Hardend Windows 7

[window]

Found a site that claims you can disable a big amout of services in Windows 7, if you have it as a standalone computer connected to Internet. I'm a bit sceptical. Could someone look at this?


"Start button/Control Panel/Administrative Tools/Services
Right click on the following services, choose Properties and set Startup Type to Disable.
-
Name (Original Mode) (what it does)
---------------------------------------------------
BranchCache (manual) (caches data from remote work place servers)
Computer Browser (manual) (finds other PCs in the network)
Distributed Link Tracking Client (automatic) (maintain shortcuts if source file name has changed)
DNS client (automatic) (caches previously looked up domain names)
Function Discovery Provider Host (manual) (HomeGroup)
Function discovery resource publication (manual) (HomeGroup)
HomeGroup Listener (manual) (HomeGroup)
HomeGroup Provider (manual) (HomeGroup)
Internet Connection Sharing (disabled) (makes PC act as router)
IP Helper (automatic) (IPv6 tunneling)
Link Layer Topology discovery mapper (manual) (network discovery)
Media Center Extender service (disabled) (turns PC into media server)
Net. TCP port Sharing service (disabled)
NetLogon (manual)
Network Access Protection Agent (manual) (reports security configuration)
Offline files (automatic)
Parental controls (manual) (empty stub for compatibility with Vista)
Peer Name Resolution Protocol (manual)
Peer Networking Grouping (manual) (HomeGroup, remote assistance)
Peer Networking Identity Mgr (manual) (HomeGroup, remote assistance)
Performance Counter DLL Host (manual) (allows remote query to performance counters)
Performance Logs & Alerts (manual) (collects remote and local perf data)
PnP-X Ip Bus Enumerator (manual) (uses SSDP)
PNRP Machine Name Publication Service (manual) (server that responds with a machine name)
Quality Windows Audio Video Experience (manual) (multimedia server)
Remote Access Auto Connection Mgr (manual)
Remote Access Connection Manager (manual) (dialup, VPN)
Remote Desktop Configuration (manual)
Remote Desktop Service (manual) (server allowing remote control)
Remote Desktop Service UserMode Port Redirector (manual)
Remote Registry (manual)
Routing and Remote Access (disabled)
Secondary logon (manual)
Secure Socket Tunneling Protocol service (manual) (VPN)
Server (automatic) (HomeGroup, File and Printer Sharing)
SNMP Trap (manual)
SSDP Discovery (manual)
Tablet PC Input Service (manual)
TCP/IP NetBIOS Helper (automatic)
Telephony (manual) (affects Remote Access Connection mgr/ VPN)
UPnP Device host (manual)
Web Client (manual)
Windows Connect Now (manual) (Wireless Setup - simplified configuration)
Windows Error Reporting Service (manual) (reports system problems to MS and fetches solutions)
Windows Event Collector (manual) (allow remote subscription to log events)
Windows Media Player Network Sharing service (manual)
Windows Remote Management (manual) (Server, listens for remote requests )
WinHTTP Web Proxy auto discovery (manual) (proxy discovery and some kind of http api )
WMI Performance Adapter (manual) (provides performance data to other PC collecting it)
Workstation (automatic) (HomeGroup)"

Thanks in advance.

 

[John Connor]

There is a website that shows you what services to disable, but I can't remember what the name of it was.

Allowing TCP/IP NetBIOS Helper and sever isn't hardening Windows 7. And Remote Registry and Remote Desktop Service should be disabled.

I block NetBIOS in the router and all the computers have it off. I never use Windows networking.

 

[John Connor]

Here's the website. http://www.blackviper.com/service-c...dows-7-service-pack-1-service-configurations/

 

[AmphibSailor]

I think the best guides to use are DISA's Security Technical Implementation Guides or the NSA's guide. Available online.