Skip to content
WindowsHardening

Area 06 / 12

Legacy Protocols

Windows still speaks protocols designed for trusted 1990s LANs. Broadcast name resolution hands hashes to anyone on the segment, unsigned SMB and LDAP enable relay attacks, and NTLMv1 can be cracked quickly. This area shows how to measure each one, switch it off or require signing, and avoid outages along the way.

Start the path

Learning path

0/4 done
  1. 01Retire LLMNR, NBT-NS, SMBv1 and NTLMv1; require signingMeasure and switch off the Windows protocols behind hash capture and relay attacks: LLMNR, NBT-NS, mDNS, WPAD, SMBv1, NTLMv1, plus SMB signing and LDAP signing with channel binding.
  2. 02TLS and Schannel hardening on WindowsDisable SSL, TLS 1.0/1.1 and weak ciphers in Schannel, set the cipher suite order by GPO and make .NET use strong crypto after measuring old TLS use.
  3. 03Hardening Remote Desktop (RDP) on WindowsSecure Remote Desktop with NLA, the TLS security layer, PKI certificates, restricted users, firewall scoping, session limits and the right logs.
  4. 04Print Spooler and Point and Print hardeningClose PrintNightmare-style risks: disable the Print Spooler where unused, restrict driver installs to admins, use Package Point and Print with approved servers.