Application Control
App Control managed installer, ISG and supplemental policies
Keep App Control for Business maintainable: trust Intune or ConfigMgr as a managed installer, use ISG carefully and delegate with supplemental policies.
Advanced
Florian Amette
Security engineer writing practical, baseline-aligned hardening guides for Windows endpoints, servers and Active Directory.
Application Control
AppLocker rollout: scripts, installers and packaged apps
Roll out AppLocker safely: Application Identity service, audit mode, publisher rules for EXE, script, MSI and packaged apps, and writable-folder gaps.
Intermediate
BitLocker & Boot Security
BitLocker recovery keys: escrow, rotation and auditing
Manage BitLocker recovery keys properly: escrow to AD DS or Entra ID, prove coverage, restrict who can read keys, audit every access and rotate keys after use.
Foundation
Credential Protection
Cached logons, WDigest and credential exposure settings
Cut the credentials Windows keeps on disk and in memory: cached logon count, WDigest, cleanup after logoff, stored network passwords and Credential Manager.
Foundation
Security Baselines
Configuration drift: OSConfig, DSC and compliance reports
Detect and correct Windows configuration drift: OSConfig on Server 2025, PowerShell DSC auto-correct, Group Policy reprocessing, change events and reports.
Advanced
Microsoft Defender
Controlled folder access: ransomware protection that works
Roll out Defender controlled folder access against ransomware: audit mode, events 1123 and 1124, allowing apps, adding protected folders and enforcing by ring.
Intermediate
Microsoft Defender
Audit and minimise Microsoft Defender exclusions
Find every Microsoft Defender exclusion across GPO, Intune and local config, justify or remove it, narrow the rest, hide them from admins and monitor changes.
Foundation
PowerShell Security
Detecting malicious PowerShell with script block logging
Turn PowerShell logs into detections: rebuild 4104 script blocks, use AMSI and engine events, spot obfuscation and unmanaged PowerShell, tune out admin noise.
Intermediate
Attack Surface Reduction
Harden Microsoft Edge with Group Policy and Intune
Harden Microsoft Edge by policy: enforced SmartScreen, an extension allowlist, enhanced security mode, download restrictions and fast forced updates.
Foundation
Microsoft Defender
EDR in block mode, passive mode and third-party AV
How Defender Antivirus behaves next to another antivirus: active, passive and EDR in block mode, forcing passive mode on servers, what you lose, how to verify.
Advanced
Attack Surface Reduction
Exploit protection: system and per-app mitigations
Configure Windows exploit protection, the EMET successor: system defaults, per-app mitigations, audit mode, XML export/import and GPO or Intune deployment.
Intermediate
Windows Firewall
Windows Firewall logging and monitoring that works
Turn Windows Firewall into a detection source: configure pfirewall.log, WFP audit events 5156/5157, rule-change events 4946-4950 and forward them centrally.
Foundation
Windows Firewall
Managing Windows Firewall at scale with GPO and Intune
Run Windows Firewall policy across a fleet: how GPO and Intune rules merge, why block beats allow, disabling local merge and checking the active store.
Intermediate
Patching & Updates
Hotpatch and cluster-aware updating for Windows Server
Patch Windows Server with less downtime: hotpatch on Server 2025 with Azure Arc or Azure Edition, baseline months, prerequisites and cluster-aware updating.
Advanced
Security Baselines
Intune security baselines, settings catalog, GPO conflicts
Deploy Intune security baselines without conflicts: baseline versions, settings catalog layering, endpoint security overlap, MDMWinsOverGP and on-device checks.
Intermediate
Windows Firewall
Domain and server isolation with IPsec
Use IPsec connection security rules so only authenticated domain computers reach your servers: domain and server isolation, crypto choices, safe rollout.
Advanced
PowerShell Security
Just Enough Administration (JEA) step by step
Build JEA endpoints that give operators exactly the commands they need: role capability files, session configurations, virtual accounts, gMSAs and auditing.
