{"id":48,"title":"Kurulum Sonras\u0131 Hemen De\u011fi\u015ftirmeniz Gereken 7 Windows Server Varsay\u0131lan Ayarlar\u0131","content":"<p>Windows Server kurulumu tamamland\u0131ktan sonra, sunucunuzu &uuml;retime almadan &ouml;nce mutlaka de\u011fi\u015ftirmeniz gereken kritik varsay\u0131lan ayarlar vard\u0131r. Microsoft, kullan\u0131\u015fl\u0131l\u0131k ve eri\u015filebilirlik a&ccedil;\u0131s\u0131ndan Windows Server'\u0131 belirli bir dengeyle yap\u0131land\u0131rm\u0131\u015ft\u0131r, ancak bu varsay\u0131lan ayarlar genellikle maksimum g&uuml;venlik sa\u011flamaz. Bu yaz\u0131da, 15+ y\u0131ll\u0131k sistem y&ouml;neticili\u011fi deneyimim boyunca her Windows Server kurulumunda mutlaka de\u011fi\u015ftirdi\u011fim 7 kritik ayar\u0131 ve bunlar\u0131n neden &ouml;nemli oldu\u011funu anlataca\u011f\u0131m.<\/p>\r\n<h2>Neden Windows Server Varsay\u0131lan Ayarlar\u0131 De\u011fi\u015ftirmek Gerekli?<\/h2>\r\n<p>Windows Server, \"out-of-the-box\" g&uuml;venli olacak \u015fekilde tasarlanm\u0131\u015f olsa da, bir&ccedil;ok organizasyon g&uuml;venlik konfig&uuml;rasyonlar\u0131 &uuml;zerinde daha ayr\u0131nt\u0131l\u0131 kontrol istemektedir. Microsoft'un g&uuml;venlik uzmanlar\u0131 \u015funu s&ouml;yl&uuml;yor: Microsoft 3,000'den fazla grup policy ayar\u0131 sunar ve bunlardan sadece bir k\u0131sm\u0131 g&uuml;venlik ile ilgilidir. Bu nedenle, do\u011fru konfig&uuml;rasyonlar\u0131 uygulamak kritiktir. <strong>Temel Prensipler:<\/strong><\/p>\r\n<ul>\r\n<li>Varsay\u0131lan ayarlar genellikle kullan\u0131c\u0131 dostu ama g&uuml;venlik odakl\u0131 de\u011fildir<\/li>\r\n<li>Her sunucu rol&uuml; farkl\u0131 g&uuml;venlik gereksinimleri gerektirir<\/li>\r\n<li>G&uuml;venlik katmanlar\u0131 (defense in depth) yakla\u015f\u0131m\u0131 benimsenmelidir<\/li>\r\n<li>Sald\u0131r\u0131 y&uuml;zeyini minimize etmek temel hedeftir<\/li>\r\n<\/ul>\r\n<h2>1. Administrator Hesab\u0131n\u0131 Yeniden Adland\u0131rma ve G&uuml;&ccedil;lendirme<\/h2>\r\n<h3>Varsay\u0131lan Durum Problemi<\/h3>\r\n<p>Windows Server kurulumu s\u0131ras\u0131nda olu\u015fturulan yerle\u015fik \"Administrator\" hesab\u0131, t&uuml;m d&uuml;nyada bilinen standart bir hesap ad\u0131d\u0131r. Bu, brute-force sald\u0131r\u0131lar\u0131 i&ccedil;in birincil hedeftir.<\/p>\r\n<h3>Yap\u0131lmas\u0131 Gerekenler<\/h3>\r\n<h4>A. Administrator Hesab\u0131n\u0131 Yeniden Adland\u0131rma<\/h4>\r\n<p><strong>GUI Y&ouml;ntemi:<\/strong><\/p>\r\n<pre><code>1. Computer Management &gt; Local Users and Groups &gt; Users 2. Administrator hesab\u0131na sa\u011f t\u0131k &gt; Rename 3. Benzersiz bir isim verin (&ouml;rn: SysAdmin2024, ServerManager, vb.) <\/code><\/pre>\r\n<p><strong>PowerShell Y&ouml;ntemi:<\/strong><\/p>\r\n<pre><code># Administrator hesab\u0131n\u0131 yeniden adland\u0131r Rename-LocalUser -Name \"Administrator\" -NewName \"SystemManager\" # Hesap durumunu kontrol et Get-LocalUser -Name \"SystemManager\" <\/code><\/pre>\r\n<p><strong>Group Policy ile Toplu De\u011fi\u015fiklik:<\/strong><\/p>\r\n<pre><code>Computer Configuration &gt; Windows Settings &gt; Security Settings &gt; Local Policies &gt; Security Options &gt; \"Accounts: Rename administrator account\" <\/code><\/pre>\r\n<h4>B. G&uuml;&ccedil;l&uuml; Parola Politikas\u0131 Uygulama<\/h4>\r\n<pre><code># G&uuml;&ccedil;l&uuml; parola belirleme $SecurePassword = ConvertTo-SecureString \"Karma\u015f\u0131kParola123!