Guides
In-depth Windows hardening guides with Group Policy paths, registry values, PowerShell and verification steps.
49 guides12 areas
Start here
Windows hardening checklist: a 30/60/90-day plan
A prioritised 90-day Windows hardening checklist: easy wins first, then credential and lateral-movement paths, then structural controls, each linked to a guide.
Area 01 · 4 guides
Accounts & Privileged Access
Unique local admin passwords, admin tiering and a small, protected Tier 0.
- 01Deploy Windows LAPS: unique local admin passwordsReplace shared local Administrator passwords with Windows LAPS: schema, permissions, Group Policy settings, encryption, retrieval and the checks that prove it works.
- 02Admin tiering and Protected Users for Active DirectoryApply the Active Directory tier model in practice: what belongs in Tier 0, logon restrictions by GPO, Protected Users, PAWs and the checks that show it is working.
- 03Remove local admin rights from users without chaosTake local admin rights away from users: inventory who has them, enforce membership with GPO or Intune, handle elevation with EPM, keep a break-glass path.
- 04UAC hardening and Windows Administrator protectionConfigure UAC properly: Admin Approval Mode, secure desktop, FilterAdministratorToken, remote UAC for local accounts, and Windows 11 Administrator protection.
Area 02 · 4 guides
Credential Protection
Keep secrets out of LSASS memory with Credential Guard and LSA protection.
- 01Credential Guard and LSA protection: protect LSASSHow Credential Guard and LSA protection (RunAsPPL) stop credential dumping, how to enable and verify them, what they break, and the legacy settings to turn off alongside.
- 02Cached logons, WDigest and credential exposure settingsCut the credentials Windows keeps on disk and in memory: cached logon count, WDigest, cleanup after logoff, stored network passwords and Credential Manager.
- 03RDP without exposing credentials: RCG and Restricted AdminStop RDP leaving reusable credentials on servers: Remote Credential Guard, Restricted Admin mode, DisableRestrictedAdmin and credential delegation policy.
- 04Windows Hello for Business: trust models and PIN policyDeploy Windows Hello for Business with cloud Kerberos trust or key trust, require TPM-backed keys, set PIN policy, and verify provisioning for users and admins.
Area 03 · 4 guides
Attack Surface Reduction
Block the behaviours malware relies on: Office child processes, LSASS reads, script droppers.
- 01Attack surface reduction rules: GUIDs and safe rolloutA practical reference to Microsoft Defender ASR rules: what each rule blocks, its GUID, which to enforce first, audit-mode rollout, event IDs and exclusions that don't gut protection.
- 02Exploit protection: system and per-app mitigationsConfigure Windows exploit protection, the EMET successor: system defaults, per-app mitigations, audit mode, XML export/import and GPO or Intune deployment.
- 03Harden Microsoft Office: macros, OLE and add-insLock down Microsoft 365 Apps: block internet macros, disable XLM, scan VBA with AMSI, keep Protected View on, require signed add-ins, stop OLE and DDE.
- 04Harden Microsoft Edge with Group Policy and IntuneHarden Microsoft Edge by policy: enforced SmartScreen, an extension allowlist, enhanced security mode, download restrictions and fast forced updates.
Area 04 · 4 guides
Microsoft Defender
Turn the built-in antivirus into a hardened sensor: cloud, tamper and network protection.
- 01Harden Microsoft Defender Antivirus beyond the defaultsConfigure Microsoft Defender Antivirus for resistance, not just compatibility: cloud-delivered protection, block at first sight, Tamper Protection, PUA, network protection and exclusion hygiene.
- 02Audit and minimise Microsoft Defender exclusionsFind every Microsoft Defender exclusion across GPO, Intune and local config, justify or remove it, narrow the rest, hide them from admins and monitor changes.
- 03Controlled folder access: ransomware protection that worksRoll out Defender controlled folder access against ransomware: audit mode, events 1123 and 1124, allowing apps, adding protected folders and enforcing by ring.
