Windows Security

Wiping unused drives

Quick-format the drive

Wipe the free space:

Microsoft.Playwright.PlaywrightException: Error: The language "cmd" has no grammar.
    at Object.highlight (http://127.0.0.1:41899/main.js:3978:11)
    at eval (eval at evaluate (:226:30), :2:18)
    at UtilityScript.evaluate (:233:19)
    at UtilityScript. (:1:44)
   at Microsoft.Playwright.Transport.Connection.InnerSendMessageToServerAsync[T](ChannelOwnerBase object, String method, Dictionary`2 dictionary, Boolean keepNulls) in /_/src/Playwright/Transport/Connection.cs:line 209
   at Microsoft.Playwright.Transport.Connection.WrapApiCallAsync[T](Func`1 action, Boolean isInternal) in /_/src/Playwright/Transport/Connection.cs:line 535
   at Microsoft.Playwright.Core.Frame.EvaluateAsync[T](String script, Object arg) in /_/src/Playwright/Core/Frame.cs:line 548
   at SiteGen.Extensions.Markdown.Prism.PrismHost.Highlight(String source, String language)
   at SiteGen.Extensions.Markdown.Prism.PrismCodeBlockRenderer.Write(HtmlRenderer renderer, PrismCodeBlock obj)

Example:

To remove as much data as possible, please close all other applications while
running CIPHER /W.
Writing 0x00
.........................................................................................................
Writing 0xFF
.........................................................................................................
Writing Random Numbers
.........................................................................................................

There'll be a folder left behind called EFSTMPWP which you can delete once it's done.

You can also run SDelete:

Microsoft.Playwright.PlaywrightException: Error: The language "cmd" has no grammar.
    at Object.highlight (http://127.0.0.1:41899/main.js:3978:11)
    at eval (eval at evaluate (:226:30), :2:18)
    at UtilityScript.evaluate (:233:19)
    at UtilityScript. (:1:44)
   at Microsoft.Playwright.Transport.Connection.InnerSendMessageToServerAsync[T](ChannelOwnerBase object, String method, Dictionary`2 dictionary, Boolean keepNulls) in /_/src/Playwright/Transport/Connection.cs:line 209
   at Microsoft.Playwright.Transport.Connection.WrapApiCallAsync[T](Func`1 action, Boolean isInternal) in /_/src/Playwright/Transport/Connection.cs:line 535
   at Microsoft.Playwright.Core.Frame.EvaluateAsync[T](String script, Object arg) in /_/src/Playwright/Core/Frame.cs:line 548
   at SiteGen.Extensions.Markdown.Prism.PrismHost.Highlight(String source, String language)
   at SiteGen.Extensions.Markdown.Prism.PrismCodeBlockRenderer.Write(HtmlRenderer renderer, PrismCodeBlock obj)

Or use it just to clean a directory:

Microsoft.Playwright.PlaywrightException: Error: The language "cmd" has no grammar.
    at Object.highlight (http://127.0.0.1:41899/main.js:3978:11)
    at eval (eval at evaluate (:226:30), :2:18)
    at UtilityScript.evaluate (:233:19)
    at UtilityScript. (:1:44)
   at Microsoft.Playwright.Transport.Connection.InnerSendMessageToServerAsync[T](ChannelOwnerBase object, String method, Dictionary`2 dictionary, Boolean keepNulls) in /_/src/Playwright/Transport/Connection.cs:line 209
   at Microsoft.Playwright.Transport.Connection.WrapApiCallAsync[T](Func`1 action, Boolean isInternal) in /_/src/Playwright/Transport/Connection.cs:line 535
   at Microsoft.Playwright.Core.Frame.EvaluateAsync[T](String script, Object arg) in /_/src/Playwright/Core/Frame.cs:line 548
   at SiteGen.Extensions.Markdown.Prism.PrismHost.Highlight(String source, String language)
   at SiteGen.Extensions.Markdown.Prism.PrismCodeBlockRenderer.Write(HtmlRenderer renderer, PrismCodeBlock obj)

Hardening

Remove SMB 1.0 that has vulnerabilities (SMB 3.0 is still fine)

Remove-WindowsFeature -Name FS-SMB1

Service Accounts

You can create per-service security identifiers (SID) for each service, so you can configure service rights on a per-service basis, as opposed to using shared accounts that give all services that use them the same privileges, or the overhead of manually creating service accounts for each service.

Query SID type: sc qsidtype <service> View privileges for a service: sc qprivs <service>

View the SID for a service: sc showsid <service>

Set the SID type to Restricted:

sc sidtype <service> <none|unrestricted|restricted>