@#\" -AsPlainText -Force Set-LocalUser -Name \"SystemManager\" -Password $SecurePassword # Parola s&uuml;resiz yap (opsiyonel) Set-LocalUser -Name \"SystemManager\" -PasswordNeverExpires $true <\/code><\/pre>\r\n<h4>C. Hesap Kilitleme Politikas\u0131<\/h4>\r\n<p><strong>Local Security Policy ile:<\/strong><\/p>\r\n<pre><code>Security Settings &gt; Account Policies &gt; Account Lockout Policy Account lockout threshold: 3 Account lockout duration: 30 minutes Reset account lockout counter after: 15 minutes <\/code><\/pre>\r\n<p><strong>PowerShell ile:<\/strong><\/p>\r\n<pre><code># Hesap kilitleme politikas\u0131 ayarlama secedit \/export \/cfg c:\\temp\\secpol.cfg # Dosyay\u0131 d&uuml;zenle ve tekrar import et secedit \/configure \/db c:\\windows\\security\\local.sdb \/cfg c:\\temp\\secpol.cfg <\/code><\/pre>\r\n<h2>2. User Account Control (UAC) Yap\u0131land\u0131rmas\u0131<\/h2>\r\n<h3>Varsay\u0131lan Durum Problemi<\/h3>\r\n<p>Windows Server'da UAC varsay\u0131lan olarak aktiftir ancak optimum g&uuml;venlik seviyesinde de\u011fildir. Ayr\u0131ca, built-in Administrator hesab\u0131 i&ccedil;in UAC varsay\u0131lan olarak devre d\u0131\u015f\u0131d\u0131r.<\/p>\r\n<h3>UAC Seviyelerini Anlama<\/h3>\r\n<p><strong>UAC Seviyeleri:<\/strong><\/p>\r\n<ol>\r\n<li><strong>Never notify<\/strong> (En d&uuml;\u015f&uuml;k g&uuml;venlik)<\/li>\r\n<li><strong>Notify me only when apps try to make changes<\/strong> (Varsay\u0131lan)<\/li>\r\n<li><strong>Always notify<\/strong> (En y&uuml;ksek g&uuml;venlik)<\/li>\r\n<\/ol>\r\n<h3>Optimal UAC Konfig&uuml;rasyonu<\/h3>\r\n<h4>A. Registry ile UAC Ayarlama<\/h4>\r\n<pre><code># UAC'\u0131 maksimum seviyeye ayarla Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"EnableLUA\" -Value 1 Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"ConsentPromptBehaviorAdmin\" -Value 2 Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"PromptOnSecureDesktop\" -Value 1 # Built-in Administrator i&ccedil;in UAC aktif et Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"FilterAdministratorToken\" -Value 1 <\/code><\/pre>\r\n<h4>B. Group Policy ile UAC Konfig&uuml;rasyonu<\/h4>\r\n<pre><code>Computer Configuration &gt; Windows Settings &gt; Security Settings &gt; Local Policies &gt; Security Options - User Account Control: Admin Approval Mode for Built-in Administrator = Enabled - User Account Control: Behavior of elevation prompt for administrators = Prompt for consent on secure desktop - User Account Control: Run all administrators in Admin Approval Mode = Enabled - User Account Control: Switch to secure desktop when prompting = Enabled <\/code><\/pre>\r\n<h4>C. UAC Monitoring Script'i<\/h4>\r\n<pre><code># UAC durumunu kontrol eden script function Check-UACStatus { $UACEnabled = Get-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"EnableLUA\" $AdminBehavior = Get-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"ConsentPromptBehaviorAdmin\" Write-Host \"UAC Status:\" Write-Host \"EnableLUA: $($UACEnabled.EnableLUA)\" Write-Host \"Admin Prompt Behavior: $($AdminBehavior.ConsentPromptBehaviorAdmin)\" if ($UACEnabled.EnableLUA -eq 1 -and $AdminBehavior.ConsentPromptBehaviorAdmin -eq 2) { Write-Host \"UAC is properly configured!