Windows Batch Script to lockdown firewall and only allow a few websites with dynamic IP addresses (nslookup)

This script was pretty much an extension of my earlier work on locking down windows. The problem is that that script only really worked for locking down static IP addresses. If you had a dynamic IP address you would have to manually change the firewall rules.

This script will delete the old firewall rules, find the new IP address of a host and create a new rule using that IP address.

@ECHO OFF
netsh advfirewall set domainprofile firewallpolicy allowinbound,allowoutbound
netsh advfirewall set privateprofile firewallpolicy allowinbound,allowoutbound
netsh advfirewall set publicprofile firewallpolicy allowinbound,allowoutbound 

netsh advfirewall firewall delete rule name=all dir=out protocol=tcp remoteport=80,8080,8443,443 profile=any 

for /f "tokens=1*" %%k in ('nslookup example.com.au') do (
if [%%k]==[Address:] set address=%%l
)
netsh advfirewall firewall add rule name="example" dir=out action=allow protocol=tcp remoteport=80,8080,8443,443 remoteip=%address% profile=any 

for /f "tokens=1*" %%k in ('nslookup learning.com.au') do (
if [%%k]==[Address:] set address=%%l
)
netsh advfirewall firewall add rule name="learning" dir=out action=allow protocol=tcp remoteport=80,8080,8443,443 remoteip=%address% profile=any 

netsh advfirewall set domainprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set privateprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set publicprofile firewallpolicy blockinbound,blockoutbound

By saving this script somewhere secure you can create an event run by the inbuilt Windows Task Scheduler to run this script daily. This way you never have to worry about updating your firewalls when IP addresses change!

Locking down windows vista

Yes, it's Windows Vista. I know, I know... believe me, it has caused me more than enough pain. But the customer had already bought the product and so I grudgingly have to go in and configure this beast. So here are a few tips for others who find themselves in my predicament (and some of these tips can be used for Windows 7 and later).

This is not an exhaustive list of what you can do, but hopefully this guide can point you in the right direction...

Runing only specific applications (or not)

1. Open up gpedit.msc
2. Navigate to User Configuration -> Administrative Templates -> System -> Run only specified Windows Applications
3. Enable this setting and add the executables you wish to restrict such as winword.exe, calc.exe, firefox.exe, outlook.exe, paint.exe, and notepad.exe (NOTE: If you don't include gpedit.msc and other sysadmin applications, this policy will LOCK you out of everything!)
4. Apply the setting.
5. Alternatively, there is another setting available that acts as a blacklist of programs

Disable the command prompt

1. Open up gpedit.msc (through the run command)
2. Navigate to User Configuration -> Administrative Templates -> System -> Prevent access to command prompt
3. Enable this setting. You can also disable command prompt scipt processing

Prevent editing of the Registry

1. Open up gpedit.msc (through the run command)
2. Navigate to User Configuration -> Administrative Templates -> System -> Prevent access to registry editing tools
3. Enable this setting. You can also stop regedit from running silently in the background.

Edit the actions of Ctrl+Alt+Del

1. Open up gpedit.msc (through the run command)
2. Navigate to User Configuration -> Administrative Templates -> System -> Ctrl+Alt+Del
3. Enable or disable your desired options. These include whether the user can change their password, lock the computer, open up task manager or logg off.

Restrict Control Panel Access

1. Open up gpedit.msc (through the run command)
2. Navigate to User Configuration -> Administrative Templates -> Control Panel
3. Under the Programs sub-menu you can hide pages such as the Windows Marketplace, Features, Installed Updates, and Program Defaults.
4. You can also force the classic control panel look and even prohibit access to the control panel.

Clean up the start menu

1. Open up gpedit.msc (through the run command)
2. Navigate to User Configuration -> Administrative Templates -> Start Menu and Task Bar
3. From this directory you can remove links and items, force the classic start menu, and prevent users from rearranging the taskbar.

References

• Sean Daniel's repost of a How-To Geek post on using group policies
• Iron Geek post on locking down malicious USB's

Configure Windows via a batch script

While I primarily use *nix based systems at home and work, I am sometimes called upon to administer Windows boxes. I have finally decided to do some basic research to figure out how to automate these tasks; behold, my Windows configuration batch script!!!

Note: This script must be executed with Administrator privileges.

@ECHO OFF
net user Guard /add
sc config "CertPropSvc" start= disabled
sc config "Browser" " start= disabled
sc config "UxSms" start= disabled
sc config "DPS" start= disabled
sc config "TrkWks" start= disabled
sc config "IKEEXT" start= disabled
sc config "PcaSvc" start= disabled
sc config "EMDMgmt" start= disabled
sc config "RasAuto" start= disabled
sc config "RasMan" start= disabled
sc config "RemoteRegistry" start= disabled
sc config "SCardSvr" start= disabled
sc config "SCPolicySvc" start= disabled
sc config "LanmanServer" start= disabled
sc config "TabletInputService" start= disabled
sc config "TermService" start= disabled
sc config "WebClient" start= disabled
sc config "idsvc" start= disabled
sc config "wcncsvc" start= disabled
sc config "WMPNetworkSvc" start= disabled
sc config "WinRM" start= disabled
sc config "WinHttpAutoProxySvc" start= disabled
sc config "AppMgmt" start= disabled
sc config "WdiServiceHost" start= disabled
sc config "WdiSystemHost" start= disabled
netsh advfirewall firewall add rule name="Rule1" dir=out action=allow protocol=tcp remoteport=80,8080,8443,443 remoteip=10.0.0.60 profile=any
netsh advfirewall firewall add rule name="MAIL" dir=out action=allow protocol=tcp remoteport=110,143,993,995,25,587,465 remoteip=any profile=any
netsh advfirewall firewall add rule name="LOCAL" dir=out action=allow protocol=tcp remoteport=any remoteip=localsubnet profile=any
netsh advfirewall set domainprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set privateprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set publicprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set domainprofile state on
netsh advfirewall set privateprofile state on
netsh advfirewall set publicprofile state on

A quick rundown of what this code actually does:

• The program sc is a program that interacts with windows services. I use the config keyword to disable some services from starting.
• The netsh program does multiple things, one of which is to configure the windows firewall. In this script I add a couple of rules and apply them to the domain.
• The second line of the batch script creates a new user.

References:

• Windows Knowledge Base article about how to use 'netsh advfirewall' instead of 'netsh firewall'
• Grand Stream Dreams blog post about how to interact with windows firewall via batch scripts
• Stack overflow Q&A about creating users from the command line
• Paradineshift article about how to disable services via a batch script