Advanced
Attack Surface Reduction
Harden Microsoft Office: macros, OLE and add-ins
Lock down Microsoft 365 Apps: block internet macros, disable XLM, scan VBA with AMSI, keep Protected View on, require signed add-ins, stop OLE and DDE.
Foundation
Security Baselines
Policy Analyzer and LGPO: compare, test, apply baselines
Use Policy Analyzer to diff GPOs, baselines and effective policy, and LGPO.exe to test, apply and export local policy on standalone machines and lab builds.
Intermediate
Legacy Protocols
Print Spooler and Point and Print hardening
Close PrintNightmare-style risks: disable the Print Spooler where unused, restrict driver installs to admins, use Package Point and Print with approved servers.
Intermediate
Credential Protection
RDP without exposing credentials: RCG and Restricted Admin
Stop RDP leaving reusable credentials on servers: Remote Credential Guard, Restricted Admin mode, DisableRestrictedAdmin and credential delegation policy.
Intermediate
Legacy Protocols
Hardening Remote Desktop (RDP) on Windows
Secure Remote Desktop with NLA, the TLS security layer, PKI certificates, restricted users, firewall scoping, session limits and the right logs.
Foundation
Accounts & Privileged Access
Remove local admin rights from users without chaos
Take local admin rights away from users: inventory who has them, enforce membership with GPO or Intune, handle elevation with EPM, keep a break-glass path.
Foundation
BitLocker & Boot Security
Secure Boot, UEFI and the BlackLotus mitigations
Harden the Windows boot chain: verify Secure Boot, apply the CVE-2023-24932 BlackLotus revocations, adopt the 2023 certificates and lock UEFI firmware.
Advanced
Audit & Logging
Deploying and tuning Sysmon at scale
Choose a Sysmon configuration, cut noise without creating blind spots, roll out updates safely across thousands of hosts and monitor Sysmon itself.
Intermediate
Patching & Updates
Patching third-party apps on Windows with winget
Inventory, prioritise and patch third-party apps on Windows: browsers and runtimes first, winget as SYSTEM, App Installer policy, removing what you can't patch.
Foundation
Legacy Protocols
TLS and Schannel hardening on Windows
Disable SSL, TLS 1.0/1.1 and weak ciphers in Schannel, set the cipher suite order by GPO and make .NET use strong crypto after measuring old TLS use.
Intermediate
Accounts & Privileged Access
UAC hardening and Windows Administrator protection
Configure UAC properly: Admin Approval Mode, secure desktop, FilterAdministratorToken, remote UAC for local accounts, and Windows 11 Administrator protection.
Intermediate
BitLocker & Boot Security
VBS, memory integrity (HVCI) and Kernel DMA Protection
Enable virtualization-based security, memory integrity (HVCI) and Kernel DMA Protection: requirements, GPO and Intune settings, driver testing, verification.
Intermediate
Application Control
Microsoft vulnerable driver blocklist: stop BYOVD
Enable and verify the Microsoft vulnerable driver blocklist on clients and servers, keep it current and detect bring-your-own-vulnerable-driver attacks.
Intermediate
Audit & Logging
Windows Event Forwarding at scale
Windows Event Forwarding that holds up: collectors, source-initiated subscriptions, XPath queries, delivery tuning, Security log access and health checks.
Intermediate
Guide
Windows hardening checklist: a 30/60/90-day plan
A prioritised 90-day Windows hardening checklist: easy wins first, then credential and lateral-movement paths, then structural controls, each linked to a guide.
Foundation
Credential Protection
Windows Hello for Business: trust models and PIN policy
Deploy Windows Hello for Business with cloud Kerberos trust or key trust, require TPM-backed keys, set PIN policy, and verify provisioning for users and admins.
Intermediate
Audit & Logging
Windows security event IDs that matter
A practical reference to the Windows event IDs worth collecting and alerting on: logons, failure codes, Kerberos, account changes, persistence and tampering.
