Yes, you can make your system more secure by making changes to the Windows registry. However, you should be careful because making incorrect changes to the registry can make the system unstable or affect important functions. Here are some security-related registry changes you can make in Windows 12, 11 and 10:
1. Disable Remote Desktop Access:
2. Enable Secure Boot:
3. Configure User Account Control (UAC) more strictly:
4. Configure Windows Defender more tightly:
5. Disable LM and NTLM protocols:
6. Disable automatic execution of files (Autoplay):
7. Block RDP login attempts:
8. Disable the storage of LAN Manager hashes:
9. Force Windows Update:
10. Disable USB ports:
11. Important notes:
1.) Disable Remote Desktop Access:
- Path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
- Value
: Change the value of fDenyTSConnections to 1 to disable remote desktop access.
2.) Enable Secure Boot:
- Path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\State
- Value
: Check if UEFISecureBootEnabled is set to 1 to ensure that Secure Boot is enabled.
3.) Configure User Account Control (UAC) more strictly:
- Path
KKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
- Values
- Set EnableLUA to 1 to enable UAC.
- Set ConsentPromptBehaviorAdmin to 2 to ensure that consent is required for administrator actions.
4.) Configure Windows Defender more strongly:
- Path
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
- Values
- Create a new DWORD value DisableAntiSpyware and set it to 0 to make sure Windows Defender is not disabled.
- Under Real-Time Protection you can set DisableRealtimeMonitoring to 0 to enforce real-time protection.
5.) Disabling LM and NTLM protocols:
- Path
KHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
- Value
Set the value of LmCompatibilityLevel to 5 to prevent the use of LM and NTLM protocols and allow only NTLMv2.
6.) Disable automatic execution of files (autoplay):
- Path
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
- Value
Create a new DWORD value NoDriveTypeAutoRun and set it to FF to disable Autoplay on all drives.
7.) Blocking RDP login attempts:
- Path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
- Value
Create a new DWORD value MaxFailedConnect and set it to 3 to enable locking after three failed connection attempts.
8.) Disabling the storage of LAN Manager hashes:
- Path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
- Value
Create a new DWORD value NoLMHash and set it to 1 to prevent LAN Manager hashes of passwords from being stored.
9.) Force Windows Update:
- Path
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
- Value
Create a new DWORD value AUOptions and set it to 4 to force automatic updates.
10.) Disable USB ports:
- Path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR
- Value
Set the value of Start to 4 to disable USB storage devices.
11.) Important information:
- Backup:
Before making any changes to the registry, you should create a full backup of your system or at least the registry.
- Care:
Make sure you understand the exact function of the change before making it.
- Documentation:
Document all changes so that you can revert them if necessary.
By making these and similar adjustments, you can significantly improve the security of Windows systems.