- 04EDR in block mode, passive mode and third-party AVHow Defender Antivirus behaves next to another antivirus: active, passive and EDR in block mode, forcing passive mode on servers, what you lose, how to verify.
Area 05 · 4 guides
Application Control
Decide what may run with App Control for Business (WDAC) and AppLocker.
- 01App Control for Business (WDAC) vs AppLockerChoose between App Control for Business (formerly WDAC) and AppLocker, start from Microsoft's example policies, audit, read Code Integrity events and enforce without breaking apps.
- 02App Control managed installer, ISG and supplemental policiesKeep App Control for Business maintainable: trust Intune or ConfigMgr as a managed installer, use ISG carefully and delegate with supplemental policies.
- 03Microsoft vulnerable driver blocklist: stop BYOVDEnable and verify the Microsoft vulnerable driver blocklist on clients and servers, keep it current and detect bring-your-own-vulnerable-driver attacks.
- 04AppLocker rollout: scripts, installers and packaged appsRoll out AppLocker safely: Application Identity service, audit mode, publisher rules for EXE, script, MSI and packaged apps, and writable-folder gaps.
Area 06 · 4 guides
Legacy Protocols
Retire SMBv1, NTLMv1, LLMNR and NBT-NS; require SMB and LDAP signing.
- 01Retire LLMNR, NBT-NS, SMBv1 and NTLMv1; require signingMeasure and switch off the Windows protocols behind hash capture and relay attacks: LLMNR, NBT-NS, mDNS, WPAD, SMBv1, NTLMv1, plus SMB signing and LDAP signing with channel binding.
- 02TLS and Schannel hardening on WindowsDisable SSL, TLS 1.0/1.1 and weak ciphers in Schannel, set the cipher suite order by GPO and make .NET use strong crypto after measuring old TLS use.
- 03Hardening Remote Desktop (RDP) on WindowsSecure Remote Desktop with NLA, the TLS security layer, PKI certificates, restricted users, firewall scoping, session limits and the right logs.
- 04Print Spooler and Point and Print hardeningClose PrintNightmare-style risks: disable the Print Spooler where unused, restrict driver installs to admins, use Package Point and Print with approved servers.
Area 07 · 4 guides
Windows Firewall
Default-deny inbound, admin ports scoped to management networks, no workstation-to-workstation SMB.
- 01Windows Firewall hardening against lateral movementUse Windows Defender Firewall as a lateral-movement control: enforce all profiles by GPO, ignore local rules, scope RDP/WinRM/SMB to management subnets and log what matters.
- 02Windows Firewall logging and monitoring that worksTurn Windows Firewall into a detection source: configure pfirewall.log, WFP audit events 5156/5157, rule-change events 4946-4950 and forward them centrally.
- 03Managing Windows Firewall at scale with GPO and IntuneRun Windows Firewall policy across a fleet: how GPO and Intune rules merge, why block beats allow, disabling local merge and checking the active store.
- 04Domain and server isolation with IPsecUse IPsec connection security rules so only authenticated domain computers reach your servers: domain and server isolation, crypto choices, safe rollout.
Area 08 · 4 guides
BitLocker & Boot Security
Encrypt every volume, escrow recovery keys and protect the boot chain with TPM and Secure Boot.
- 01BitLocker hardening: XTS-AES 256, TPM+PIN, key escrowConfigure BitLocker for real-world threats: encryption method, TPM-only vs TPM+PIN, recovery key escrow to AD or Entra ID, Secure Boot, DMA protection and fleet verification.
- 02BitLocker recovery keys: escrow, rotation and auditingManage BitLocker recovery keys properly: escrow to AD DS or Entra ID, prove coverage, restrict who can read keys, audit every access and rotate keys after use.
- 03Secure Boot, UEFI and the BlackLotus mitigationsHarden the Windows boot chain: verify Secure Boot, apply the CVE-2023-24932 BlackLotus revocations, adopt the 2023 certificates and lock UEFI firmware.
