Sitemap
All pages on Windows Hardening.
Home
Hardening map
Guides
- App Control managed installer, ISG and supplemental policies
- AppLocker rollout: scripts, installers and packaged apps
- BitLocker recovery keys: escrow, rotation and auditing
- Cached logons, WDigest and credential exposure settings
- Configuration drift: OSConfig, DSC and compliance reports
- Controlled folder access: ransomware protection that works
- Audit and minimise Microsoft Defender exclusions
- Detecting malicious PowerShell with script block logging
- Harden Microsoft Edge with Group Policy and Intune
- EDR in block mode, passive mode and third-party AV
- Exploit protection: system and per-app mitigations
- Windows Firewall logging and monitoring that works
- Managing Windows Firewall at scale with GPO and Intune
- Hotpatch and cluster-aware updating for Windows Server
- Intune security baselines, settings catalog, GPO conflicts
- Domain and server isolation with IPsec
- Just Enough Administration (JEA) step by step
- Harden Microsoft Office: macros, OLE and add-ins
- Policy Analyzer and LGPO: compare, test, apply baselines
- Print Spooler and Point and Print hardening
- RDP without exposing credentials: RCG and Restricted Admin
- Hardening Remote Desktop (RDP) on Windows
- Remove local admin rights from users without chaos
- Secure Boot, UEFI and the BlackLotus mitigations
- Deploying and tuning Sysmon at scale
- Patching third-party apps on Windows with winget
- TLS and Schannel hardening on Windows
- UAC hardening and Windows Administrator protection
- VBS, memory integrity (HVCI) and Kernel DMA Protection
- Microsoft vulnerable driver blocklist: stop BYOVD
- Windows Event Forwarding at scale
- Windows hardening checklist: a 30/60/90-day plan
- Windows Hello for Business: trust models and PIN policy
- Windows security event IDs that matter
- Windows Update policies: deferrals, deadlines and restarts
- Hardening WinRM and PowerShell remoting
- Windows security baselines: Microsoft SCT, CIS and STIG
- Windows patching: update rings, deadlines, KEV first
- Windows audit policy and Sysmon: a logging baseline
- PowerShell security: logging, v2 removal, CLM and JEA
- BitLocker hardening: XTS-AES 256, TPM+PIN, key escrow
- Windows Firewall hardening against lateral movement
- Retire LLMNR, NBT-NS, SMBv1 and NTLMv1; require signing
- App Control for Business (WDAC) vs AppLocker
- Harden Microsoft Defender Antivirus beyond the defaults
- Attack surface reduction rules: GUIDs and safe rollout
- Credential Guard and LSA protection: protect LSASS
- Admin tiering and Protected Users for Active Directory
- Deploy Windows LAPS: unique local admin passwords
Glossary
- AMSI (Antimalware Scan Interface)
- Controlled folder access
- Exploit protection
- Memory integrity (HVCI)
- Just Enough Administration (JEA)
- Kernel DMA Protection
- Point and Print
- Remote Credential Guard
- Secure Boot
- Microsoft Defender SmartScreen
- Tamper protection
- Trusted Platform Module (TPM)
- Vulnerable driver blocklist
- WDigest
- Windows Event Forwarding (WEF)
- Windows Hello for Business
- Sysmon
- Constrained Language Mode
- LLMNR and NBT-NS poisoning
- NTLM relay
- SMB signing
- App Control for Business (WDAC)
- AppLocker
- Attack surface reduction (ASR) rules
- Credential Guard
- LSA protection (RunAsPPL)
- Protected Users group
- Active Directory tier model
- Windows LAPS