Securing Windows XP

As I wrote in a previous post, securing your operating systems is critical to security and privacy.

Below is a batch‑file script you can run (as Administrator) inside a Windows XP virtual machine to apply a set of common hardening measures.
It focuses on reducing the attack surface, tightening default settings, and disabling services that are rarely needed on a VM used for testing or development.

---

Important – Run this on a snapshot or a disposable VM first. Some changes (especially service disables) can affect functionality if you later need those components.

@echo off
REM -------------------------------------------------
REM Windows XP Hardening Script – run as Administrator
REM -------------------------------------------------

REM ----------------------------------------------------------------------
REM 1. Enable the built‑in firewall (Windows Firewall) and set a strict profile
REM ----------------------------------------------------------------------
netsh firewall set opmode enable
netsh firewall set logging droppedconnections enable
netsh firewall set logging logpath %systemroot%\system32\LogFiles\Firewall.log
netsh firewall set logging loglimit 4096
netsh firewall set icmptype enable=FALSE
netsh firewall set portopening protocol=TCP port=135 name="RPC Endpoint Mapper" enable=FALSE
netsh firewall set portopening protocol=TCP port=139 name="NetBIOS Session Service" enable=FALSE
netsh firewall set portopening protocol=TCP port=445 name="SMB" enable=FALSE

REM -------------------------------------------------
REM 2. Disable unnecessary services
REM -------------------------------------------------
sc config "RemoteRegistry" start= disabled
sc stop RemoteRegistry

sc config "Telnet" start= disabled
sc stop Telnet

sc config "Messenger" start= disabled
sc stop Messenger

sc config "Server" start= disabled
sc stop Server

sc config "Workstation" start= disabled
sc stop Workstation

sc config "Routing and Remote Access" start= disabled
sc stop RemoteAccess

sc config "SNMP" start= disabled
sc stop SNMP

sc config "UPnP Device Host" start= disabled
sc stop upnphost

REM -------------------------------------------------
REM 3. Harden the registry – disable LM hash storage
REM -------------------------------------------------
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "NoLMHash" /t REG_DWORD /d 1 /f

REM -------------------------------------------------
REM 4. Enforce strong password policy
REM -------------------------------------------------
net accounts /minpwlen:12 /maxpwage:90 /minpwage:1 /uniquepw:5
net accounts /lockoutthreshold:5 /lockoutduration:30 /lockoutwindow:30

REM -------------------------------------------------
REM 5. Disable AutoRun for all drives (prevents autorun.inf exploits)
REM -------------------------------------------------
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f

REM -------------------------------------------------
REM 6. Turn off SMB v1 (SMB1) – XP only supports SMB1, so we block it at the firewall level (already done above)
REM -------------------------------------------------
rem No native way to uninstall SMB1 on XP; firewall rules already block ports 139/445.

REM -------------------------------------------------
REM 7. Disable unnecessary scheduled tasks (e.g., Disk Defragmenter)
REM -------------------------------------------------
schtasks /Change /TN "\Microsoft\Windows\Defrag\ScheduledDefrag" /Disable >nul 2>&1

REM -------------------------------------------------
REM 8. Remove or disable the Guest account
REM -------------------------------------------------
net user Guest /active:no

REM -------------------------------------------------
REM 9. Set the system to require a password on wake‑up (if using power management)
REM -------------------------------------------------
powercfg -change -monitor-timeout-ac 0
powercfg -change -standby-timeout-ac 0

REM -------------------------------------------------
REM 10. Apply latest security patches (manual step)
REM -------------------------------------------------
echo.
echo ==========================================================
echo PLEASE REBOOT THE VM AND THEN MANUALLY APPLY ALL AVAILABLE
echo WINDOWS XP SP3 SECURITY PATCHes via Windows Update.
echo ==========================================================
pause

exit /b 0

---

How to use it

1. Create a snapshot of your XP VM (so you can roll back if anything goes wrong).
2. Open Notepad, paste the script above, and save it as hardening_xp.bat.
3. Right‑click the file and choose “Run as administrator.”
4. After the script finishes, reboot the VM.
5. Finally, run Windows Update (or manually install the latest XP SP3 patches) to bring the system up to date.

What the script does (brief overview)

Area	Action	Why it helps
Firewall	Enables Windows Firewall, blocks inbound RPC, NetBIOS, SMB, disables ICMP echo replies	Reduces exposure to network‑based attacks
Services	Stops & disables services that are rarely needed (Remote Registry, Telnet, Messenger, Server/Workstation, etc.)	Cuts down the number of potential entry points
LM Hashes	Disables storage of LAN Manager password hashes	Prevents attackers from cracking weak legacy hashes
Password Policy	Enforces minimum length, expiration, lockout thresholds	Forces stronger credentials
Autorun	Blocks autorun.inf execution on all drives	Mitigates USB/ISO autorun malware
Guest Account	Disables the built‑in Guest account	Removes a default low‑privilege account that could be abused
Scheduled Tasks	Disables automatic defragmentation (not needed on a VM)	Slightly reduces background activity that could be leveraged
Power Management	Ensures the machine doesn’t auto‑wake without a password	Prevents unattended access

---

Next steps & further hardening ideas

• Patch management: XP is out‑of‑support; consider using a whitelisted update repository or applying the last cumulative patch manually.
• Application whitelisting: Use Software Restriction Policies (secpol.msc) to allow only trusted executables.
• Remove unnecessary software: Uninstall browsers, media players, or development tools you don’t need.
• Enable audit logging: auditpol /set /category:* /success:enable /failure:enable to capture security‑relevant events.
• Network isolation: Place the VM on a host‑only or internal virtual network so it cannot reach the internet unless explicitly required.

Feel free to adapt any part of the script to match the exact role of your VM. If you need additional tweaks—such as configuring specific registry keys, adding more firewall rules, or setting up a custom local security policy—just let me know!