windows server
Windows Server Hardening Guide
"Essential hardening steps for securing Windows Server roles and services."
PopDocs Intel
May 22, 2024
1 MIN
Windows Server Hardening Guide
Securing a Windows Server instance requires a defense-in-depth approach, starting from the OS and extending to the network and role-specific configurations.
1. Attack Surface Reduction (ASR)
- Minimal Roles: Only install the necessary server roles and features. Use "Server Core" whenever possible.
- Disable Legacy Protocols: Disable SMBv1, LLMNR, NetBIOS, and NTLMv1.
- Remove Unused Services: Audit services and disable any not required for the server's function.
2. Access Control
- PAWs: Use Privileged Access Workstations for server management.
- JEA/JIT: Implement Just-Enough-Administration and Just-In-Time access.
- Least Privilege: Avoid using Domain Admin accounts for routine server maintenance.
3. Patching & Updates
- Automated Patching: Use WSUS or Azure Update Manager to ensure critical security patches are applied within 48 hours.
- Driver Management: Audit and restrict third-party drivers to prevent kernel-level exploits.
4. Monitoring & Logging
- Sysmon: Deploy Microsoft Sysmon for deep visibility into process creations, network connections, and file changes.
- Centralized Logs: Forward Event Logs to a SIEM (e.g., Splunk, Microsoft Sentinel).