From 5bd366ceca2e2e045530118541802d85859e4031 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Carr=C3=B3n?= Date: Sun, 28 Apr 2024 13:19:17 +0200 Subject: [PATCH] First release Here's an improved version of the text in English: The following modules have been added: - Disabled IPv6 - Disabled SMB - Disabled Remote Desktop - Blocked all incoming connections - Set AdguardDNS server as default - Enabled protection against potentially unwanted applications (PUA) - Set User Account Control (UAC) to maximum - Activated automatic Windows Updates by default - Activated automatic Store Updates by default - Enabled UAC Secure Desktop by default - Removed branding from OEM information --- README.md | 32 +++++++--------- src/playbook/Configuration/tweaks.yml | 32 ++++------------ .../tweaks/misc/config-oem-information.yml | 29 --------------- .../networking/block-incoming-connections.yml | 4 ++ .../tweaks/networking/set-adguarddns.yml | 9 +++++ .../shares/disable-smb-protocols.yml | 8 ++++ .../tweaks/qol/disable-store-auto-updates.yml | 9 ----- .../security/disable-uac-secure-desktop.yml | 9 ----- .../windows-update/disable-auto-updates.yml | 31 ---------------- .../tweaks/security/disable-ipv6.yml | 10 +++++ .../security/disable-remote-desktop.yml | 13 +++++++ .../tweaks/security/enable-pua-protection.yml | 5 +++ .../tweaks/security/uac-maximum.yml | 24 ++++++++++++ src/playbook/local-build.cmd | 2 +- src/playbook/playbook.conf | 37 ++++++------------- 15 files changed, 107 insertions(+), 147 deletions(-) delete mode 100644 src/playbook/Configuration/tweaks/misc/config-oem-information.yml create mode 100644 src/playbook/Configuration/tweaks/networking/block-incoming-connections.yml create mode 100644 src/playbook/Configuration/tweaks/networking/set-adguarddns.yml create mode 100644 src/playbook/Configuration/tweaks/networking/shares/disable-smb-protocols.yml delete mode 100644 src/playbook/Configuration/tweaks/qol/disable-store-auto-updates.yml delete mode 100644 src/playbook/Configuration/tweaks/qol/security/disable-uac-secure-desktop.yml delete mode 100644 src/playbook/Configuration/tweaks/qol/windows-update/disable-auto-updates.yml create mode 100644 src/playbook/Configuration/tweaks/security/disable-ipv6.yml create mode 100644 src/playbook/Configuration/tweaks/security/disable-remote-desktop.yml create mode 100644 src/playbook/Configuration/tweaks/security/enable-pua-protection.yml create mode 100644 src/playbook/Configuration/tweaks/security/uac-maximum.yml diff --git a/README.md b/README.md index 034b354bc4..f74b6160e1 100644 --- a/README.md +++ b/README.md @@ -1,12 +1,9 @@ -

A fork of AtlasOS focused on security, without leaving behind usability and performance.

+

A fork of AtlasOS that focuses on security without compromising usability or performance.

- ๐ŸŒ AtlasOS Website - โ€ข - ๐Ÿ“š AtlasOS Documentation - โ€ข - โ˜Ž๏ธ AtlasOS Discord - โ€ข + ๐ŸŒ AtlasOS Website | + ๐Ÿ“š AtlasOS Documentation | + โ˜Ž๏ธ AtlasOS Discord | ๐Ÿ’ฌ AtlasOS Forum

@@ -17,25 +14,24 @@ - [Branding](https://docs.atlasos.net/branding/) ## ๐Ÿค” What is SecOS? -SecOS is an open source fork of AtlasOS that enhances Windows by eliminating factors that negatively affect performance. -SecOS focuses on security as it focuses on the daily use of Windows to ensure end-user safety. +SecOS is an open-source fork of AtlasOS that improves Windows by eliminating factors that negatively impact performance. It emphasizes security to ensure user protection during daily use of Windows. -## ๐Ÿ‘€ Why SecOS? +## ๐Ÿ‘€ Why Choose SecOS? -As computer geeks, we all have family members who don't use their computers primarily for gaming. SecOS aims to provide these types of users with a fast user experience, similar to AtlasOS, but with a stronger focus on security and privacy. +SecOS is designed for users who want a fast, secure experience similar to AtlasOS but with a greater emphasis on security and privacy. It is ideal for those who don't primarily use their computers for gaming. -Trying to follow Microsoft's official methods. +SecOS adheres to Microsoft's official methods. ### ๐Ÿ” Open Source and Transparent -Unlike custom Windows ISOs, Atlas is more straightforward to audit due to the use of [AME Wizard](https://ameliorated.io). AME Wizard is controlled by Playbooks, a customizable script-esque