all-the-rest.json: Re-define Windows Basic Service Set - Githubissues

Linuxfabrik / monitoring-plugins

220+ check plugins for Icinga and other Nagios-compatible monitoring applications. Each plugin is a standalone command line tool (written in Python) that provides a specific type of check.

https://linuxfabrik.ch

The Unlicense

214 stars 50 forks source link

all-the-rest.json: Re-define Windows Basic Service Set #427

Closed NavidSassan closed 2 years ago

NavidSassan commented 3 years ago

In GitLab by @markuslf on Oct 18, 2021, 21:54

We have to re-define/rewrite all "Service - ..." definitions in (all?) "OS - Windows Basic Service Set"s.

What we have to check according to https://docs.microsoft.com/en-us/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server are:

Services that are common on Windows Server 2016, Windows Server 2019 and Windows 10
Only services that are always installed
Only services with Startup type "Automatic"
Only services where the recommendation is "Do not disable"
Only services that are allowed to run according to CIS

I checked everything. The result is the following list. Please implement:

BFE (Base Filtering Engine)
BrokerInfrastructure (Background Tasks Infrastructure Service)
CDPSvc (Connected Devices Platform Service)
CoreMessagingRegistrar (CoreMessaging)
CryptSvc (Cryptographic Services)
DcomLaunch (DCOM Server Process Launcher)
Dhcp (DHCP Client)
DiagTrack (Connected User Experiences and Telemetry)
Dnscache (DNS Client)
DPS (Diagnostic Policy Service)
EventLog (Windows Event Log)
EventSystem (COM+ Event System)
FontCache (Windows Font Cache Service)
gpsvc (Group Policy Client)
iphlpsvc (IP Helper)
LanmanWorkstation (Workstation)
LSM (Local Session Manager)
mpssvc (Windows Defender Firewall)
MSDTC (Distributed Transaction Coordinator)
NlaSvc (Network Location Awareness)
nsi (Network Store Interface Service)
Power (Power)
ProfSvc (User Profile Service)
RpcEptMapper (RPC Endpoint Mapper)
RpcSs (Remote Procedure Call (RPC)
SamSs (Security Accounts Manager)
Schedule (Task Scheduler)
SENS (System Event Notification Service)
SysMain (SysMain)
SystemEventsBroker (System Events Broker)
Themes (Themes)
TimeBrokerSvc (Time Broker)
UserManager (User Manager)
W32Time (Windows Time)
Winmgmt (Windows Management Instrumentation)

NavidSassan commented 3 years ago

In GitLab by @markuslf on Oct 18, 2021, 21:56

mentioned in issue support#1595

NavidSassan commented 3 years ago

mentioned in commit fac0d878468c77f1640521e63ade73163641fff7

NavidSassan commented 3 years ago

TimeBrokerSvc - Start Type is "manual", but supposed to be "automatic" consistent with the docs: https://docs.microsoft.com/en-us/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#time-broker

should i remove it from the service set?

NavidSassan commented 3 years ago

disabling TimeBrokerSvc for now

NavidSassan commented 3 years ago

mentioned in commit ab620f87e93922b6a018017ae8ea831b52427608

NavidSassan commented 2 years ago

mentioned in commit 269b36c4380ca2ed5a3615b0accdab89136d4dfa