Windows Hardening

Windows is the dominant OS in enterprise environments, which makes it the dominant target. Active Directory, SMB, RDP, DCOM, WMI, these are all powerful features that also happen to be the bread and butter of how attackers move through corporate networks. Hardening Windows, whether it’s a workstation, a server, or a domain controller, is about systematically closing those doors. This page covers the practical steps, what to actually configure, and the tools to help you do it.

Start with Microsoft’s Security Baselines

Microsoft publishes Security Baselines - Group Policy templates with their recommended security configurations for each Windows version. These are free and are the official starting point:

Download from the Microsoft Security Compliance Toolkit
Baselines exist for Windows 10, Windows 11, Windows Server 2019, 2022, and Microsoft 365 Apps

CIS Benchmarks for Windows are equally good and widely used - grab the relevant one from cisecurity.org.

Account and Authentication Hardening

Local Account Policies

Open secpol.msc (Local Security Policy) or configure via Group Policy: Account Policies > Password Policy:

Minimum password length: 14+ characters
Maximum password age: 90 days (or never, if using MFA)
Password history: 24
Complexity requirements: Enabled

Account Policies > Account Lockout Policy:

Account lockout threshold: 5 invalid attempts
Lockout duration: 15 minutes
Reset lockout counter after: 15 minutes

Disable the Built-in Administrator Account

The default Administrator account with a well-known SID (S-1-5-21-…-500) is a consistent attack target:

# Disable the built-in Administrator
Disable-LocalUser -Name "Administrator"

# Rename it if you need to keep it (security through obscurity, but reduces noise)
Rename-LocalUser -Name "Administrator" -NewName "something_else"

Disable the Guest Account

Disable-LocalUser -Name "Guest"

Local Administrator Password Solution (LAPS)

In domain environments, every machine having the same local admin password is a massive lateral movement risk. Microsoft LAPS (or the newer Windows LAPS built into Windows Server 2022/Windows 11) generates unique, random, rotated passwords for local admin accounts:

# Check if LAPS is installed
Get-Command Get-LapsADPassword -ErrorAction SilentlyContinue

# View LAPS password for a computer (requires appropriate AD permissions)
Get-LapsADPassword -Identity WORKSTATION01

Windows Defender and Antivirus

On modern Windows, Microsoft Defender is actually quite solid - but its default configuration can be improved:

# Enable real-time protection (should be on by default)
Set-MpPreference -DisableRealtimeMonitoring $false

# Enable cloud-based protection
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent SendAllSamples

# Enable network protection (blocks malicious domains and IPs)
Set-MpPreference -EnableNetworkProtection Enabled

# Enable controlled folder access (ransomware protection)
Set-MpPreference -EnableControlledFolderAccess Enabled

# Enable attack surface reduction (ASR) rules
# Block Office apps from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Block credential stealing from LSASS
Add-MpPreference -AttackSurfaceReductionRules_Ids 9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2 -AttackSurfaceReductionRules_Actions Enabled

Remote Desktop Protocol (RDP)

RDP is one of the most attacked services on Windows - ransomware gangs love it. If you must use RDP:

# Restrict RDP access to specific IP ranges via Windows Firewall
New-NetFirewallRule -DisplayName "RDP - Allowed Sources" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 10.0.0.0/8 -Action Allow

# Block RDP from everywhere else
New-NetFirewallRule -DisplayName "RDP - Block All" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Block

Additional RDP hardening (via Group Policy or Registry):

Enable Network Level Authentication (NLA) - Computer Config > Admin Templates > Windows Components > Remote Desktop Services > Require NLA
Set maximum session time limits
Use Remote Desktop Gateway instead of direct RDP exposure
Consider changing the default port (3389) - not a security control, but reduces automated scanning noise

Windows Firewall

Windows Firewall with Advanced Security is actually capable - it’s just rarely configured well.

# Ensure firewall is on for all profiles
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

# Default deny inbound on all profiles
Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultInboundAction Block
Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultOutboundAction Allow

# View all enabled inbound rules
Get-NetFirewallRule -Direction Inbound -Enabled True | Format-Table DisplayName, Action, Profile

# Disable a specific rule you don't need
Disable-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)"

SMB Hardening

SMB is the protocol behind Windows file sharing and a common attack vector (EternalBlue, lateral movement, credential relay).

