Monday, February 9, 2026

Security Hardening Standard - 安全性加固標準對比摘要

 
標準名稱
適用對象
優點
缺點
Microsoft Baseline
一般企業
最佳的應用程式相容性,與 Windows 更新同步,易於部署。
安全性相對較寬鬆,僅涵蓋微軟產品。
CIS Benchmarks
金融、醫療、合規企業
業界公認中立且細緻,提供 L1/L2 分層,平衡安全與營運。
規則較多,可能需要針對特定業務軟體進行排除設定。
DISA STIG
政府、軍方、國防承包商
極致的安全性,針對國家級攻擊設計,強制執行高強度稽核。
設定極其繁雜,極易造成系統功能失效或應用程式崩潰。
NIST SP 800-53
美國聯邦機構、FedRAMP
全球最權威的安全性控制框架,邏輯嚴密,適合大型合規架構。
主要是「準則」而非「設定值」,需轉譯為具體指令。
PCI DSS
支付卡產業、電商、零售
專為保護持卡人數據設計,對防火牆與數據加密有明確要求。
範疇較窄(僅限支付環境),每年需進行嚴格的合規審查。
HIPAA
醫療保健、健康保險業
核心在於保護受保護健康資訊 (PHI) 的隱私與完整性。
規範較為籠統(如「合理防護」),需要配合技術標準實施。
USGCB
美國政府低風險設備
曾是聯邦桌面設備的統一基準,由 NIST、DISA 及微軟協作。
已逐漸被 DISA STIG 取代,部分較新版本系統已停止更新。


Print Friendly and PDF
Share/Bookmark

Microsoft Defender Hardening for Windows 11

Microsoft Defender Hardening:

Home:
PS C:\Windows\system32> Set-MpPreference -SignatureUpdateInterval 1

PS C:\Windows\system32> Set-MpPreference -CheckForSignaturesBeforeRunningScan 1

PS C:\Windows\system32> Set-MpPreference -MAPSReporting Advanced -SubmitSamplesConsent SendSafeSamples -CloudBlockLevel High -CloudExtendedTimeout 50
PS C:\Windows\system32> Set-MpPreference -PUAProtection Enabled
PS C:\Windows\system32> Set-MpPreference -EnableNetworkProtection Enabled


MAPS、Cloud Protection 和 PUA 在家用版上是完全有效

Pro/Enterprise:
Able to add ASR Rule:
系統限制:ASR 規則在 Windows 10/11 專業版 (Pro) 上可部分運行,但官方正式支援為 企業版 (Enterprise)。
前置要求:必須將 Microsoft Defender 設為主要防毒軟體,且開啟即時防護與雲端傳送防護。

Reference:

Print Friendly and PDF
Share/Bookmark

Saturday, February 7, 2026

7-zip redirect temp working folder per job by using command prompt

 7z.exe x "D:\source_zip_file.7z.001" -o"D:\Temp\" -w"D:\temp\TempWorkingfolder"



Print Friendly and PDF
Share/Bookmark

Thursday, February 5, 2026

Install Fortinet Forticlient VPN on Deepin 23.1 (For SSL cert is self-signed cert)

1. echo -n | openssl s_client -showcerts -connect registry.example.com:port 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > xxca.crt


Replace the "registry.example.com:port"  to your SSL VPN gateway URL and port.

2. Go to the file "xxca.crt", use a editor like "notepadqq" to open the file

3. Copy all the text in the xxca.crt

4. sudo vi /usr/local/share/ca-certificates/xxca.crt

5. Paste all text into this file and :wq (To save those text)

6. sudo update-ca-certificates

7. Reboot your machine

8. Then you can use the Forticlient to connect your VPN gateway. 


Reference:

https://blog.keepchen.com/a/configure-forticlient-vpn-on-deepin-25.html


Print Friendly and PDF
Share/Bookmark

Thursday, January 1, 2026

Redmi 14c 4G did not receive update on 1.0.10

 My Redmi 14c 4G did not receive update for a long time. It is running on 1.0.10 (HyperOS) (Android 14)

My regional setting is Hong Kong. I change it to Macau, it able to receive 1.0.11, after update it. It able to receive 2.0.203 (HyperOS) 

After that, I able to receive the 3.0.6.0 (HyperOS) (Android 16).

Print Friendly and PDF
Share/Bookmark

Wednesday, December 31, 2025

How to install Microsoft Intune with Microsoft Defender and Intune VPN on Redmi Pad SE 8.7?

The Redmi Pad SE 8.7 which is running on Xiaomi HyperOS 2.x which is Android 15.

When you deploy the "Android For Work" (Personally-Owned Work Profile) ("BYOD") on it. You may hit the permission issue on the Microsoft Defender and cannot trigger the VPN connection.

To resolve this issue, you need to manual grant those permission when you register your device via the app "intune company portal".

There are three steps of the registration:

Step 1: Login and create profile
Step 2: Device registration during this stage, the Microsoft defender will installed to your tablet.
(Do not click the "resolve" of the defender items, it will trigger you to open the app and login the app.

After complete all the above permission grant, click "resolve in steps 2" to continues step 2 setup.

You will request to login your O365/M65 account in your "Microsoft Defender" (Just click your email address, no need to enter username and password.

After that you will able to complete all the setup.

Print Friendly and PDF
Share/Bookmark

Windows 11 (24H2) explorer crashes when opening folder after Windows update

Issue: Windows Update bugs.

Solution:

Use admin right to run the following powershell command:

Add-AppxPackage -Register -Path 'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\appxmanifest.xml' -DisableDevelopmentMode 
Add-AppxPackage -Register -Path 'C:\Windows\SystemApps\Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe\appxmanifest.xml' -DisableDevelopmentMode 
Add-AppxPackage -Register -Path 'C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\appxmanifest.xml' -DisableDevelopmentMode 
Then, reboot your machine

Reference:

Print Friendly and PDF
Share/Bookmark