Procedure

1. Log on to the inSync server as an Administrator and launch the Server Manager console.
2. Click Tools > Security Configuration Wizard under the Security Information.  The Security Configuration Wizard is displayed.
   
   
3. Click Next on the Welcome Page.
   
   
4. Select Create a new security policy and click Next.
5. Keep the existing server as selected and click Next.
   
   
6. Click Next when the processing is complete on the Processing Security Configuration Database page.
   
   
7. Click Next on the Role-Based Service Configuration page.
   
   
8. Select Remote SCW Configuration and Analysis, clear all the other server roles., and click Next.
   Remote SCW Configuration and Analysis role is required only when you want to manage the Security configuration centrally or remotely.
   
   
9. On the Select Client Features page, select the following features and click Next.
   • Background Intelligent Transfer Service
   • DNS Client
   • Microsoft Networking Client
   • Time Synchronisation
   • Windows Update
     
     
10. On the Select Administration and Other Options page, select the following options, clear the other options, and click Next.
    • Local Application Installation
    • Microsoft Fibre Channel Platform Registration Service (Required only if any system disk/volumes are FC based.)
    • Microsoft iSCSI Initiator Service (Required only if any system disk/volumes are iSCSI based.)
      
      
11. On the Select Additional Services page, select the following services and clear the rest.

On inSync Master:

• Background Tasks Infrastructure Service
• Druva inSync Master Config Server
• Druva inSync Master Control Panel
• Druva inSync Master Sync Server
• Local Session Manager
• Performance Counter DLL Host
• Power
• Windows Font Cache Service

On Storage Node:

• Background Tasks Infrastructure Service
• Druva inSync Storage Node
• Local Session Manager
• Optimize Drives
• Performance Counter DLL Host
• Power
• Windows Font Cache Service
• User Access Logging Service
  
  

12. On the Handling Unspecified Services page, select Disable the Service option and click Next.
    
    
13. Click Next on the Confirm Service Changes page.
    
    
14. Click Next on the Network Security page.
    
    
15. On the Network Security Rules page select the following rules and clear the rest.
    • Core Networking – DNS (UDP-Out)
    • Core Networking – IPHTTPS (TCP-In)
    • Core Networking – IPHTTPS (TCP-Out)
    • File and Printer Sharing (SMB-Out)
      
      
16. Click Add to add the rules to allow incoming TCP for Backup/Sync port (e.g.2081) and Admin UI port (e.g. 2088) on all connections.
17. Click Add again and add the rule Allow ICMP (ping) only from inSync Master and click Next.
18. Select Skip this section on the Registry Settings page and click Next.
    
    
19.  Select the Skip this section on the Audit Policy page and click Next.
    
    
20. Click Next on the Save Security Policy page.
21. Name the Policy: Click on Browse name as “DruvaHardening” and click on Save and then click Next:
22. On Security Policy File Name page, click Browse and add path to DruvaHardening, click Save, and then click Next.
    
    
23. Select Apply Now on the Apply Security Policy page and click Next.
    
    
24. Click Finish.
    
    
25. Reboot the server.