Getting Started

Explore this Page

Overview

This section introduces the OS Hardening feature for SANsymphony and explains how to prepare, apply, and validate hardening on supported Windows Server systems. It covers the requirements, tool components, prerequisites, and the recommended workflow to help secure the operating system while maintaining SANsymphony functionality.

Requirements

OS hardening is supported on the following Windows Server versions:

  • Windows Server 2025
  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016

    This feature is validated and supported for SANsymphony PSP20 and PSP21.

How OS Hardening Works

DCS Hardening Tool (DcsHardeningTool.ps1) is made up of a few key components that work together to apply and manage security settings on a Windows Server system.

Main Execution Script (DcsHardeningTool.ps1)

  • DcsHardeningTool.ps1 is the main script used to run the OS hardening tool. You can use it to:

    • Apply OS hardening
    • Run an audit
    • Create a backup
    • Restore settings

    The script controls the overall process and executes the required actions based on the system configuration.

Security Finding Lists (Lists/*.csv)

These are CSV files that contain the actual security rules.

  • Based on CIS and Microsoft security recommendations.
  • Adjusted to make sure SANsymphony works correctly.
  • Include settings for both system and user configurations.

These files define what changes are applied during hardening.

OS Hardening Profiles (os-hardening-profiles/*.json)

  • Profiles decide which rules are applied for each Windows Server version.

    • Each profile is linked to a specific OS (for example, DCS-WS2016)
    • Selects the correct finding lists to use.
    • Ensures only supported settings are applied.

This helps apply hardening in a safe and version-specific way.

Prerequisites

  • Ensure you have administrator privileges to run PowerShell.
  • Download and extract the OS Hardening package to the SANsymphony server from the DataCore Repository.
  • Although OS hardening does not modify SANsymphony components, it changes system-level security settings and may impact system behavior. Therefore, it is strongly recommended to:
    • Create a virtual machine snapshot, or
    • Perform a full system backup, or
    • Create a Windows restore point

OS Hardening Workflow (Recommended)

The following workflow is recommended when applying OS hardening and validating the results:

  1. Run Audit (Before Hardening)

    Perform an audit to evaluate the current system configuration and establish a baseline. See Run OS Hardening Audit.

  2. Apply OS Hardening

    Apply the recommended security configurations based on the displayed OS profile. See Apply OS Hardening.

  3. Reboot the System

    Restart the system to ensure that all configuration changes take full effect.

  4. Run Audit (After Hardening)

    Perform the audit again to verify that the system configuration has improved and aligns with the recommended settings. See Run OS Hardening Audit.

Learn More