window基线脚本怎么写

Window基线脚本可以使用PowerShell编写，以下是一个示例：

# 禁用Guest账户
Set-LocalUser -Name "Guest" -Enabled $false

# 禁用匿名共享
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name "NullSessionShares" -Value ""

# 启用防火墙
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

# 禁用远程桌面协议（RDP）中的NLA（网络级身份验证）
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Value 0

# 启用密码复杂性要求
Set-LocalSecurityPolicy -Policy "Password must meet complexity requirements" -Value 1

# 禁用自动播放
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun" -Value 255

# 禁用共享文件夹中的隐藏共享
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name "Hidden" -Value 1

# 禁用LM哈希
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "LMCompatibilityLevel" -Value 5

# 禁用SMBv1
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

# 设置屏幕锁定时间
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name "ScreenSaveTimeOut" -Value 900

# 禁用Windows Script Host
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows Script Host\Settings" -Name "Enabled" -Value 0

# 禁用自动登录
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "AutoAdminLogon" -Value 0

# 启用强制TLS
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" -Name "Enabled" -Value 1
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" -Name "Enabled" -Value 1
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" -Name "Enabled" -Value 1

# 禁用IE保护模式
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" -Name "2500" -Value 0

这个脚本包含了一组常见的基线安全设置，可以根据需要进行修改和扩展。