How Windows hardening techniques can improve Windows 10

Microsoft makes much ado about Windows 10 from a security standpoint, and the company often claims it's the most secure of all the Windows clients so far.

Be that as it may, there are still plenty of things savvy Windows admins can do to further harden Windows 10 against attacks, especially when constructing reference or canonical Windows images for desktop deployments. Apply a small set of basic security principles to crafting such an image, and the result will be more secure than what Microsoft provides out of the box.

Applying basic security principles to Windows image construction

Windows admins often use tools such as Sysprep, Microsoft's System Preparation tool, to create a reference Windows image for later desktop deployment. The relevant security principles to keep in mind when doing this begin with understanding OS hardening.

Hardening an installation is about securing the OS and the applications that a system -- in this case, a Windows 10 client -- will use. The fundamental idea is to eliminate or reduce attack surfaces to repel or impede attackers. Thus, key goals for Windows hardening must include all the available means to deny, deter or delay attacks of any kind.

To harden Windows, the best approach begins with turning off or disabling any feature in Windows that isn't being used. This ensures that, if a feature isn't present or isn't active, it presents no attack surface for an attacker to exploit.

Applying the principle of least privilege further protects hardened systems from attack. In security circles, the principle of least privilege means providing access rights and privileges that permit users to do their jobs, and nothing more. This starts with establishing an account policy that requires all users to log into standard user accounts to perform ordinary tasks.

Admins themselves should log in with administrative privileges only when they need to perform administrative tasks, and should stay logged in that way only long enough to complete them. In fact, administrative tasks that can be automated should be to minimize the amount of time administrators are logged in with administrative privileges. Administrative tasks can include installing programs; configuring systems, services and networks; and performing system maintenance tasks, such as backups, updates, patches and configuration or system management.

If admins look at what they do with Windows 10 with these principles in mind, they'll understand what they must do to harden Windows 10 or other clients against attack.

Initial approach to Windows hardening

Building a hardened system image is different from a typical installation. An administrator would normally disconnect the workstation on which such an image is to be created from the network -- either by disconnecting the wired network cable in conventional Ethernet networks or by disabling Wi-Fi on devices connecting through a wireless internet connection.

The next step is to use a bootable USB installer to perform an upgrade install, if modifying an existing image, or a clean install, if creating a new image. Supplying an OS may be skipped during the initial image creation, or a file named PID.TXT can be inserted in the …\Sources directory of the USB installer that includes the volume license key to be used for all applicable client installations.

For more details about the process, see sidebar.

Customizing the Windows 10 image

The next step for Windows hardening is to customize the base Windows 10 image in Audit Mode using Sysprep. When the Settings dialog box appears during the final phase of Windows 10 installation, instead of choosing Customize or Express Settings, hold down the CTRL and SHIFT keys and then press the F3 function key. Windows will reboot in Audit Mode and display the Sysprep dialog box. There are a few other tasks to finish before using Sysprep, so press Cancel to close this dialog box and continue.

The next task is installing the Windows Assessment and Deployment Kit, which provides access to the Windows System Image Manager (SIM). Use SIM to create and modify the answer file for Sysprep to create an image customized to your specifications, and then complete and customize a reference Windows image. Call this "Windows 10 base, version xxxx," where "xxxx" reflects the current version branch number.

Maintaining a hardened Windows image

Over time, the base image will need to be updated and amended as requirements evolve and software is updated. This requires that you repeat the same steps described for customizing a base image.

For example, when Windows 10 changes build numbers (such as upgrading from 1511 to 1607), it is necessary to start over from scratch. Otherwise, you can start your update with the base image (to which updates may be applied), and then rebuild the Sysprep file to update any applications, settings or account information.

Always use an explicit file-naming convention, and create new files when making changes. That way, it's possible to return to the previous base and apps versions should a mistake be made or should any problems arise during image creation or the modification/customization processes.

Remember to apply the basic Windows hardening principles described in the introduction to this article so you'll never stray too far off the path of keeping your Windows systems safe and secure. When in doubt, ask how your contemplated changes meet one or more of those principles before making them permanent. If you can't make a good argument as to why or how a planned change or introduction keeps Windows secure, the change is probably not worth introducing.