system that can perform various tasks. +Unlike custom Windows ISOs, SecOS easier to audit due to the use of [AME Wizard](https://ameliorated.io). AME Wizard is controlled by Playbooks, a customizable script-like system that can perform various tasks. -Playbooks are renamed **.zip** archives, with the password [`malte`](https://docs.ameliorated.io/developers/getting-started/creation.html). As they primarily consist of plain text, Playbooks enable transparency, unlike custom Windows ISOs, which have many entry points for malicious activity. The few binaries in the Playbook are open source in our [`utilities` repository](https://github.com/Atlas-OS/utilities), with the [hashes listed here](https://github.com/Atlas-OS/Atlas/blob/main/src/playbook/Executables/AtlasModules/README.md). +Playbooks are **.zip** files with the password [`malte`](https://docs.ameliorated.io/developers/getting-started/creation.html). Since they primarily consist of plain text, Playbooks offer transparency, unlike custom Windows ISOs, which have many entry points for malicious activity. The few binaries in the Playbook are open source in our [`utilities` repository](https://github.com/Atlas-OS/utilities), with the [hashes listed here](https://github.com/Atlas-OS/Atlas/blob/main/src/playbook/Executables/AtlasModules/README.md). -Although the GUI is not open source for AME Wizard, AME Wizard's entire backend (called [TrustedUninstaller](https://github.com/Ameliorated-LLC/trusted-uninstaller-cli)) is open source under MIT, which contains each action used to run SecOS. The SecOS Playbook is open source under the [GPLv3 license](https://github.com/iamcarron/SecOS/blob/main/LICENSE). +Although the GUI of AME Wizard is not open source, the entire backend (called [TrustedUninstaller](https://github.com/Ameliorated-LLC/trusted-uninstaller-cli)) is open source under MIT and contains each action used to run SecOS. The SecOS Playbook is open source under the [GPLv3 license](https://github.com/iamcarron/SecOS/blob/main/LICENSE). ### ๐Ÿ”’ Legal Compliance -As SecOS doesn't redistribute a modified Windows ISO, it complies with [Windows's Usage Terms](https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/UseTerms_Retail_Windows_10_English.htm). In addition, SecOS does not alter activation in Windows. +SecOS complies with [Windows's Usage Terms](https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/UseTerms_Retail_Windows_10_English.htm) because it doesn't redistribute a modified Windows ISO. Additionally, SecOS does not alter Windows activation. -### ๐Ÿค Contribution -SecOS arises as a project for a class work, so it is not guaranteed to have recurring updates and very often, so any contribution is appreciated! +### ๐Ÿค Contributions +SecOS began as a class project, so frequent updates are not guaranteed. Contributions are welcome and appreciated to help improve the project. \ No newline at end of file diff --git a/src/playbook/Configuration/tweaks.yml b/src/playbook/Configuration/tweaks.yml index da04d676a4..b09cae0921 100644 --- a/src/playbook/Configuration/tweaks.yml +++ b/src/playbook/Configuration/tweaks.yml @@ -1,6 +1,6 @@ --- title: Tweaks Root Playbook File -description: Runs all of the Atlas playbook tweaks +description: Runs all of the SecOS playbook tweaks actions: [] tasks: # ------------------------- NOTES ------------------------- # @@ -27,6 +27,8 @@ tasks: - tweaks\statuses\status-networking.yml - tweaks\networking\disable-llmnr.yml - tweaks\networking\atlas-network-settings.yml + - tweaks\networking\block-incoming-connections.yml + - tweaks\networking\set-adguarddns.yml # -------------------------------------------------------------------------- # # networking\shares # @@ -34,8 +36,7 @@ tasks: - tweaks\networking\shares\restrict-anonymous-access.yml - tweaks\networking\shares\restrict-anonymous-enumeration.yml - tweaks\networking\shares\disable-smb-bandwidth-throttling.yml - - + - tweaks\networking\shares\disable-smb-protocols.yml # ----------------------------------------------------- # Performance @@ -54,7 +55,6 @@ tasks: - tweaks\performance\disable-fth.yml - tweaks\performance\disable-sleep-study.yml - # -------------------------------------------------------------------------- # # performance\system # # -------------------------------------------------------------------------- # @@ -64,8 +64,6 @@ tasks: - tweaks\performance\system\disable-service-host-split.yml - tweaks\performance\system\win32-priority-seperation.yml - - # ----------------------------------------------------- # Privacy # ----------------------------------------------------- @@ -124,8 +122,6 @@ tasks: - tweaks\privacy\telemetry\disable-input-telemetry.yml - tweaks\privacy\telemetry\disallow-data-collection.yml - - # ----------------------------------------------------- # QOL # ----------------------------------------------------- @@ -146,7 +142,6 @@ tasks: - tweaks\qol\disable-mouse-accel.yml - tweaks\qol\disable-settings-tips.yml - tweaks\qol\disable-spell-checking.yml - - tweaks\qol\disable-store-auto-updates.yml - tweaks\qol\disable-touch-keyboard-features.yml - tweaks\qol\disable-touch-visual-feedback.yml - tweaks\qol\disable-usb-issues-notifications.yml @@ -173,7 +168,6 @@ tasks: - tweaks\qol\windows-update\disable-insider.yml - tweaks\qol\windows-update\disable-msrt-telemetry.yml - tweaks\qol\windows-update\disable-feature-updates.yml - - tweaks\qol\windows-update\disable-auto-updates.yml - tweaks\qol\windows-update\disable-auto-reboot.yml - tweaks\qol\windows-update\disable-delivery-optimization.yml @@ -232,11 +226,6 @@ tasks: - tweaks\qol\explorer\remove-context-menus\share.yml - tweaks\qol\explorer\remove-context-menus\troubleshooting-compat.yml - # -------------------------------------------------------------------------- # - # qol\security # - # -------------------------------------------------------------------------- # - - tweaks\qol\security\disable-uac-secure-desktop.yml - # -------------------------------------------------------------------------- # # qol\shell # # -------------------------------------------------------------------------- # @@ -283,8 +272,6 @@ tasks: - tweaks\qol\taskbar\set-to-left.yml - tweaks\qol\taskbar\end-task.yml - - # ----------------------------------------------------- # Security # ----------------------------------------------------- @@ -297,8 +284,10 @@ tasks: - tweaks\security\block-anonymous-enum-sam.yml - tweaks\security\delete-defaultuser0.yml - tweaks\security\disable-remote-assistance.yml - - + - tweaks\security\disable-ipv6.yml + - tweaks\security\disable-remote-desktop.yml + - tweaks\security\enable-pua-protection.yml + - tweaks\security\uac-maximum.yml # ----------------------------------------------------- # Debloat @@ -315,8 +304,6 @@ tasks: - tweaks\debloat\hide-unused-security-pages.yml - tweaks\debloat\config-storage-sense.yml - - # ----------------------------------------------------- # Scripts # ----------------------------------------------------- @@ -335,8 +322,6 @@ tasks: - tweaks\scripts\script-backup2.yml - tweaks\scripts\script-clientcbs.yml - - # ----------------------------------------------------- # Misc # ----------------------------------------------------- @@ -348,7 +333,6 @@ tasks: - tweaks\statuses\status-misc.yml - tweaks\misc\config-time.yml - tweaks\misc\delete-windows-specific-files.yml - - tweaks\misc\config-oem-information.yml - tweaks\misc\rebuild-perf-counters.yml - tweaks\misc\create-shortcuts.yml - tweaks\misc\add-music-videos-to-home.yml diff --git a/src/playbook/Configuration/tweaks/misc/config-oem-information.yml b/src/playbook/Configuration/tweaks/misc/config-oem-information.yml deleted file mode 100644 index 9aaf356e6e..0000000000 --- a/src/playbook/Configuration/tweaks/misc/config-oem-information.yml +++ /dev/null @@ -1,29 +0,0 @@ ---- -title: Configure OEM Information -description: Configures OEM information to contain the Atlas version and the Atlas Discord server -actions: - - !registryValue: - path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation' - value: 'Manufacturer' - data: 'Atlas Team' - type: REG_SZ - - !registryValue: - path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation' - value: 'Model' - data: 'AtlasOS v0.4.0' - type: REG_SZ - - !registryValue: - path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation' - value: 'SupportURL' - data: 'https://discord.atlasos.net' - type: REG_SZ - - !registryValue: - path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation' - value: 'SupportPhone' - data: 'https://github.com/Atlas-OS/Atlas' - type: REG_SZ - - !registryValue: - path: 'HKLM\SOFTWARE\Atlas' - value: 'WinreFallbackFixed' - data: '1' - type: REG_SZ diff --git a/src/playbook/Configuration/tweaks/networking/block-incoming-connections.yml b/src/playbook/Configuration/tweaks/networking/block-incoming-connections.yml new file mode 100644 index 0000000000..eae82ea732 --- /dev/null +++ b/src/playbook/Configuration/tweaks/networking/block-incoming-connections.yml @@ -0,0 +1,4 @@ +title: Block All Incoming Connections with Microsoft Defender Firewall +description: To enhance network security, Microsoft Defender Firewall is configured to block all incoming connections. +actions: + - !run: {exe: 'netsh', args: 'advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound'} \ No newline at end of file diff --git a/src/playbook/Configuration/tweaks/networking/set-adguarddns.yml b/src/playbook/Configuration/tweaks/networking/set-adguarddns.yml new file mode 100644 index 0000000000..90bbd13046 --- /dev/null +++ b/src/playbook/Configuration/tweaks/networking/set-adguarddns.yml @@ -0,0 +1,9 @@ +--- +title: Configure AdguardDNS +description: Set the DNS server to AdguardDNS for improved privacy and security. +actions: + - !registryValue: + path: 'HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{InterfaceGUID}' + value: 'NameServer' + data: '94.140.14.14,94.140.15.15' + type: REG_SZ \ No newline at end of file diff --git a/src/playbook/Configuration/tweaks/networking/shares/disable-smb-protocols.yml b/src/playbook/Configuration/tweaks/networking/shares/disable-smb-protocols.yml new file mode 100644 index 0000000000..0a11e663d2 --- /dev/null +++ b/src/playbook/Configuration/tweaks/networking/shares/disable-smb-protocols.yml @@ -0,0 +1,8 @@ +--- +title: Disable SMB Protocols +description: Disabling SMB protocols to enhance the security of the Windows system and minimize vulnerabilities. +actions: + - !run: {exe: 'powershell', args: 'Set-SmbServerConfiguration -EnableSMB1Protocol $false -Confirm:$false'} + - !run: {exe: 'powershell', args: 'Set-SmbServerConfiguration -EnableSMB2Protocol $false -Confirm:$false'} + + diff --git a/src/playbook/Configuration/tweaks/qol/disable-store-auto-updates.yml b/src/playbook/Configuration/tweaks/qol/disable-store-auto-updates.yml deleted file mode 100644 index f72495bf2f..0000000000 --- a/src/playbook/Configuration/tweaks/qol/disable-store-auto-updates.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -title: Disable Automatic Updates for Apps in Store -description: Disables automatic updates for apps in Store so that the user has more control -actions: - - !registryValue: - path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate' - value: 'AutoDownload' - data: '2' - type: REG_DWORD diff --git a/src/playbook/Configuration/tweaks/qol/security/disable-uac-secure-desktop.yml b/src/playbook/Configuration/tweaks/qol/security/disable-uac-secure-desktop.yml deleted file mode 100644 index fad21c0f42..0000000000 --- a/src/playbook/Configuration/tweaks/qol/security/disable-uac-secure-desktop.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -title: Disable UAC Secure Desktop -description: Disables switching to the Secure Desktop when prompting for elevation. An application would need admin privileges to control the mouse and keyboard to accept the UAC prompt anyways. As a note, UAC is not designed to save you from malware, UAC can easily be bypassed on admin accounts (e.g. check GitHub) -actions: - - !registryValue: - path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' - value: 'PromptOnSecureDesktop' - data: '0' - type: REG_DWORD diff --git a/src/playbook/Configuration/tweaks/qol/windows-update/disable-auto-updates.yml b/src/playbook/Configuration/tweaks/qol/windows-update/disable-auto-updates.yml deleted file mode 100644 index 72e4c10e44..0000000000 --- a/src/playbook/Configuration/tweaks/qol/windows-update/disable-auto-updates.yml +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: Disable WU Auto-Updates -description: Disables Windows Update from automatically updating Windows for QoL, at the cost of security. -actions: - # Disable auto-updates - - !cmd: - command: 'reg import "AtlasDesktop\3. General Configuration\Windows Update\Automatic Updates\Disable Automatic Updates (default).reg"' - exeDir: true - wait: true - option: 'disable-auto-updates' - - # Prevent DevHome & Outlook from re-installing - - !registryKey: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator\UScheduler\DevHomeUpdate'} - - !registryKey: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator\UScheduler\OutlookUpdate'} - - # Prevent random apps from installing, including Widgets or advertisements - # Commented until it's proven that this helps - deleting these values is irreversible - # - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator\Settings', value: 'STOREBIZCRITICALAPPS', operation: delete} - # - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State\CategoryCache', value: '48caba8a-2e62-2097-dcd8-4255c637b32dUS', operation: delete} - # - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell\Update\Packages\Components', value: 'AccountsService', operation: delete} - # - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell\Update\Packages\Components', value: 'BackupBanner', operation: delete} - # - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell\Update\Packages\Components', value: 'DesktopSpotlight', operation: delete} - # - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell\Update\Packages\Components', value: 'IrisService', operation: delete} - # - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell\Update\Packages\Components', value: 'SystemSettingsExtensions', operation: delete} - # - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell\Update\Packages\Components', value: 'WebExperienceHost', operation: delete} - # - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell\Update\Packages\Components', value: 'WindowsBackup', operation: delete} - # - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\LastOnlineScanTimeForAppCategory\855E8A7C-ECB4-4CA3-B045-1DFA50104289', value: 'EA6A8EC8-24BF-48A3-B0F0-A86A6447C0E2', operation: delete} - # - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RequestedAppCategories\855E8A7C-ECB4-4CA3-B045-1DFA50104289', value: 'EA6A8EC8-24BF-48A3-B0F0-A86A6447C0E2', operation: delete} - # - !registryValue: {path: 'HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules', value: '{5D2C72C6-969D-4C1E-8484-41ED53782351}', data: 'v2.32|Action=Block|Active=TRUE|Dir=Out|Profile=Domain|Profile=Private|Profile=Public|RA42=IntErnet|RA62=IntErnet|Name=Windows Web Experience Pack|Desc=Windows Web Experience Pack|LUAuth=O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)|LUOwn=S-1-5-21-1752034362-1788923297-4099944-1001|AppPkgId=S-1-15-2-1312876954-3728250218-3694470604-4188764552-3197360367-780678243-3229644300|EmbedCtxt=Windows Web Experience Pack|'} - # - !registryValue: {path: 'HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules', value: '{26037439-AD8B-4A56-AF2E-F6CDDB59F6BE}', data: 'v2.32|Action=Block|Active=TRUE|Dir=Out|Profile=Domain|Profile=Private|Profile=Public|Name=Windows Web Experience Pack|Desc=Windows Web Experience Pack|LUOwn=S-1-5-21-1752034362-1788923297-4099944-1001|AppPkgId=S-1-15-2-1312876954-3728250218-3694470604-4188764552-3197360367-780678243-3229644300|EmbedCtxt=Windows Web Experience Pack|Platform=2:6:2|Platform2=GTEQ|'} - # - !registryValue: {path: 'HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules', value: '{44000509-BE9E-419B-A60B-54E62CF41203}', data: 'v2.32|Action=Block|Active=TRUE|Dir=Out|Profile=Domain|Profile=Private|Profile=Public|Name=Windows Web Experience Pack|Desc=Windows Web Experience Pack|LUOwn=S-1-5-21-2784447539-1655915103-1638202157-1001|AppPkgId=S-1-15-2-1312876954-3728250218-3694470604-4188764552-3197360367-780678243-3229644300|EmbedCtxt=Windows Web Experience Pack|'} diff --git a/src/playbook/Configuration/tweaks/security/disable-ipv6.yml b/src/playbook/Configuration/tweaks/security/disable-ipv6.yml new file mode 100644 index 0000000000..130b8b2e72 --- /dev/null +++ b/src/playbook/Configuration/tweaks/security/disable-ipv6.yml @@ -0,0 +1,10 @@ +--- +title: Disable IPv6 +description: As IPv6 may introduce security vulnerabilities in some network environments, it is disabled to improve security. +actions: + - !registryValue: + path: 'HKLM\SYSTEM\CurrentControlSet\services\tcpip6\parameters' + value: 'DisabledComponents' + data: '0' + type: REG_DWORD + - !run: {exe: 'powershell', args: 'Get-NetAdapterBinding โ€“ComponentID โ€œms_tcpip6โ€ | disable-NetAdapterBinding โ€“ComponentID โ€œms_tcpip6โ€ โ€“PassThru'} diff --git a/src/playbook/Configuration/tweaks/security/disable-remote-desktop.yml