Windows Hardening — Blog https://www.windowshardening.org/en/blog Latest from Blog en Thu, 22 Oct 2026 03:43:07 GMT App Control managed installer, ISG and supplemental policies https://www.windowshardening.org/en/blog/app-control-managed-installer https://www.windowshardening.org/en/blog/app-control-managed-installer Keep App Control for Business maintainable: trust Intune or ConfigMgr as a managed installer, use ISG carefully and delegate with supplemental policies. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT AppLocker rollout: scripts, installers and packaged apps https://www.windowshardening.org/en/blog/applocker-rollout https://www.windowshardening.org/en/blog/applocker-rollout Roll out AppLocker safely: Application Identity service, audit mode, publisher rules for EXE, script, MSI and packaged apps, and writable-folder gaps. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT BitLocker recovery keys: escrow, rotation and auditing https://www.windowshardening.org/en/blog/bitlocker-recovery-keys https://www.windowshardening.org/en/blog/bitlocker-recovery-keys Manage BitLocker recovery keys properly: escrow to AD DS or Entra ID, prove coverage, restrict who can read keys, audit every access and rotate keys after use. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Cached logons, WDigest and credential exposure settings https://www.windowshardening.org/en/blog/cached-logons-wdigest https://www.windowshardening.org/en/blog/cached-logons-wdigest Cut the credentials Windows keeps on disk and in memory: cached logon count, WDigest, cleanup after logoff, stored network passwords and Credential Manager. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Configuration drift: OSConfig, DSC and compliance reports https://www.windowshardening.org/en/blog/configuration-drift-osconfig https://www.windowshardening.org/en/blog/configuration-drift-osconfig Detect and correct Windows configuration drift: OSConfig on Server 2025, PowerShell DSC auto-correct, Group Policy reprocessing, change events and reports. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Controlled folder access: ransomware protection that works https://www.windowshardening.org/en/blog/controlled-folder-access https://www.windowshardening.org/en/blog/controlled-folder-access Roll out Defender controlled folder access against ransomware: audit mode, events 1123 and 1124, allowing apps, adding protected folders and enforcing by ring. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Audit and minimise Microsoft Defender exclusions https://www.windowshardening.org/en/blog/defender-exclusions-audit https://www.windowshardening.org/en/blog/defender-exclusions-audit Find every Microsoft Defender exclusion across GPO, Intune and local config, justify or remove it, narrow the rest, hide them from admins and monitor changes. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Detecting malicious PowerShell with script block logging https://www.windowshardening.org/en/blog/detect-malicious-powershell https://www.windowshardening.org/en/blog/detect-malicious-powershell Turn PowerShell logs into detections: rebuild 4104 script blocks, use AMSI and engine events, spot obfuscation and unmanaged PowerShell, tune out admin noise. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Harden Microsoft Edge with Group Policy and Intune https://www.windowshardening.org/en/blog/edge-browser-hardening https://www.windowshardening.org/en/blog/edge-browser-hardening Harden Microsoft Edge by policy: enforced SmartScreen, an extension allowlist, enhanced security mode, download restrictions and fast forced updates. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT EDR in block mode, passive mode and third-party AV https://www.windowshardening.org/en/blog/edr-block-mode-passive-mode https://www.windowshardening.org/en/blog/edr-block-mode-passive-mode How Defender Antivirus behaves next to another antivirus: active, passive and EDR in block mode, forcing passive mode on servers, what you lose, how to verify. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Exploit protection: system and per-app mitigations https://www.windowshardening.org/en/blog/exploit-protection https://www.windowshardening.org/en/blog/exploit-protection Configure Windows exploit protection, the EMET successor: system defaults, per-app mitigations, audit mode, XML export/import and GPO or Intune deployment. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Windows Firewall logging and monitoring that works https://www.windowshardening.org/en/blog/firewall-logging-monitoring https://www.windowshardening.org/en/blog/firewall-logging-monitoring Turn Windows Firewall into a detection source: configure pfirewall.log, WFP audit events 5156/5157, rule-change events 4946-4950 and forward them centrally. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Managing Windows Firewall at scale with GPO and Intune https://www.windowshardening.org/en/blog/firewall-policy-at-scale https://www.windowshardening.org/en/blog/firewall-policy-at-scale Run Windows Firewall policy across a fleet: how GPO and Intune rules merge, why block beats allow, disabling local merge and checking the active store. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Hotpatch and cluster-aware updating for Windows Server https://www.windowshardening.org/en/blog/hotpatch-servers https://www.windowshardening.org/en/blog/hotpatch-servers Patch Windows Server with less downtime: hotpatch on Server 2025 with Azure Arc or Azure Edition, baseline months, prerequisites and cluster-aware updating. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Intune security baselines, settings catalog, GPO conflicts https://www.windowshardening.org/en/blog/intune-security-baselines https://www.windowshardening.org/en/blog/intune-security-baselines Deploy Intune security baselines without conflicts: baseline versions, settings catalog layering, endpoint security overlap, MDMWinsOverGP and on-device checks. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Domain and server isolation with IPsec https://www.windowshardening.org/en/blog/ipsec-domain-isolation https://www.windowshardening.org/en/blog/ipsec-domain-isolation Use IPsec connection security rules so only authenticated domain computers reach your servers: domain and server isolation, crypto choices, safe rollout. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Just Enough Administration (JEA) step by step https://www.windowshardening.org/en/blog/jea-just-enough-administration https://www.windowshardening.org/en/blog/jea-just-enough-administration Build JEA endpoints that give operators exactly the commands they need: role capability files, session configurations, virtual accounts, gMSAs and auditing. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Harden Microsoft Office: macros, OLE and add-ins https://www.windowshardening.org/en/blog/office-macro-hardening https://www.windowshardening.org/en/blog/office-macro-hardening Lock down Microsoft 365 Apps: block internet macros, disable XLM, scan VBA with AMSI, keep Protected View on, require signed add-ins, stop OLE and DDE. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Policy Analyzer and LGPO: compare, test, apply baselines https://www.windowshardening.org/en/blog/policy-analyzer-lgpo https://www.windowshardening.org/en/blog/policy-analyzer-lgpo Use Policy Analyzer to diff GPOs, baselines and effective policy, and LGPO.exe to test, apply and export local policy on standalone machines and lab builds. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT Print Spooler and Point and Print hardening https://www.windowshardening.org/en/blog/print-spooler-point-and-print https://www.windowshardening.org/en/blog/print-spooler-point-and-print Close PrintNightmare-style risks: disable the Print Spooler where unused, restrict driver installs to admins, use Package Point and Print with approved servers. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT