Skip to content
WindowsHardening

Area 01 / 12

Accounts & Privileged Access

Almost every Windows intrusion becomes a domain compromise through reused or over-exposed admin credentials. This area removes shared local administrator passwords with Windows LAPS, separates administration into tiers so Domain Admin credentials never touch a workstation, and uses Protected Users and logon restrictions to keep privileged accounts where they belong.

Start the path

Learning path

0/4 done
  1. 01Deploy Windows LAPS: unique local admin passwordsReplace shared local Administrator passwords with Windows LAPS: schema, permissions, Group Policy settings, encryption, retrieval and the checks that prove it works.
  2. 02Admin tiering and Protected Users for Active DirectoryApply the Active Directory tier model in practice: what belongs in Tier 0, logon restrictions by GPO, Protected Users, PAWs and the checks that show it is working.
  3. 03Remove local admin rights from users without chaosTake local admin rights away from users: inventory who has them, enforce membership with GPO or Intune, handle elevation with EPM, keep a break-glass path.
  4. 04UAC hardening and Windows Administrator protectionConfigure UAC properly: Admin Approval Mode, secure desktop, FilterAdministratorToken, remote UAC for local accounts, and Windows 11 Administrator protection.