\" -ForegroundColor Green } else { Write-Host \"UAC needs configuration!\" -ForegroundColor Red } } Check-UACStatus <\/code><\/pre>\r\n<h2>3. Windows Firewall Yap\u0131land\u0131rmas\u0131 ve Sertle\u015ftirme<\/h2>\r\n<h3>Varsay\u0131lan Durum Problemi<\/h3>\r\n<p>Windows Firewall aktiftir ancak bir&ccedil;ok gereksiz kural ve servis a&ccedil;\u0131kt\u0131r. Ayr\u0131ca logging genellikle etkin de\u011fildir.<\/p>\r\n<h3>Optimal Firewall Konfig&uuml;rasyonu<\/h3>\r\n<h4>A. Temel Firewall Sertle\u015ftirme<\/h4>\r\n<pre><code># T&uuml;m profiller i&ccedil;in varsay\u0131lan politikalar\u0131 ayarla Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultInboundAction Block Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultOutboundAction Allow # Logging'i aktif et Set-NetFirewallProfile -Profile Domain,Public,Private -LogAllowed True -LogBlocked True -LogMaxSizeKilobytes 32767 Set-NetFirewallProfile -Profile Domain,Public,Private -LogFileName \"%SystemRoot%\\System32\\LogFiles\\Firewall\\pfirewall.log\" # Firewall bildirimlerini aktif et Set-NetFirewallProfile -Profile Domain,Public,Private -NotifyOnListen True <\/code><\/pre>\r\n<h4>B. Gereksiz Kurallar\u0131 Devre D\u0131\u015f\u0131 B\u0131rakma<\/h4>\r\n<pre><code># Yayg\u0131n olarak gereksiz olan kurallar\u0131 devre d\u0131\u015f\u0131 b\u0131rak $DisableRules = @( \"*AllJoyn*\", \"*Cast to Device*\", \"*mDNS*\", \"*Wireless Display*\", \"*WLAN Service*\", \"*Windows Media Player*\" ) foreach ($rule in $DisableRules) { Disable-NetFirewallRule -DisplayName $rule -ErrorAction SilentlyContinue Write-Host \"Disabled: $rule\" } <\/code><\/pre>\r\n<h4>C. Remote Desktop Port De\u011fi\u015ftirme<\/h4>\r\n<pre><code># RDP portunu varsay\u0131lan 3389'dan de\u011fi\u015ftir $NewRDPPort = 6689 # Registry'de RDP portunu de\u011fi\u015ftir Set-ItemProperty -Path \"HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" -Name \"PortNumber\" -Value $NewRDPPort # Firewall kural\u0131n\u0131 g&uuml;ncelle New-NetFirewallRule -DisplayName \"Remote Desktop - Custom Port\" -Direction Inbound -Protocol TCP -LocalPort $NewRDPPort -Action Allow # Eski RDP kural\u0131n\u0131 devre d\u0131\u015f\u0131 b\u0131rak Disable-NetFirewallRule -DisplayName \"Remote Desktop*\" Write-Host \"RDP port changed to: $NewRDPPort\" Write-Host \"Remember to add this port to your RDP client!\" <\/code><\/pre>\r\n<h4>D. Network Level Authentication Zorla<\/h4>\r\n<pre><code># Network Level Authentication'\u0131 aktif et Set-ItemProperty -Path \"HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" -Name \"SecurityLayer\" -Value 1 Set-ItemProperty -Path \"HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" -Name \"UserAuthentication\" -Value 1 # RDP servisini yeniden ba\u015flat Restart-Service TermService -Force <\/code><\/pre>\r\n<h2>4. Otomatik Windows Update Konfig&uuml;rasyonu<\/h2>\r\n<h3>Varsay\u0131lan Durum Problemi<\/h3>\r\n<p>Windows Server varsay\u0131lan olarak manuel g&uuml;ncelleme modundad\u0131r. Bu g&uuml;venlik a&ccedil;\u0131klar\u0131n\u0131n kapat\u0131lmamas\u0131na neden olabilir.