Skip to content
WindowsHardening
Start hereNew: 49 in-depth guides and a 90-day Windows hardening plan

Harden Windows, one pane at a time.

A practical map of Windows hardening for endpoints, servers and domains. Every control comes with the Group Policy path, the registry value, the PowerShell to verify it and the things it will break.

Start the 90-day planExplore the map
Target state · Tier 1 member server

89%

controls enforced

Extra local admins

0

−100% / 30 d

App Control audit

412

in audit

  • Local admin passwordEnforced
  • LSASSEnforced
  • Credential GuardEnforced
  • ASR rulesEnforced
  • SMB signingEnforced
  • LLMNREnforced
  • NTLMEnforced
  • PowerShellEnforced
  • App Controlin audit
Illustrative target configuration

Aligned with

  • Microsoft Security Baselines
  • CIS Benchmarks
  • DISA STIG
  • ANSSI
  • MITRE ATT&CK
areas
12
guides
49
glossary terms
29
languages
4

Why it works

Written for the people who change production

Every guide is built the same way, so you can go from finding to enforced control without a second tab open.

Exact paths and values

The Group Policy path, the registry value and the attribute to set. No hand-waving, no "consider hardening".

PowerShell to verify

Read the current state before you change it and prove the change afterwards, with commands you can paste.

What it breaks

Every guide ends with the compatibility fallout, so the control is not rolled back at the first help-desk ticket.

Audit before enforce

Audit modes, event IDs and staged rings: the rollout that survives contact with legacy apps.

Ordered by impact

A map of twelve areas and a 90-day plan that puts the controls behind most real breaches first.

The map

Twelve areas, from identity to baselines

Each area groups the controls that defend against the same class of attack. Start anywhere, but the first two areas stop most real-world domain compromises.

  1. 01Accounts & Privileged AccessUnique local admin passwords, admin tiering and a small, protected Tier 0.Windows LAPSTier modelProtected UsersClientServerAD4 guides
  2. 02Credential ProtectionKeep secrets out of LSASS memory with Credential Guard and LSA protection.Credential GuardRunAsPPLWDigest offClientServer4 guides
  3. 03Attack Surface ReductionBlock the behaviours malware relies on: Office child processes, LSASS reads, script droppers.ASR rulesExploit protectionClientServer4 guides
  4. 04Microsoft DefenderTurn the built-in antivirus into a hardened sensor: cloud, tamper and network protection.Tamper ProtectionCloud protectionNetwork protectionClientServer4 guides
  5. 05Application ControlDecide what may run with App Control for Business (WDAC) and AppLocker.App Control (WDAC)AppLockerClientServer4 guides
  6. 06Legacy ProtocolsRetire SMBv1, NTLMv1, LLMNR and NBT-NS; require SMB and LDAP signing.SMB signingNTLMv2 onlyLLMNR offClientServerAD4 guides
  7. 07Windows FirewallDefault-deny inbound, admin ports scoped to management networks, no workstation-to-workstation SMB.Default deny inboundMgmt-subnet rulesLoggingClientServer4 guides
  8. 08BitLocker & Boot SecurityEncrypt every volume, escrow recovery keys and protect the boot chain with TPM and Secure Boot.BitLockerTPM + PINSecure BootClientServer4 guides
  9. 09PowerShell SecurityLog what PowerShell runs, remove v2 and constrain the language where users don't need it.Script block loggingCLMJEAClientServer4 guides
  10. 10Audit & LoggingAdvanced audit policy, command-line capture, Sysmon and log forwarding that survive an incident.Advanced audit policySysmonWEFClientServerAD4 guides
  11. 11Patching & UpdatesRing-based rollout with enforced deadlines, plus the drivers, firmware and apps outside Windows Update.Update ringsDeadlinesKEV-firstClientServer4 guides
  12. 12Security BaselinesStart from Microsoft and CIS baselines, measure drift, document every deviation.Microsoft SCTCIS BenchmarksPolicy AnalyzerClientServerAD4 guides

Roadmap

A 90-day plan, in three phases

The order matters. Close the paths attackers actually use first, then fix the structure, then keep it that way.

  1. Days 0–30

    Take the easy wins

    Windows LAPS, local admin rights removed, ASR rules, LLMNR and NBT-NS off, internet macros blocked.

  2. Days 31–60

    Protect credentials, stop lateral movement

    Credential Guard and LSA protection, safe RDP, admin tiering, firewall rules, PowerShell logging.

  3. Days 61–90

    Structural hardening

    App Control, BitLocker with TPM+PIN, memory integrity, TLS clean-up and drift detection.

Open the full checklist

Method

Every change follows the same loop

Windows hardening fails when it breaks something and gets rolled back. Audit modes exist for almost every control on this map: use them.

  1. 01MeasureRead the current state with PowerShell or Policy Analyzer before changing anything.
  2. 02AuditTurn on the control in audit mode and collect the events it would have blocked.
  3. 03EnforceFix or exclude the real collisions, then enforce ring by ring with a rollback plan.
  4. 04VerifyRe-check the setting and alert on drift, so the control stays on after the next rebuild.

Guides

Latest guides

View all guides

Harden every Windows machine before someone else tests it.

Start with the 90-day plan, or pick the area that keeps you up at night.

Start the 90-day planBrowse all guides