Windows hardening checklist: a 30/60/90-day plan

Windows ships with hundreds of security settings, and every baseline, benchmark and audit report adds more. The hard part of hardening is not finding things to change. It is deciding what to change first, without breaking the business, and proving that each change actually happened.

This checklist puts every guide on this site into a 90-day sequence. The order follows how real intrusions unfold: an attacker gets code running on a workstation, steals credentials, moves laterally, then disables security tools and persists. The first 30 days remove the cheapest and most commonly abused openings. Days 31 to 60 break the credential theft and lateral movement chain. Days 61 to 90 add the structural controls, such as application control and boot security, that take longer to roll out but make the whole estate harder to own. After that, the work becomes a cycle of patching, detection and measurement.

Each item is a task you can tick, with a short reason and a link to the guide that explains how to do it.

Before you start

You cannot prioritise what you have not counted, and you cannot show progress without a starting point. Spend the first few days on inventory and measurement.

• Inventory devices and roles. Export a list of every Windows device with operating system version, build, edition, join type (domain, hybrid, Entra) and management tool (Group Policy, Intune, Configuration Manager). Tag domain controllers, servers exposed to the internet, admin workstations and kiosk or shared devices separately.
• Inventory privileged accounts. List members of Domain Admins, Enterprise Admins, local Administrators groups and any account used by a management tool.
• Pick pilot groups. For every change below, use a small pilot ring of IT devices first, then a broader early-adopter ring, then everyone.

Then measure where you stand:

• Measure your current configuration against a recognised baseline — without a gap list you will argue about opinions instead of evidence, Security baselines: CIS and Microsoft
• Export existing GPOs and compare them with the baseline — reveals conflicting and forgotten settings before you add new ones, Policy Analyzer and LGPO
• Decide which security events you will track as success measures — failed logons, NTLM use and new services give you numbers to report, Windows security event IDs that matter

Record the results in a simple spreadsheet: setting, current state, target state, owner, phase. You will re-run the same measurement at day 30, 60 and 90.

Days 0–30: stop the easy wins

The goal of the first month is to remove openings that attackers exploit at scale and that cost little to close. Most items are single policy changes with low compatibility risk. Where a change has any risk, start in audit mode and move to enforcement before day 30.

Patching and exposure

• Put every device into an update ring with deferrals and deadlines — unpatched vulnerabilities remain a leading way in, Windows patching and update rings
• Patch browsers, PDF readers, runtimes and remote access tools — third-party software is exploited as often as Windows itself, Patching third-party applications
• Turn on the Windows Firewall in all profiles and block inbound by default — a host firewall stops worms and limits lateral movement, Windows Firewall hardening
• Require Network Level Authentication for RDP and remove it from the internet — exposed RDP is one of the most common ransomware entry points, Hardening Remote Desktop
• Disable the Print Spooler on domain controllers and servers that do not print — removes PrintNightmare-class bugs and coercion paths, Print Spooler and Point and Print hardening

Local admin and credentials

• Deploy Windows LAPS to every workstation and member server — a shared local Administrator password turns one compromise into all of them, Deploy Windows LAPS
• Confirm WDigest is off and reduce cached logons — stops plaintext passwords in memory and limits cached domain credentials, Cached logons, WDigest and credential exposure settings
• Disable LLMNR and NetBIOS over TCP/IP — these name-resolution fallbacks hand password hashes to anyone on the network, Disable LLMNR, NetBIOS, enforce SMB signing and restrict NTLM

Defender and email-borne attacks

• Turn on real-time, cloud-delivered and behaviour monitoring protection with tamper protection — Defender is only useful if it cannot be switched off, Microsoft Defender Antivirus hardening
• Review every Defender exclusion and hide exclusions from local admins — broad exclusions are where attackers drop their tools, Auditing and minimising Defender exclusions
• Enable attack surface reduction rules in audit, then block the standard protection rules — stops Office, script and LSASS abuse with little breakage, Attack surface reduction rules
• Block macros in files from the internet and disable XLM macros — malicious documents are still a top initial access vector, Hardening Microsoft Office
• Enforce SmartScreen and prevent bypass in Microsoft Edge — blocks known phishing and malware downloads before they run, Hardening Microsoft Edge with policy

Visibility and data at rest

• Apply an advanced audit policy and install Sysmon with a starter configuration — you cannot investigate what you did not log, Audit policy and Sysmon baseline
• Turn on PowerShell script block and module logging — PowerShell is involved in most hands-on-keyboard intrusions, PowerShell logging and Constrained Language Mode
• Encrypt every laptop with BitLocker and use a pre-boot PIN on high-risk devices — protects data and credentials on lost devices, BitLocker with TPM and PIN
• Escrow BitLocker recovery keys and audit who reads them — an unrecoverable device is an outage, and recovery keys are a secret too, BitLocker recovery key escrow and auditing

At day 30, re-run the baseline comparison and check that LAPS, Defender, ASR and BitLocker compliance numbers are close to 100 percent on the devices in scope.

Days 31–60: close credential and lateral-movement paths

With the obvious doors shut, the second month targets what attackers do after the first foothold: steal credentials, reuse them, and move to more valuable machines. These changes need more testing because they affect how administrators work.