<\/p>\r\n<h3>Optimal Update Konfig&uuml;rasyonu<\/h3>\r\n<h4>A. Otomatik G&uuml;ncelleme Ayarlama<\/h4>\r\n<pre><code># Windows Update servisini aktif et Set-Service -Name wuauserv -StartupType Automatic Start-Service wuauserv # Otomatik g&uuml;ncellemeleri aktif et $AUSettings = (New-Object -com \"Microsoft.Update.AutoUpdate\").Settings $AUSettings.NotificationLevel = 4 # Automatically download and install $AUSettings.ScheduledInstallationDay = 0 # Every day $AUSettings.ScheduledInstallationTime = 3 # 3 AM $AUSettings.IncludeRecommendedUpdates = $true $AUSettings.Save() <\/code><\/pre>\r\n<h4>B. Registry ile Update Politikas\u0131<\/h4>\r\n<pre><code># Windows Update registry ayarlar\u0131 $UpdatePath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\" if (!(Test-Path $UpdatePath)) { New-Item -Path $UpdatePath -Force } Set-ItemProperty -Path $UpdatePath -Name \"AUOptions\" -Value 4 # Auto download and install Set-ItemProperty -Path $UpdatePath -Name \"ScheduledInstallDay\" -Value 0 # Every day Set-ItemProperty -Path $UpdatePath -Name \"ScheduledInstallTime\" -Value 3 # 3 AM Set-ItemProperty -Path $UpdatePath -Name \"AutoInstallMinorUpdates\" -Value 1 # Install minor updates Set-ItemProperty -Path $UpdatePath -Name \"IncludeRecommendedUpdates\" -Value 1 # Include recommended updates <\/code><\/pre>\r\n<h4>C. WSUS Konfig&uuml;rasyonu (Kurumsal Ortamlar \u0130&ccedil;in)<\/h4>\r\n<pre><code># WSUS sunucu konfig&uuml;rasyonu $WSUSServer = \"http:\/\/wsus.yourdomain.com:8530\" Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\" -Name \"WUServer\" -Value $WSUSServer Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\" -Name \"WUStatusServer\" -Value $WSUSServer Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\" -Name \"UseWUServer\" -Value 1 # G&uuml;ncelleme servisini yeniden ba\u015flat Restart-Service wuauserv <\/code><\/pre>\r\n<h4>D. Update Status Monitoring Script'i<\/h4>\r\n<pre><code># Windows Update durumunu kontrol eden script function Get-WindowsUpdateStatus { $Session = New-Object -ComObject Microsoft.Update.Session $Searcher = $Session.CreateupdateSearcher() try { $Updates = $Searcher.Search(\"IsInstalled=0\") $PendingUpdates = $Updates.Updates.Count Write-Host \"Windows Update Status:\" -ForegroundColor Cyan Write-Host \"Pending Updates: $PendingUpdates\" -ForegroundColor $(if($PendingUpdates -gt 0){\"Red\"}else{\"Green\"}) if ($PendingUpdates -gt 0) { foreach ($Update in $Updates.Updates) { Write-Host \"- $($Update.Title)\" -ForegroundColor Yellow } } # Son y&uuml;klenen g&uuml;ncellemeleri g&ouml;ster $LastInstalled = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 Write-Host \"`nLast 5 Installed Updates:\" -ForegroundColor Cyan $LastInstalled | Format-Table HotFixID, Description, InstalledOn -AutoSize } catch { Write-Host \"Error checking updates: $($_.Exception.Message)\" -ForegroundColor Red } } Get-WindowsUpdateStatus <\/code><\/pre>\r\n<h2>5. Gereksiz Windows Servislerini Devre D\u0131\u015f\u0131 B\u0131rakma<\/h2>\r\n<h3>Varsay\u0131lan Durum Problemi<\/h3>\r\n<p>Windows Server bir&ccedil;ok servisle gelir ve bunlar\u0131n &ccedil;o\u011fu tipik sunucu operasyonlar\u0131 i&ccedil;in gerekli de\u011fildir. Microsoft, g&uuml;venlik odakl\u0131 da\u011f\u0131t\u0131mlar i&ccedil;in bu ayarlar\u0131n de\u011fi\u015ftirilmesini &ouml;nermektedir.