Foundation
Patching & Updates
Windows Update policies: deferrals, deadlines and restarts
Configure Windows Update client policies in GPO and Intune: quality and feature deferrals, compliance deadlines, grace periods, restarts and verification.
Intermediate
PowerShell Security
Hardening WinRM and PowerShell remoting
Lock down WinRM: inventory listeners, enforce Kerberos, block Basic, Digest and CredSSP, add HTTPS listeners, keep TrustedHosts empty and scope the firewall.
Intermediate
Security Baselines
Windows security baselines: Microsoft SCT, CIS and STIG
Compare the Microsoft Security Compliance Toolkit, CIS Benchmarks and DISA STIGs, then apply one with Policy Analyzer and LGPO, layer your own settings and track every deviation.
Foundation
Patching & Updates
Windows patching: update rings, deadlines, KEV first
A Windows patch process that finishes every month: update rings with deadlines, WSUS vs Update for Business, hotpatch, KEV-first priorities and non-Windows gaps.
Foundation
Audit & Logging
Windows audit policy and Sysmon: a logging baseline
Configure advanced audit policy subcategories, command-line capture, log sizes, Sysmon and Windows Event Forwarding so Windows logs can answer who, what, where and when.
Foundation
PowerShell Security
PowerShell security: logging, v2 removal, CLM and JEA
Make PowerShell transparent and bounded: script block, module and transcription logging, removing PowerShell 2.0, Constrained Language Mode enforced by App Control, and Just Enough Administration.
Intermediate
BitLocker & Boot Security
BitLocker hardening: XTS-AES 256, TPM+PIN, key escrow
Configure BitLocker for real-world threats: encryption method, TPM-only vs TPM+PIN, recovery key escrow to AD or Entra ID, Secure Boot, DMA protection and fleet verification.
Intermediate
Windows Firewall
Windows Firewall hardening against lateral movement
Use Windows Defender Firewall as a lateral-movement control: enforce all profiles by GPO, ignore local rules, scope RDP/WinRM/SMB to management subnets and log what matters.
Foundation
Legacy Protocols
Retire LLMNR, NBT-NS, SMBv1 and NTLMv1; require signing
Measure and switch off the Windows protocols behind hash capture and relay attacks: LLMNR, NBT-NS, mDNS, WPAD, SMBv1, NTLMv1, plus SMB signing and LDAP signing with channel binding.
Foundation
Application Control
App Control for Business (WDAC) vs AppLocker
Choose between App Control for Business (formerly WDAC) and AppLocker, start from Microsoft's example policies, audit, read Code Integrity events and enforce without breaking apps.
Intermediate
Microsoft Defender
Harden Microsoft Defender Antivirus beyond the defaults
Configure Microsoft Defender Antivirus for resistance, not just compatibility: cloud-delivered protection, block at first sight, Tamper Protection, PUA, network protection and exclusion hygiene.
Foundation
Attack Surface Reduction
Attack surface reduction rules: GUIDs and safe rollout
A practical reference to Microsoft Defender ASR rules: what each rule blocks, its GUID, which to enforce first, audit-mode rollout, event IDs and exclusions that don't gut protection.
Foundation
Credential Protection
Credential Guard and LSA protection: protect LSASS
How Credential Guard and LSA protection (RunAsPPL) stop credential dumping, how to enable and verify them, what they break, and the legacy settings to turn off alongside.
Intermediate
Accounts & Privileged Access
Admin tiering and Protected Users for Active Directory
Apply the Active Directory tier model in practice: what belongs in Tier 0, logon restrictions by GPO, Protected Users, PAWs and the checks that show it is working.
Intermediate
Accounts & Privileged Access
Deploy Windows LAPS: unique local admin passwords
Replace shared local Administrator passwords with Windows LAPS: schema, permissions, Group Policy settings, encryption, retrieval and the checks that prove it works.
Foundation