b/src/playbook/Configuration/tweaks/security/disable-remote-desktop.yml new file mode 100644 index 0000000000..3f879e4a2a --- /dev/null +++ b/src/playbook/Configuration/tweaks/security/disable-remote-desktop.yml @@ -0,0 +1,13 @@ +title: Disable Remote Desktop +description: Disable Remote Desktop to enhance system security and prevent unauthorized access. +actions: + - !registryValue: + path: 'HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server' + value: 'fDenyTSConnections' + data: '1' + type: REG_DWORD + - !registryValue: + path: 'HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' + value: 'UserAuthentication' + data: '1' + type: REG_DWORD diff --git a/src/playbook/Configuration/tweaks/security/enable-pua-protection.yml b/src/playbook/Configuration/tweaks/security/enable-pua-protection.yml new file mode 100644 index 0000000000..b460432a0e --- /dev/null +++ b/src/playbook/Configuration/tweaks/security/enable-pua-protection.yml @@ -0,0 +1,5 @@ +--- +title: Enable PUA Protection +description: Enable the protection against Potentially Unwanted Applications (PUA) using Microsoft Defender. +actions: + - !run: {exe: 'powershell', args: '-Command "Set-MpPreference -PUAProtection Enabled"'} \ No newline at end of file diff --git a/src/playbook/Configuration/tweaks/security/uac-maximum.yml b/src/playbook/Configuration/tweaks/security/uac-maximum.yml new file mode 100644 index 0000000000..5967de362e --- /dev/null +++ b/src/playbook/Configuration/tweaks/security/uac-maximum.yml @@ -0,0 +1,24 @@ +--- +title: Set User Account Control (UAC) to Maximum +description: To enhance system security, UAC is set to its highest level, requiring the user's permission for all actions. +actions: + - !registryValue: + path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' + value: 'ConsentPromptBehaviorAdmin' + data: '2' + type: REG_DWORD + - !registryValue: + path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' + value: 'ConsentPromptBehaviorUser' + data: '1' + type: REG_DWORD + - !registryValue: + path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' + value: 'EnableLUA' + data: '1' + type: REG_DWORD + - !registryValue: + path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' + value: 'PromptOnSecureDesktop' + data: '1' + type: REG_DWORD diff --git a/src/playbook/local-build.cmd b/src/playbook/local-build.cmd index b41c6b168f..427fbbc9b4 100644 --- a/src/playbook/local-build.cmd +++ b/src/playbook/local-build.cmd @@ -5,7 +5,7 @@ # Do not change anything here, this is simply for reference $defaultConfig = @{ # Name of resulting APBX - fileName = "Atlas Test" + fileName = "SecOS" # Should the script delete any playbook that already exists with the same name or not # If not, it will make something like "Atlas Test (1).apbx" diff --git a/src/playbook/playbook.conf b/src/playbook/playbook.conf index 5ed4fec682..562237260e 100644 --- a/src/playbook/playbook.conf +++ b/src/playbook/playbook.conf @@ -1,17 +1,12 @@ - AtlasOS - Atlas - AtlasOS Playbook v0.4.0 - AtlasOS Playbook for Windows 10 and 11 - + SecOS + SecOS + SecOS Playbook v0.1.0 + SecOS Playbook for Windows 10 and 11 + SecOS is an open source fork of AtlasOS that enhances Windows by focuses on security as it focuses on the daily use of Windows to ensure end-user safety.>
An open and lightweight modification to Windows, designed to optimize performance, privacy and security.
- + 0.4.0 19045 @@ -28,9 +23,7 @@ Atlas makes your computer snappier and more private with lots of usability impro false 64 15 - https://github.com/Atlas-OS/Atlas - https://atlasos.net - https://ko-fi.com/atlasos + https://github.com/IamCarron/SecOS @@ -60,16 +53,16 @@ Atlas makes your computer snappier and more private with lots of usability impro - + - Disable Core Isolation (recommended) - vbs-disable + Enable Core Isolation (recommended) + vbs-default Windows Default - vbs-default + vbs-disable @@ -97,10 +90,6 @@ Atlas makes your computer snappier and more private with lots of usability impro Disable Hibernation disable-hibernation - - Disable Automatic Updates - disable-auto-updates - Remove Snipping Tool App remove-snipping-tool @@ -110,10 +99,6 @@ Atlas makes your computer snappier and more private with lots of usability impro - - Disable Notifications - disable-notifications - Remove Microsoft Edge uninstall-edge