<\/p>\r\n<h3>G&uuml;venli \u015eekilde Devre D\u0131\u015f\u0131 B\u0131rak\u0131labilecek Servisler<\/h3>\r\n<h4>A. Print Spooler Servisi<\/h4>\r\n<pre><code># Print Spooler - En yayg\u0131n sald\u0131r\u0131 vekt&ouml;rlerinden biri Stop-Service -Name Spooler -Force Set-Service -Name Spooler -StartupType Disabled Write-Host \"Print Spooler disabled - Major security improvement!\" <\/code><\/pre>\r\n<h4>B. Remote Registry Servisi<\/h4>\r\n<pre><code># Remote Registry - Uzaktan registry eri\u015fimini engelle Stop-Service -Name RemoteRegistry -Force Set-Service -Name RemoteRegistry -StartupType Disabled Write-Host \"Remote Registry disabled!\" <\/code><\/pre>\r\n<h4>C. Di\u011fer G&uuml;venlik Riski Olu\u015fturan Servisler<\/h4>\r\n<pre><code># Devre d\u0131\u015f\u0131 b\u0131rak\u0131labilecek servisler listesi $ServicesToDisable = @( \"Fax\", # Fax Service \"TrkWks\", # Distributed Link Tracking Client \"MSiSCSI\", # Microsoft iSCSI Initiator Service \"WbioSrvc\", # Windows Biometric Service \"WerSvc\", # Windows Error Reporting Service \"WSearch\", # Windows Search (dosya sunucusu de\u011filse) \"SSDPSRV\", # SSDP Discovery \"upnphost\", # UPnP Device Host \"Browser\", # Computer Browser \"LanmanServer\" # Server (dosya payla\u015f\u0131m\u0131 gerekmiyorsa) ) foreach ($service in $ServicesToDisable) { $svc = Get-Service -Name $service -ErrorAction SilentlyContinue if ($svc) { if ($svc.Status -eq 'Running') { Stop-Service -Name $service -Force } Set-Service -Name $service -StartupType Disabled Write-Host \"Disabled service: $service\" -ForegroundColor Green } } <\/code><\/pre>\r\n<h4>D. Servis Durumu Raporu<\/h4>\r\n<pre><code>function Get-SecurityServiceReport { $CriticalServices = @( \"Spooler\", \"RemoteRegistry\", \"Fax\", \"TrkWks\", \"MSiSCSI\", \"WbioSrvc\", \"WerSvc\", \"SSDPSRV\", \"upnphost\" ) Write-Host \"Security Service Status Report:\" -ForegroundColor Cyan Write-Host \"==============================\" -ForegroundColor Cyan foreach ($serviceName in $CriticalServices) { $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue if ($service) { $status = if ($service.StartType -eq 'Disabled') { \"SECURE\" } else { \"RISK\" } $color = if ($status -eq \"SECURE\") { \"Green\" } else { \"Red\" } Write-Host \"$serviceName : $($service.Status) \/ $($service.StartType) - $status\" -ForegroundColor $color } } } Get-SecurityServiceReport <\/code><\/pre>\r\n<h2>6. Zaman ve Saat Konfig&uuml;rasyonu (NTP G&uuml;venli\u011fi)<\/h2>\r\n<h3>Varsay\u0131lan Durum Problemi<\/h3>\r\n<p>Do\u011fru zaman senkronizasyonu g&uuml;venlik log'lar\u0131 i&ccedil;in kritiktir. Varsay\u0131lan Windows Time servisi her zaman en g&uuml;venli yap\u0131land\u0131rmaya sahip de\u011fildir.