# Disable SMBv1 - it should never be enabled in 2024+
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

# Require SMB signing (prevents relay attacks like Responder/NTLM relay)
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force
Set-SmbClientConfiguration -RequireSecuritySignature $true -Force

# Disable SMB compression if not needed (reduces attack surface)
Set-SmbServerConfiguration -DisableCompression $true -Force

# Verify current SMB configuration
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol, EnableSMB2Protocol, RequireSecuritySignature

Disabling Unnecessary Services and Features

# Check running services
Get-Service | Where-Object {$_.Status -eq "Running"} | Sort-Object DisplayName

# Disable a service you don't need
Set-Service -Name "RemoteRegistry" -StartupType Disabled
Stop-Service -Name "RemoteRegistry"

# Common services to evaluate for disabling (context-dependent):
# RemoteRegistry - allows remote registry editing - often not needed
# Telnet - should never be on
# SNMP - if not actively used
# Fax - almost never needed
# Print Spooler (on non-print servers) - was exploited by PrintNightmare

Windows Features to Remove

# Remove PowerShell v2 (lacks security logging and constrained language mode)
Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root -NoRestart

# Remove Telnet client (you shouldn't be using this)
Disable-WindowsOptionalFeature -Online -FeatureName TelnetClient -NoRestart

PowerShell Security

PowerShell is both essential and one of the most abused tools by attackers. Harden it without breaking legitimate use:

# Set execution policy - RemoteSigned requires scripts from internet to be signed
Set-ExecutionPolicy RemoteSigned -Scope LocalMachine

# Enable Script Block Logging (logs every PowerShell script that runs)
# Via Group Policy: Computer Config > Admin Templates > Windows Components > Windows PowerShell
# Enable "Turn on PowerShell Script Block Logging"

# Enable Module Logging (logs all PowerShell module usage)
# Enable "Turn on Module Logging" in the same policy location

# Enable Transcription (full PS session transcripts)
# Enable "Turn on PowerShell Transcription" and specify output directory

# Force PowerShell 5.1+ (not PS 2.0) to prevent downgrade attacks
# Done by removing the PS v2 feature (see above)

Credential Protection

Enable Credential Guard

Credential Guard uses virtualization-based security to protect LSASS credentials, preventing tools like Mimikatz from dumping them:

# Check if Credential Guard is running
(Get-CimInstance -Namespace root/Microsoft/Windows/DeviceGuard -ClassName Win32_DeviceGuard).SecurityServicesRunning
# Value 1 = Credential Guard running

# Enable via Group Policy:
# Computer Config > Admin Templates > System > Device Guard
# "Turn On Virtualization Based Security" > Enable
# Set Credential Guard to: Enabled with UEFI lock

Disable NTLM Where Possible

NTLM is an older authentication protocol that’s frequently abused for relay attacks. Where Kerberos can be used, it should be:

# Restrict NTLM usage (be careful - this can break things in older environments)
# Via Group Policy: Computer Config > Windows Settings > Security Settings > Local Policies > Security Options
# "Network Security: Restrict NTLM: NTLM authentication in this domain" > Deny All

Disable WDigest Authentication

WDigest stores plaintext credentials in memory - it shouldn’t be enabled on modern Windows, but sometimes gets re-enabled:

# Disable WDigest (prevents plaintext credential storage in LSASS)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" -Name "UseLogonCredential" -Value 0

Windows Event Logging

Default Windows logging is insufficient for any meaningful detection or forensics. You need to increase log sizes and enable additional audit policies.

Audit Policy

# Enable comprehensive audit policy via auditpol
auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
auditpol /set /category:"Account Logon" /success:enable /failure:enable
auditpol /set /category:"Account Management" /success:enable /failure:enable
auditpol /set /category:"Policy Change" /success:enable /failure:enable
auditpol /set /category:"Privilege Use" /success:enable /failure:enable
auditpol /set /category:"Object Access" /success:enable /failure:enable
auditpol /set /subcategory:"Process Creation" /success:enable

# Check current audit policy
auditpol /get /category:*

Increase Log Sizes

Default Windows log sizes are way too small for any real environment:

# Set Security log size to 1GB
wevtutil sl Security /ms:1073741824

# Set System log size to 256MB
wevtutil sl System /ms:268435456

# Set Application log size to 256MB
wevtutil sl Application /ms:268435456

Enable Sysmon

Sysmon (System Monitor) from Sysinternals is a free tool that dramatically improves Windows visibility. It logs process creation, network connections, file creation, and more with much more detail than native audit logging:

# Download Sysmon from Microsoft Sysinternals
# Run with a config (SwiftOnSecurity's config is a popular community baseline)
sysmon64 -accepteula -i sysmonconfig.xml

# Update config
sysmon64 -c sysmonconfig.xml

Use the SwiftOnSecurity Sysmon config as a starting point.

