PSM Hardening Tasks

This section describes the hardening task procedures. Use this reference to troubleshoot your automatic installation or manually perform these steps.

The hardening script

The PSM hardening procedure on the PSM server machine enhances PSM security. The PSM Hardening script is copied to the PSM machine as part of the installation, to the <PSM installation folder>\Hardening folder.

 

If you are using the automated installation script, several steps are done during the Hardening stage.

 

To configure the PSM users’ passwords when installing the PSM on AWS, refer to Amazon Web Services before hardening the PSM server machine.

Run the hardening script

 

If you are using the automated installation script, this step is done during the Hardening stage.

Perform the following procedures to run the hardening script.

After running the hardening script

 

If you are using the automated installation script, these steps are done during the Hardening stage.

Hide PSM local drives in PSM sessions

This procedure hides the PSM local drives in the PSM sessions. It is applied automatically.

If you add a new local drive to the PSM machine, run the Hardening stage again with the Runs post hardening tasks step enabled to apply the hiding policy on the newly added drive. Before running the Hardening stage, any PSM local Shadow user in the system must be removed, along with its user profile.

Block Internet Explorer developer tools

This procedure blocks Internet Explorer development tools when connecting to web sites through the PSM.

Internet Explorer developer tools are blocked in the PSM in order to prevent end users who connect via the PSM from accessing it.

Block the Internet Explorer context menu

This procedure blocks Internet Explorer context menus when connecting to web sites through PSM.

The Internet Explorer context menu in the PSM is blocked in order to prevent end users from adding the developer tools.

Run AppLocker rules

 

If you are using the automated installation script, this step is done during the Hardening stage.

To create a hardened and secure PSM environment, the system must limit the applications that can be launched during a PSM session. To do this, the PSM uses the Windows AppLocker feature, which defines a set of rules that allow or deny applications from running on the PSM machine, based on unique file identities. These rules specify which users or groups can run those applications.

The PSM installation includes an AppLocker script which enables PSM users to invoke internal PSM applications, mandatory Windows applications, and 3rd party external applications that are used as clients in the PSM.

All AppLocker rules are defined in the PSMConfigureAppLocker.xml file in the PSM installation folder > Hardening. If your environment includes executables that must be allowed, in addition to those that are built-in to the PSM installation, such as PSM Universal Connectors executables, you must edit this file to add rules that will allow these executables. If you have connectors deployed using shared universal connector deployment on multiple PSM servers they will be updated automatically in the AppLocker rules. For details, see Deploy a shared universal connector on multiple PSM servers.

Return the security level for running PowerShell after running the AppLocker script

After running the AppLocker script, you can return the security level for running PowerShell scripts to the same status as it was before you ran the AppLocker script.

For example, to set the execution policy to restricted, run the following command:

 
Set-ExecutionPolicy restricted

For more information, refer to PowerShell's main page.

Automatic hardening in 'In Domain' deployments

 

Even If you are using the automated installation script, this step is still required.

This section describes the automatic hardening procedure for In Domain deployments, including each file type and its configuration, as well as the procedures for applying and editing these files in a customer's environment.

Automatic hardening in 'Out of Domain' deployments

This section describes how to apply automatic hardening procedures in 'Out of Domain' deployments.

 

If you are using the automated installation script, this step is done during the Hardening stage.

General routine configurations for 'In Domain' and 'Out of Domain' deployments

This section describes configuration that must be performed in 'In Domain' deployments as well as in 'Out of Domain' deployments.

 

Even If you are using the automated installation script, this step is still required.

Update your Operating System

Microsoft releases periodic updates (security updates and service packs) to address security issues that were discovered in Operating Systems. Make sure your Operating System is updated to the latest version.

You can install the updates in either of the following ways:

  • Manually install updates and service packs.
  • Automatically install with Server Update Services (WSUS), which is located on a corporate network.

Install an Anti-Virus solution

In today’s world, the pace of virus development is very fast. Servers without anti-virus protection are exposed to two risks:

  • Server infected with viruses that might damage the server and the entire network.

  • Trojan horses that are planted to allow remote control of the server and to all the information on it.

Install an Anti-Virus solution and update it as needed.

Validate proper server roles

Server roles can be set using the Server Manager. Ensure that the unnecessary roles are not installed on the server

Restrict network protocols

Install only the required protocols and remove unnecessary ones.

For example, only TCP/IP are necessary, and ensure that no additional protocols such as IPX or NetBEUI are allowed.

Rename default accounts

It is recommended to change the names of both the Administrator and the guest to names that will not testify about their permissions.

It is also recommended to create a new locked and unprivileged Administrator user name as bait.

Configure the PSM server in 'In Domain' deployments

This section describes how to configure the PSM Server in 'In Domain' deployments.

Configure 'Out of Domain' PSM servers

Use the following procedures to configure PSM Servers in ‘Out of Domain’ deployments.

Manually configure Out of Domain PSM servers - administrative templates

To manually configure Remote Desktop Services, do the following:

Policy Setting
Services

Administrative Templates → Windows components → Remote Desktop Services → Remote Desktop Session Host → Connections

Automatic reconnection Disabled
Configure keep-alive connection interval

Enabled
Keep-Alive interval:1

Deny logoff of an administrator logged in to the console session

Enabled

Set rules for remote control of Remote Desktop Services user sessions

Enabled
Full Control without user's permission

Do not allow LPT port redirection

Enabled

Do not allow supported Plug and Play device redirection

Enabled

Administrative Templates → Windows components → Remote Desktop Services → Remote Desktop Session Host → Remote Session Environment

Remove "Disconnect" option from Shut Down dialog Enabled
Remove Windows Security item from Start menu

Enabled

Administrative Templates → Windows components → Remote Desktop Services → Remote Desktop Session Host → Security

Do not allow local administrators to customize permissions Not Defined
Require secure RPC communication

Enabled

Set client connection encryption level

Enabled
Encryption Level: High Level

Administrative Templates → Windows components →  Remote Desktop Services → Remote Desktop Session Host → Session Time Limits

End session when time limits are reached Enabled
Set time limit for active but idle Remote Desktop Services sessions

Not Defined

Set time limit for disconnected sessions

Enabled
Set to one minute

Administrative Templates → Windows components → Remote Desktop Services → Remote Desktop Session Host → Temporary folders

Do not delete temp folders upon exit Disabled
Do not use temporary folders per session

Disabled

Customer's discretion is required when changing the following policies!

Policy Setting
Services

Administrative Templates  → Windows components → Remote Desktop Services → Remote Desktop Session Host → Device and Resource Redirection

Do not allow Clipboard redirection
If this feature is used: Not defined
If this feature is not used: Enabled
Do not allow COM port redirection
If this feature is used: Not defined
If this feature is not used: Enabled
Do not allow drive redirection
If this feature is used: Not defined
If this feature is not used: Enabled
 
TruePrivileged Access Security11.4