<\/p>\r\n<h3>G&uuml;venli NTP Konfig&uuml;rasyonu<\/h3>\r\n<h4>A. G&uuml;venilir NTP Sunucular\u0131 Ayarlama<\/h4>\r\n<pre><code># G&uuml;venilir NTP sunucular\u0131n\u0131 ayarla $NTPServers = \"time.windows.com,time.nist.gov,pool.ntp.org\" # NTP client'\u0131 durdur Stop-Service w32time # NTP konfig&uuml;rasyonu w32tm \/config \/manualpeerlist:$NTPServers \/syncfromflags:manual \/reliable:yes \/update # Hizmeti ba\u015flat Start-Service w32time # Zaman senkronizasyonunu zorla w32tm \/resync \/force Write-Host \"NTP configuration completed with servers: $NTPServers\" <\/code><\/pre>\r\n<h4>B. Zaman Servisi G&uuml;venlik Ayarlar\u0131<\/h4>\r\n<pre><code># Windows Time Service g&uuml;venlik ayarlar\u0131 Set-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Config\" -Name \"AnnounceFlags\" -Value 5 Set-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Config\" -Name \"MaxNegPhaseCorrection\" -Value 3600 Set-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Config\" -Name \"MaxPosPhaseCorrection\" -Value 3600 # NTP authentication (kurumsal ortamlar i&ccedil;in) Set-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\TimeProviders\\NtpClient\" -Name \"RequireSecureTimeSyncRequests\" -Value 1 <\/code><\/pre>\r\n<h4>C. Zaman Senkronizasyonu Monitoring<\/h4>\r\n<pre><code>function Test-TimeSynchronization { Write-Host \"Time Synchronization Status:\" -ForegroundColor Cyan # W32Time servis durumu $w32timeService = Get-Service w32time Write-Host \"W32Time Service: $($w32timeService.Status)\" -ForegroundColor $(if($w32timeService.Status -eq 'Running'){\"Green\"}else{\"Red\"}) # Zaman senkronizasyon durumu $timeSync = w32tm \/query \/status Write-Host \"`nTime Sync Status:\" $timeSync | Select-String \"Last Successful Sync Time\", \"Source\", \"Stratum\" # Zaman fark\u0131n\u0131 kontrol et $ntpQuery = w32tm \/stripchart \/computer:time.windows.com \/samples:1 \/dataonly Write-Host \"`nTime Difference Check:\" $ntpQuery # Local time vs UTC $localTime = Get-Date $utcTime = Get-Date -UFormat \"%Y-%m-%d %H:%M:%S UTC\" Write-Host \"`nLocal Time: $localTime\" Write-Host \"UTC Time: $utcTime\" } Test-TimeSynchronization <\/code><\/pre>\r\n<h2>7. PowerShell Execution Policy ve G&uuml;venlik Ayarlar\u0131<\/h2>\r\n<h3>Varsay\u0131lan Durum Problemi<\/h3>\r\n<p>PowerShell varsay\u0131lan olarak script execution'a izin verir, bu da g&uuml;venlik riski olu\u015fturabilir. Ayr\u0131ca PowerShell v2.0 g&uuml;venlik a&ccedil;\u0131klar\u0131na sahiptir.<\/p>\r\n<h3>PowerShell G&uuml;venlik Sertle\u015ftirme<\/h3>\r\n<h4>A. Execution Policy Ayarlama<\/h4>\r\n<pre><code># G&uuml;venli execution policy ayarla Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine -Force # T&uuml;m kullan\u0131c\u0131lar i&ccedil;in policy kontrol&uuml; Get-ExecutionPolicy -List # PowerShell mod&uuml;l logging'i aktif et $PSModuleLoggingPath = \"HKLM:\\SOFTWARE\\Wow6432Node\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging\" if (!(Test-Path $PSModuleLoggingPath)) { New-Item -Path $PSModuleLoggingPath -Force } Set-ItemProperty -Path $PSModuleLoggingPath -Name \"EnableModuleLogging\" -Value 1 # Script block logging aktif et $PSScriptBlockPath = \"HKLM:\\SOFTWARE\\Wow6432Node\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" if (!