Application Control
App Control managed installer, ISG and supplemental policies
Keep App Control for Business maintainable: trust Intune or ConfigMgr as a managed installer, use ISG carefully and delegate with supplemental policies.
Advanced
Guides tagged
#windows
Application Control
AppLocker rollout: scripts, installers and packaged apps
Roll out AppLocker safely: Application Identity service, audit mode, publisher rules for EXE, script, MSI and packaged apps, and writable-folder gaps.
Intermediate
BitLocker & Boot Security
BitLocker recovery keys: escrow, rotation and auditing
Manage BitLocker recovery keys properly: escrow to AD DS or Entra ID, prove coverage, restrict who can read keys, audit every access and rotate keys after use.
Foundation
Credential Protection
Cached logons, WDigest and credential exposure settings
Cut the credentials Windows keeps on disk and in memory: cached logon count, WDigest, cleanup after logoff, stored network passwords and Credential Manager.
Foundation
Security Baselines
Configuration drift: OSConfig, DSC and compliance reports
Detect and correct Windows configuration drift: OSConfig on Server 2025, PowerShell DSC auto-correct, Group Policy reprocessing, change events and reports.
Advanced
Microsoft Defender
Controlled folder access: ransomware protection that works
Roll out Defender controlled folder access against ransomware: audit mode, events 1123 and 1124, allowing apps, adding protected folders and enforcing by ring.
Intermediate
Microsoft Defender
Audit and minimise Microsoft Defender exclusions
Find every Microsoft Defender exclusion across GPO, Intune and local config, justify or remove it, narrow the rest, hide them from admins and monitor changes.
Foundation
PowerShell Security
Detecting malicious PowerShell with script block logging
Turn PowerShell logs into detections: rebuild 4104 script blocks, use AMSI and engine events, spot obfuscation and unmanaged PowerShell, tune out admin noise.
Intermediate
Attack Surface Reduction
Harden Microsoft Edge with Group Policy and Intune
Harden Microsoft Edge by policy: enforced SmartScreen, an extension allowlist, enhanced security mode, download restrictions and fast forced updates.
Foundation
Microsoft Defender
EDR in block mode, passive mode and third-party AV
How Defender Antivirus behaves next to another antivirus: active, passive and EDR in block mode, forcing passive mode on servers, what you lose, how to verify.
Advanced
Attack Surface Reduction
Exploit protection: system and per-app mitigations
Configure Windows exploit protection, the EMET successor: system defaults, per-app mitigations, audit mode, XML export/import and GPO or Intune deployment.
Intermediate
Windows Firewall
Windows Firewall logging and monitoring that works
Turn Windows Firewall into a detection source: configure pfirewall.log, WFP audit events 5156/5157, rule-change events 4946-4950 and forward them centrally.
Foundation
Windows Firewall
Managing Windows Firewall at scale with GPO and Intune
Run Windows Firewall policy across a fleet: how GPO and Intune rules merge, why block beats allow, disabling local merge and checking the active store.
Intermediate
Patching & Updates
Hotpatch and cluster-aware updating for Windows Server
Patch Windows Server with less downtime: hotpatch on Server 2025 with Azure Arc or Azure Edition, baseline months, prerequisites and cluster-aware updating.
Advanced
Security Baselines
Intune security baselines, settings catalog, GPO conflicts
Deploy Intune security baselines without conflicts: baseline versions, settings catalog layering, endpoint security overlap, MDMWinsOverGP and on-device checks.
Intermediate
Windows Firewall
Domain and server isolation with IPsec
Use IPsec connection security rules so only authenticated domain computers reach your servers: domain and server isolation, crypto choices, safe rollout.
Advanced
PowerShell Security
Just Enough Administration (JEA) step by step
Build JEA endpoints that give operators exactly the commands they need: role capability files, session configurations, virtual accounts, gMSAs and auditing.
Advanced
Attack Surface Reduction
Harden Microsoft Office: macros, OLE and add-ins
Lock down Microsoft 365 Apps: block internet macros, disable XLM, scan VBA with AMSI, keep Protected View on, require signed add-ins, stop OLE and DDE.