Protect credentials on the endpoint

• Enable Credential Guard and LSA protection — isolates NTLM hashes and Kerberos secrets from LSASS dumping tools, Credential Guard and LSA protection
• Use Remote Credential Guard or Restricted Admin for administrative RDP — stops admin credentials being left on the servers you connect to, RDP without exposing credentials
• Roll out Windows Hello for Business, starting with IT staff — phishing-resistant sign-in removes the reusable password, Windows Hello for Business

Reduce privilege

• Separate admin tiers and add privileged users to Protected Users — keeps domain admin credentials off workstations, Admin tiering and Protected Users
• Remove local admin rights from standard users, with a break-glass process — most malware and many exploits need admin rights to do real damage, Removing local admin rights from users
• Keep UAC at its secure defaults and block remote use of local admin tokens — prevents silent elevation and pass-the-hash with local accounts, UAC hardening and Administrator protection

Harden the protocols attackers move with

• Require SMB signing and start restricting NTLM, beginning with NTLMv1 — breaks NTLM relay, one of the fastest paths to domain admin, Disable LLMNR, NetBIOS, enforce SMB signing and restrict NTLM
• Configure WinRM for Kerberos and HTTPS only, and scope who can connect — remote management is lateral movement when left open, Hardening WinRM
• Disable TLS 1.0 and 1.1, SSL and weak ciphers — old protocols weaken every service that negotiates them, TLS and Schannel hardening
• Manage firewall rules centrally and turn off local rule merging — stops users and malware adding their own inbound exceptions, Managing Windows Firewall at scale

Collect the evidence centrally

• Tune your Sysmon configuration to reduce noise — raw volume hides the few events that matter, Deploying and tuning Sysmon
• Forward security, PowerShell and Sysmon logs to a collector — local logs disappear when attackers clear them, Windows Event Forwarding at scale
• Enable firewall logging and forward blocked connection events — shows scanning and lateral movement attempts, Windows Firewall logging and monitoring
• Build detections for suspicious PowerShell from script block logs — catches encoded commands and AMSI bypasses early, Detecting malicious PowerShell

At day 60, measure NTLM usage, local admin group membership and the number of admin logons to workstations. These numbers should be falling.

Days 61–90: structural hardening

The third month introduces controls that change what can run and what can be trusted on a device. They give the strongest protection but need careful audit periods, so start them now even if enforcement finishes later.

Control what runs

• Design an application control strategy and start App Control in audit mode — allowlisting stops unknown malware regardless of signatures, App Control for Business and AppLocker
• Use a managed installer and supplemental policies to keep App Control maintainable — reduces the rule churn that makes allowlisting fail, App Control managed installer and Intelligent Security Graph
• Where App Control is not practical, deploy AppLocker for scripts and installers — blocks user-writable paths, a common malware launch point, AppLocker rollout
• Confirm the vulnerable driver blocklist is enforced — stops attackers loading signed but exploitable drivers to kill security tools, Microsoft vulnerable driver blocklist
• Apply exploit protection mitigations to high-risk applications — makes memory corruption bugs harder to exploit, Exploit protection

Protect the platform

• Enable virtualization-based security, memory integrity and check Kernel DMA Protection — protects the kernel from unsigned code and DMA attacks, Virtualization-based security, HVCI and Kernel DMA protection
• Verify Secure Boot, apply the BlackLotus mitigations and plan the certificate update — bootkits run before any other protection, Secure Boot and UEFI hardening
• Turn on controlled folder access in audit, then block — limits ransomware damage to user data, Controlled folder access against ransomware
• Configure EDR in block mode and review devices running Defender in passive mode — catches what another antivirus misses, EDR in block mode and passive mode

Narrow administration

• Replace routine admin access with Just Enough Administration endpoints — users run specific tasks without holding admin rights, Just Enough Administration step by step
• Require IPsec authentication to reach sensitive servers — only domain members, and only the right ones, can connect at all, Domain and server isolation with IPsec
• Move cloud-managed devices to Intune security baselines and resolve GPO conflicts — one clear source of truth per setting, Intune security baselines and the settings catalog

At day 90, re-run the full baseline comparison and compare it with your starting measurement. The difference, shown per area, is the report for management.

Ongoing: patch, detect, re-measure

Hardening decays. New devices arrive with defaults, exceptions pile up, and settings drift after troubleshooting. Build these tasks into regular operations:

• Review update policies, deadlines and restart behaviour every quarter — compliance slips when deadlines are soft, Windows Update for Business policies
• Use hotpatching and cluster-aware updating for servers that cannot reboot often — lets critical servers patch on time, Hotpatch and patching Windows Server
• Detect and correct configuration drift automatically — settings that are not enforced do not stay set, Detecting and correcting configuration drift
• Re-run the baseline comparison after every major Windows release — new releases add settings and change defaults, Security baselines: CIS and Microsoft
• Review key security event trends monthly — rising NTLM use or failed logons show where controls are slipping, Windows security event IDs that matter

Review exclusions (Defender, ASR, App Control, firewall) on the same schedule. Each exception should have an owner and an expiry date.

How to use this checklist

Treat the phases as an order of priority, not a strict calendar. If you already have LAPS and BitLocker everywhere, skip ahead; if you run an older estate, the first phase may take longer. What matters is that the cheap, high-impact controls come before the expensive ones, and that credential protection comes before the complex structural work.

For every item, follow the same pattern: read the linked guide, test on a pilot group, enable audit mode where available, review the results, then enforce and verify. Record the verification, such as an event ID, a compliance report or a PowerShell query, next to the item so it can be re-checked later.

Finally, share the measurement with the people who approve the work. A table showing the baseline score and key numbers at day 0, 30, 60 and 90 is more persuasive than any list of settings.

Related reading: Accounts and privileged access, Credential protection, Attack surface reduction, Microsoft Defender, Application control, Legacy protocols, Windows Firewall, BitLocker and boot security, PowerShell security, Audit and logging, Patching and updates and Security baselines.