windows_hardening VS workspaces-core-images

You can try this tool, or some other similar tool. It hardens Windows 10 using the latest guidelines from several organisations. Of course you need to be careful doing this, it can very easily ruin your Windows installation.

Endpoint-based prevention: Harden endpoints, including browser settings (https://www.cisa.gov/uscert/publications/securing-your-web-browser; https://stigviewer.com/stig/google_chrome_browser/) and software firewall including ingress and egress rules (https://www.stigviewer.com/stig/microsoft_windows_firewall_with_advanced_security/2021-10-15/). If you're primarily worried about Windows endpoints, take a look at Hardening Kitty and the solid STIG-based Windows Firewall list (https://github.com/0x6d69636b/windows_hardening/blob/master/lists/finding_list_dod_windows_firewall_stig_v1r7.csv) for some relatively easy wins.

#1: "HardeningKitty was created to simplify the hardening of Windows. Now, HardeningKitty supports guidelines from Microsoft, CIS Benchmarks, DoD STIG and BSI SiSyPHuS Win10. And of course [their] own hardening list." | 20 comments #2: For those that work in IT Admin, what are the key Powershell Commands that every admin should know? #3: I wrote the mother-of-all onboarding scripts and now everyone blames me for everything...

The above documents mandate a lot of testing and analysis, together with potential design decisions you are not in a position to make; still - you should dedicate the time to do it "properly" from the beginning. Anyhow, in case you are a renegade daredevil - HardeningKitty to the rescue https://github.com/0x6d69636b/windows_hardening =]

#1: /u/betterthangoku has passed away #2: "HardeningKitty was created to simplify the hardening of Windows. Now, HardeningKitty supports guidelines from Microsoft, CIS Benchmarks, DoD STIG and BSI SiSyPHuS Win10. And of course [their] own hardening list." | 20 comments #3: For those that work in IT Admin, what are the key Powershell Commands that every admin should know?

The copy script resides within the Core images and can be adjusted if necessary. It is visible in the workspaces-core-images Github Repo

Another option could be to let the servers just boot into webbrowser and then do somethign VDI (Vitual Desktop infrastructure), for example KASAM: https://www.kasmweb.com/ This would also address/ solve/ simplify many of the mentioned issues above.

https://www.kasmweb.com/ is a popular new solution in this space. I've played around with https://docs.linuxserver.io/images/docker-webtop which is based on their kasmvnc and even in the non lossless mode if feels quite snappy.

I read about Kasm Workspaces here on selfhosted and really wanted to try it out on my Ubuntu VPS. Problem is, I use Traefik for my reverse proxy and it's not technically supported by Kasm. There are also very few hits on searches for the two platforms together, and the information that's available is not very helpful. Maybe I'm the only person really interested in this 😂 but after a lot of time spent figuring it out I decided to write my own guide in case someone else is too. This assumes you already have Traefik setup and running on port 443. The files are available at my Github project.

Check out KASM - https://www.kasmweb.com/ - you can actually play many of your Steam games from it with GPU acceleration.

You could spin up something like Kasm Workspaces, Neko or Docker Webtop.

- The Workspaces Images and Workpaces Core images, are both open source projects that include the image dockerfiles and associated scripts for building the end-user containers such as Chrome , Brave, Ubuntu desktop, etc. You can view the code and licenses here: https://github.com/kasmtech/workspaces-images/blob/develop/LICENSE.md , https://github.com/kasmtech/workspaces-core-images/blob/develop/LICENSE.md

Check out https://www.kasmweb.com/. You could setup a persistent profile storage on a linux distro of your choosing and have all the bookmarks saved there or even have it open chrome directly with all your shortcuts right from the website using 2fa to protect everything.