(Test-Path $PSScriptBlockPath)) { New-Item -Path $PSScriptBlockPath -Force } Set-ItemProperty -Path $PSScriptBlockPath -Name \"EnableScriptBlockLogging\" -Value 1 <\/code><\/pre>\r\n<h4>B. PowerShell v2.0 Kald\u0131rma<\/h4>\r\n<pre><code># PowerShell v2.0 feature'\u0131n\u0131 kald\u0131r (g&uuml;venlik a&ccedil;\u0131klar\u0131 nedeniyle) Disable-WindowsOptionalFeature -Online -FeatureName \"MicrosoftWindowsPowerShellV2Root\" -All # ISE kald\u0131rma (sunucu ortam\u0131nda gerekli de\u011fil) Disable-WindowsOptionalFeature -Online -FeatureName \"MicrosoftWindowsPowerShellISE\" -All Write-Host \"PowerShell v2.0 and ISE removed for security!\" <\/code><\/pre>\r\n<h4>C. PowerShell Constrained Language Mode<\/h4>\r\n<pre><code># Constrained Language Mode ayarlama (y&uuml;ksek g&uuml;venlik ortamlar\u0131 i&ccedil;in) $env:__PSLockdownPolicy = \"4\" # Sistem &ccedil;ap\u0131nda constrained mode i&ccedil;in ::SetEnvironmentVariable(\"__PSLockdownPolicy\", \"4\", \"Machine\") Write-Host \"PowerShell Constrained Language Mode enabled!\" <\/code><\/pre>\r\n<h4>D. PowerShell G&uuml;venlik Monitoring<\/h4>\r\n<pre><code>function Test-PowerShellSecurity { Write-Host \"PowerShell Security Assessment:\" -ForegroundColor Cyan Write-Host \"================================\" -ForegroundColor Cyan # Execution Policy kontrol $policy = Get-ExecutionPolicy $policyColor = switch ($policy) { \"Restricted\" { \"Green\" } \"RemoteSigned\" { \"Yellow\" } \"AllSigned\" { \"Green\" } default { \"Red\" } } Write-Host \"Execution Policy: $policy\" -ForegroundColor $policyColor # PowerShell v2.0 kontrol $ps2Feature = Get-WindowsOptionalFeature -Online -FeatureName \"MicrosoftWindowsPowerShellV2Root\" $ps2Status = if ($ps2Feature.State -eq \"Disabled\") { \"SECURE\" } else { \"RISK\" } $ps2Color = if ($ps2Status -eq \"SECURE\") { \"Green\" } else { \"Red\" } Write-Host \"PowerShell v2.0 Status: $ps2Status\" -ForegroundColor $ps2Color # Module logging kontrol $moduleLogging = Get-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging\" -Name \"EnableModuleLogging\" -ErrorAction SilentlyContinue $moduleStatus = if ($moduleLogging.EnableModuleLogging -eq 1) { \"ENABLED\" } else { \"DISABLED\" } $moduleColor = if ($moduleStatus -eq \"ENABLED\") { \"Green\" } else { \"Yellow\" } Write-Host \"Module Logging: $moduleStatus\" -ForegroundColor $moduleColor # Script block logging kontrol $scriptLogging = Get-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" -Name \"EnableScriptBlockLogging\" -ErrorAction SilentlyContinue $scriptStatus = if ($scriptLogging.EnableScriptBlockLogging -eq 1) { \"ENABLED\" } else { \"DISABLED\" } $scriptColor = if ($scriptStatus -eq \"ENABLED\") { \"Green\" } else { \"Yellow\" } Write-Host \"Script Block Logging: $scriptStatus\" -ForegroundColor $scriptColor } Test-PowerShellSecurity <\/code><\/pre>\r\n<h2>T&uuml;m De\u011fi\u015fiklikleri Uygulayan Master Script<\/h2>\r\n<pre><code># Windows Server Security Hardening Master Script param( $SkipReboot, $NewAdminName = \"SystemManager\", $NewRDPPort = 6689, $NTPServers = \"time.windows.com,time.nist.gov,pool.ntp.org\" ) Write-Host \"Starting Windows Server Security Hardening...