Foundation
Security Baselines
Policy Analyzer and LGPO: compare, test, apply baselines
Use Policy Analyzer to diff GPOs, baselines and effective policy, and LGPO.exe to test, apply and export local policy on standalone machines and lab builds.
Intermediate
Legacy Protocols
Print Spooler and Point and Print hardening
Close PrintNightmare-style risks: disable the Print Spooler where unused, restrict driver installs to admins, use Package Point and Print with approved servers.
Intermediate
Credential Protection
RDP without exposing credentials: RCG and Restricted Admin
Stop RDP leaving reusable credentials on servers: Remote Credential Guard, Restricted Admin mode, DisableRestrictedAdmin and credential delegation policy.
Intermediate
Legacy Protocols
Hardening Remote Desktop (RDP) on Windows
Secure Remote Desktop with NLA, the TLS security layer, PKI certificates, restricted users, firewall scoping, session limits and the right logs.
Foundation
Accounts & Privileged Access
Remove local admin rights from users without chaos
Take local admin rights away from users: inventory who has them, enforce membership with GPO or Intune, handle elevation with EPM, keep a break-glass path.
Foundation
BitLocker & Boot Security
Secure Boot, UEFI and the BlackLotus mitigations
Harden the Windows boot chain: verify Secure Boot, apply the CVE-2023-24932 BlackLotus revocations, adopt the 2023 certificates and lock UEFI firmware.
Advanced
Audit & Logging
Deploying and tuning Sysmon at scale
Choose a Sysmon configuration, cut noise without creating blind spots, roll out updates safely across thousands of hosts and monitor Sysmon itself.
Intermediate
Patching & Updates
Patching third-party apps on Windows with winget
Inventory, prioritise and patch third-party apps on Windows: browsers and runtimes first, winget as SYSTEM, App Installer policy, removing what you can't patch.
Foundation
Legacy Protocols
TLS and Schannel hardening on Windows
Disable SSL, TLS 1.0/1.1 and weak ciphers in Schannel, set the cipher suite order by GPO and make .NET use strong crypto after measuring old TLS use.
Intermediate
Accounts & Privileged Access
UAC hardening and Windows Administrator protection
Configure UAC properly: Admin Approval Mode, secure desktop, FilterAdministratorToken, remote UAC for local accounts, and Windows 11 Administrator protection.
Intermediate
BitLocker & Boot Security
VBS, memory integrity (HVCI) and Kernel DMA Protection
Enable virtualization-based security, memory integrity (HVCI) and Kernel DMA Protection: requirements, GPO and Intune settings, driver testing, verification.
Intermediate
Application Control
Microsoft vulnerable driver blocklist: stop BYOVD
Enable and verify the Microsoft vulnerable driver blocklist on clients and servers, keep it current and detect bring-your-own-vulnerable-driver attacks.
Intermediate
Audit & Logging
Windows Event Forwarding at scale
Windows Event Forwarding that holds up: collectors, source-initiated subscriptions, XPath queries, delivery tuning, Security log access and health checks.
Intermediate
Guide
Windows hardening checklist: a 30/60/90-day plan
A prioritised 90-day Windows hardening checklist: easy wins first, then credential and lateral-movement paths, then structural controls, each linked to a guide.
Foundation
Credential Protection
Windows Hello for Business: trust models and PIN policy
Deploy Windows Hello for Business with cloud Kerberos trust or key trust, require TPM-backed keys, set PIN policy, and verify provisioning for users and admins.
Intermediate
Audit & Logging
Windows security event IDs that matter
A practical reference to the Windows event IDs worth collecting and alerting on: logons, failure codes, Kerberos, account changes, persistence and tampering.
Foundation
Patching & Updates
Windows Update policies: deferrals, deadlines and restarts
Configure Windows Update client policies in GPO and Intune: quality and feature deferrals, compliance deadlines, grace periods, restarts and verification.
Intermediate
PowerShell Security
Hardening WinRM and PowerShell remoting
Lock down WinRM: inventory listeners, enforce Kerberos, block Basic, Digest and CredSSP, add HTTPS listeners, keep TrustedHosts empty and scope the firewall.
Intermediate