- 04VBS, memory integrity (HVCI) and Kernel DMA ProtectionEnable virtualization-based security, memory integrity (HVCI) and Kernel DMA Protection: requirements, GPO and Intune settings, driver testing, verification.
Area 09 · 4 guides
PowerShell Security
Log what PowerShell runs, remove v2 and constrain the language where users don't need it.
- 01PowerShell security: logging, v2 removal, CLM and JEAMake PowerShell transparent and bounded: script block, module and transcription logging, removing PowerShell 2.0, Constrained Language Mode enforced by App Control, and Just Enough Administration.
- 02Just Enough Administration (JEA) step by stepBuild JEA endpoints that give operators exactly the commands they need: role capability files, session configurations, virtual accounts, gMSAs and auditing.
- 03Detecting malicious PowerShell with script block loggingTurn PowerShell logs into detections: rebuild 4104 script blocks, use AMSI and engine events, spot obfuscation and unmanaged PowerShell, tune out admin noise.
- 04Hardening WinRM and PowerShell remotingLock down WinRM: inventory listeners, enforce Kerberos, block Basic, Digest and CredSSP, add HTTPS listeners, keep TrustedHosts empty and scope the firewall.
Area 10 · 4 guides
Audit & Logging
Advanced audit policy, command-line capture, Sysmon and log forwarding that survive an incident.
- 01Windows audit policy and Sysmon: a logging baselineConfigure advanced audit policy subcategories, command-line capture, log sizes, Sysmon and Windows Event Forwarding so Windows logs can answer who, what, where and when.
- 02Deploying and tuning Sysmon at scaleChoose a Sysmon configuration, cut noise without creating blind spots, roll out updates safely across thousands of hosts and monitor Sysmon itself.
- 03Windows Event Forwarding at scaleWindows Event Forwarding that holds up: collectors, source-initiated subscriptions, XPath queries, delivery tuning, Security log access and health checks.
- 04Windows security event IDs that matterA practical reference to the Windows event IDs worth collecting and alerting on: logons, failure codes, Kerberos, account changes, persistence and tampering.
Area 11 · 4 guides
Patching & Updates
Ring-based rollout with enforced deadlines, plus the drivers, firmware and apps outside Windows Update.
- 01Windows patching: update rings, deadlines, KEV firstA Windows patch process that finishes every month: update rings with deadlines, WSUS vs Update for Business, hotpatch, KEV-first priorities and non-Windows gaps.
- 02Windows Update policies: deferrals, deadlines and restartsConfigure Windows Update client policies in GPO and Intune: quality and feature deferrals, compliance deadlines, grace periods, restarts and verification.
- 03Patching third-party apps on Windows with wingetInventory, prioritise and patch third-party apps on Windows: browsers and runtimes first, winget as SYSTEM, App Installer policy, removing what you can't patch.
- 04Hotpatch and cluster-aware updating for Windows ServerPatch Windows Server with less downtime: hotpatch on Server 2025 with Azure Arc or Azure Edition, baseline months, prerequisites and cluster-aware updating.
Area 12 · 4 guides
Security Baselines
Start from Microsoft and CIS baselines, measure drift, document every deviation.
- 01Windows security baselines: Microsoft SCT, CIS and STIGCompare the Microsoft Security Compliance Toolkit, CIS Benchmarks and DISA STIGs, then apply one with Policy Analyzer and LGPO, layer your own settings and track every deviation.
- 02Policy Analyzer and LGPO: compare, test, apply baselinesUse Policy Analyzer to diff GPOs, baselines and effective policy, and LGPO.exe to test, apply and export local policy on standalone machines and lab builds.
- 03Intune security baselines, settings catalog, GPO conflictsDeploy Intune security baselines without conflicts: baseline versions, settings catalog layering, endpoint security overlap, MDMWinsOverGP and on-device checks.
- 04Configuration drift: OSConfig, DSC and compliance reportsDetect and correct Windows configuration drift: OSConfig on Server 2025, PowerShell DSC auto-correct, Group Policy reprocessing, change events and reports.