Windows Firewall
Domain and server isolation with IPsec
Use IPsec connection security rules so only authenticated domain computers reach your servers: domain and server isolation, crypto choices, safe rollout.
Advanced
Guides tagged
#lateral-movement
PowerShell Security
Hardening WinRM and PowerShell remoting
Lock down WinRM: inventory listeners, enforce Kerberos, block Basic, Digest and CredSSP, add HTTPS listeners, keep TrustedHosts empty and scope the firewall.
Intermediate
Windows Firewall
Windows Firewall hardening against lateral movement
Use Windows Defender Firewall as a lateral-movement control: enforce all profiles by GPO, ignore local rules, scope RDP/WinRM/SMB to management subnets and log what matters.
Foundation
Accounts & Privileged Access
Deploy Windows LAPS: unique local admin passwords
Replace shared local Administrator passwords with Windows LAPS: schema, permissions, Group Policy settings, encryption, retrieval and the checks that prove it works.
Foundation