SimpleWindowsHardening

[ashledombos]

Hello,

this is my first post here, but I'm a fairly long-time WAPT user (I was fortunate enough to receive training from Tranqui IT, among others).

For a FabLab, which involves installing packages but allowing a certain degree of autonomy, I'd like to deploy the open-source software SimpleWindowsHardeningand grant access to the executable to the local administrator, who needs a degree of autonomy.

The principle of this executable is that when launched, it activates SRPs and restrictions by default and displays a window with activation and configuration buttons.

I'd like to create a WAPT package that leaves a copy of the executable on the local disk (that part is working), launches the executable (that part is working), and closes the window (I haven't been able to get that part right).

Indeed, the Python script is waiting for the process to close (I also tried launching it via a background batch file with start.exe, then running taskkill), and I don't know how to get it to proceed. At best, I get a timeout, but I only get an error code 3, and the package is considered uninstalled (I haven't been able to get the error code to work).
Do you have any suggestions?

----
WAPT 1.8 on Debian Buster, Client machines on Windows 10

[ashledombos]

Just a few additional details: SimpleWindowsHardener is a module derived from Hard_Configurator , which is more comprehensive and complex.

For those interested, the SWH manual is here, and the discussion thread started by its author is here.

[nliaudat]

Try using:

run('xxxxx',accept_returncodes=[0, 3]) or
run_notfatal('xxx')

[nliaudat]

However, I recommend installing a Samba4 domain controller and using Group Policy Objects (GPOs) to secure user access to your machines.
Some NAS devices offer all these features natively.

Alternatively, for machines with public access, there's a kiosk mode available on Windows 10.
I advise against using third-party software to secure your workstations.

For a fab lab, most of the necessary software works perfectly on Unix. That's also a good option.

[dcardon]

...
For a fab lab, most of the necessary software works perfectly on Unix. It's also a good option

In addition, the WAPT agent for Linux works very well now.