\" -ForegroundColor Green Write-Host \"=============================================\" -ForegroundColor Green # 1. Administrator Hesab\u0131n\u0131 Yeniden Adland\u0131r try { Rename-LocalUser -Name \"Administrator\" -NewName $NewAdminName Write-Host \" Administrator account renamed to: $NewAdminName\" -ForegroundColor Green } catch { Write-Host \" Failed to rename Administrator account: $($_.Exception.Message)\" -ForegroundColor Red } # 2. UAC Konfig&uuml;rasyonu try { Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"EnableLUA\" -Value 1 Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"ConsentPromptBehaviorAdmin\" -Value 2 Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"FilterAdministratorToken\" -Value 1 Write-Host \" UAC configured for maximum security\" -ForegroundColor Green } catch { Write-Host \" Failed to configure UAC: $($_.Exception.Message)\" -ForegroundColor Red } # 3. Windows Firewall Sertle\u015ftirme try { Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultInboundAction Block Set-NetFirewallProfile -Profile Domain,Public,Private -LogAllowed True -LogBlocked True Write-Host \" Windows Firewall hardened\" -ForegroundColor Green } catch { Write-Host \" Failed to configure Firewall: $($_.Exception.Message)\" -ForegroundColor Red } # 4. Otomatik Update Konfig&uuml;rasyonu try { Set-Service -Name wuauserv -StartupType Automatic Start-Service wuauserv Write-Host \" Automatic updates enabled\" -ForegroundColor Green } catch { Write-Host \" Failed to configure updates: $($_.Exception.Message)\" -ForegroundColor Red } # 5. Gereksiz Servisleri Devre D\u0131\u015f\u0131 B\u0131rak $ServicesToDisable = @(\"Spooler\", \"RemoteRegistry\", \"Fax\", \"TrkWks\") foreach ($service in $ServicesToDisable) { try { Stop-Service -Name $service -Force -ErrorAction SilentlyContinue Set-Service -Name $service -StartupType Disabled -ErrorAction SilentlyContinue Write-Host \" Disabled service: $service\" -ForegroundColor Green } catch { Write-Host \" Service $service not found or already disabled\" -ForegroundColor Yellow } } # 6. NTP Konfig&uuml;rasyonu try { Stop-Service w32time w32tm \/config \/manualpeerlist:$NTPServers \/syncfromflags:manual \/reliable:yes \/update Start-Service w32time w32tm \/resync \/force Write-Host \" NTP configured with servers: $NTPServers\" -ForegroundColor Green } catch { Write-Host \" Failed to configure NTP: $($_.Exception.Message)\" -ForegroundColor Red } <\/code><\/pre>","excerpt":"Windows Server kurulumu tamamland\u0131ktan sonra, sunucunuzu \u00fcretime almadan \u00f6nce mutlaka de\u011fi\u015ftirmeniz gereken kritik varsay\u0131lan ayarlar vard\u0131r....","created_at":"2025-06-12 13:48:07","updated_at":"2026-09-23 19:04:16","category_id":6,"view_count":946,"reading_time":13,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-06-12 13:48:07","featured_image":"resimyok.jpg","slug":"kurulum-sonrasi-hemen-degistirmeniz-gereken-7-windows-server-varsayilan-ayarlari","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"}