AppLocker and Windows Defender Application Control (WDAC)

Control which applications are allowed to run - one of the most effective defenses against malware and ransomware. AppLocker (older, easier to configure):

Available in Enterprise/Education editions
Configure via Group Policy: Computer Config > Windows Settings > Security Settings > Application Control Policies > AppLocker
Start in Audit mode to understand what would be blocked before enforcing

WDAC (newer, more robust):

Works at the kernel level, harder to bypass than AppLocker
Managed via Group Policy or Intune
Microsoft provides a WDAC Wizard to help build policies

Windows Update and Patch Management

# Check Windows Update status
Get-WindowsUpdateLog

# Force check for updates (requires PSWindowsUpdate module)
Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate
Install-WindowsUpdate -AcceptAll -AutoReboot

In enterprise environments, use WSUS (Windows Server Update Services) or Microsoft Endpoint Configuration Manager (MECM/SCCM) for centralized patch management.

Useful Tools

Tool	What it’s for
Microsoft Security Compliance Toolkit	Official baseline configs from Microsoft
CIS-CAT	Benchmark assessment against CIS Windows benchmarks
Sysmon	Enhanced Windows event logging
BloodHound / SharpHound	AD attack path analysis - run it defensively to find your own issues
Pingcastle	Active Directory security audit tool
LAPS	Local Administrator Password Solution
Defender for Endpoint	Commercial EDR - best-in-class Windows detection
Microsoft Baseline Security Analyzer	Legacy tool but still useful for basic checks
PowerStig	PowerShell module for DISA STIG compliance

Active Directory Specific Hardening

If you’re hardening in a domain environment, AD hardening deserves its own attention:

Tier model - Separate admin accounts by tier (T0: Domain Controllers, T1: Servers, T2: Workstations). Never use the same account across tiers.
Protected Users group - Add sensitive accounts to the Protected Users security group to restrict credential caching and weak auth
Disable unconstrained delegation - Extremely dangerous. Audit with: Get-ADComputer -Filter {TrustedForDelegation -eq $true}
Review AdminSDHolder - Controls ACLs on privileged accounts
Monitor Kerberoastable accounts - Service accounts with SPNs and weak passwords: Get-ADUser -Filter {ServicePrincipalName -ne "$null"}
Run Pingcastle or BloodHound - These tools specifically find AD attack paths

Reference

Windows hardening in enterprise environments is a team sport. Most of it happens through Group Policy and requires coordination between IT and security. Start with the Microsoft Security Baselines and work outward from there.

Welcome

Awesome Resources

Red Teaming 101

Blue Teaming 101

GRC 101

General IT Knowledge

Windows

Windows Hardening

Start with Microsoft’s Security Baselines

Account and Authentication Hardening

Local Account Policies

Disable the Built-in Administrator Account

Disable the Guest Account

Local Administrator Password Solution (LAPS)

Windows Defender and Antivirus

Remote Desktop Protocol (RDP)

Windows Firewall

SMB Hardening

Disabling Unnecessary Services and Features

Windows Features to Remove

PowerShell Security

Credential Protection

Enable Credential Guard

Disable NTLM Where Possible

Disable WDigest Authentication

Windows Event Logging

Audit Policy

Increase Log Sizes

Enable Sysmon

AppLocker and Windows Defender Application Control (WDAC)

Windows Update and Patch Management

Useful Tools

Active Directory Specific Hardening

Reference

​Windows Hardening

​Start with Microsoft’s Security Baselines

​Account and Authentication Hardening

​Local Account Policies

​Disable the Built-in Administrator Account

​Disable the Guest Account

​Local Administrator Password Solution (LAPS)

​Windows Defender and Antivirus

​Remote Desktop Protocol (RDP)

​Windows Firewall

​SMB Hardening

​Disabling Unnecessary Services and Features

​Windows Features to Remove

​PowerShell Security

​Credential Protection

​Enable Credential Guard

​Disable NTLM Where Possible

​Disable WDigest Authentication

​Windows Event Logging

​Audit Policy

​Increase Log Sizes

​Enable Sysmon

​AppLocker and Windows Defender Application Control (WDAC)

​Windows Update and Patch Management

​Useful Tools

​Active Directory Specific Hardening

​Reference

Windows Hardening

Start with Microsoft’s Security Baselines

Account and Authentication Hardening

Local Account Policies

Disable the Built-in Administrator Account

Disable the Guest Account

Local Administrator Password Solution (LAPS)

Windows Defender and Antivirus

Remote Desktop Protocol (RDP)

Windows Firewall

SMB Hardening

Disabling Unnecessary Services and Features

Windows Features to Remove

PowerShell Security

Credential Protection

Enable Credential Guard

Disable NTLM Where Possible

Disable WDigest Authentication

Windows Event Logging

Audit Policy

Increase Log Sizes

Enable Sysmon

AppLocker and Windows Defender Application Control (WDAC)

Windows Update and Patch Management

Useful Tools

Active Directory Specific Hardening

Reference