Windows Server Hardening

Windows Server is a high-value target for adversaries: it hosts shared services, stores sensitive data, and often operates with elevated network trust. Hardening reduces the exposure window and limits blast radius when an endpoint or user account is compromised. This guide covers the CIS Benchmarks for Windows Server 2019/2022, Microsoft Security Baselines, and DISA STIGs.

Scope: Applies to member servers, domain controllers, and standalone installations. Domain controller-specific controls are called out where they differ.

1. Minimal Installation — Reduce Attack Surface From Day One

The single most effective hardening action is installing only what you need.

Windows Server Core

Prefer Server Core (no GUI) where the workload supports it. Removing the graphical shell eliminates:

• Internet Explorer / Edge (browser attack surface)
• Windows Explorer shell (LOLBin execution paths)
• Many desktop-class components with historically high vulnerability density

Server Core is manageable via PowerShell remoting, Windows Admin Center, and RSAT from an admin workstation. Most server roles (AD DS, DNS, DHCP, File Services, Hyper-V, IIS) run on Core.

Remove Unused Roles and Features

After installation, audit installed roles and features and remove anything not required:

# List installed features
Get-WindowsFeature | Where-Object { $_.InstallState -eq 'Installed' } | Select Name, DisplayName

# Remove a feature (example: Telnet client)
Remove-WindowsFeature Telnet-Client

# Remove multiple features
Remove-WindowsFeature Web-DAV-Publishing, TFTP-Client, SMB1Protocol

Always disable/remove:

2. Account Hardening

Rename and Disable Built-in Accounts

# Rename local administrator
Rename-LocalUser -Name "Administrator" -NewName "svc_localadmin"

# Disable Guest
Disable-LocalUser -Name "Guest"

# Verify no unexpected enabled local accounts
Get-LocalUser | Where-Object { $_.Enabled -eq $true } | Select Name, LastLogon

Local Administrator Password Solution (LAPS)

Deploy LAPS to every server — identical local admin passwords across servers allow lateral movement with a single credential theft.

• Rotate every 30 days
• Store recovery passwords in Active Directory with access-controlled read permissions
• Audit all LAPS password reads in AD

Service Accounts

• Use Group Managed Service Accounts (gMSA) for services that support it — passwords managed automatically by AD, no human-readable password
• For services requiring standard accounts: use dedicated, least-privilege service accounts — never reuse credentials across services
• Do not use Domain Admin or built-in accounts as service accounts
• Enable Protected Users group for privileged accounts

Password Policy (Local / Fine-Grained)

For domain environments, use Fine-Grained Password Policies (PSOs) to enforce stricter requirements for privileged accounts.

3. Network Protocol Hardening

Disable SMBv1

SMBv1 is the protocol exploited by EternalBlue (MS17-010), which enabled WannaCry and NotPetya. It must be disabled on all servers regardless of patch status.

# Remove SMBv1 (Server 2016+)
Remove-WindowsFeature FS-SMB1

# Disable via registry (belt-and-suspenders)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" `
  -Name "SMB1" -Value 0 -Type DWord

# Verify
Get-SmbServerConfiguration | Select EnableSMB1Protocol

SMBv2/v3 Hardening

# Require SMB signing (prevent relay attacks)
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force
Set-SmbClientConfiguration -RequireSecuritySignature $true -Force

# Enable SMB encryption (SMBv3, for sensitive data)
Set-SmbServerConfiguration -EncryptData $true -Force

# Disable SMB compression if not required (CVE-2020-0796 / SMBGhost attack vector)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" `
  -Name "DisableCompression" -Value 1 -Type DWord

Remote Desktop Protocol (RDP)

If RDP is required, harden it:

# Require NLA
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" `
  -Name "UserAuthentication" -Value 1

# Set encryption level to High
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" `
  -Name "MinEncryptionLevel" -Value 3

Restrict RDP access by Group Policy:

Computer Configuration → Windows Settings → Security Settings →
  Local Policies → User Rights Assignment →
  Allow log on through Remote Desktop Services: [specific group only]

Disable LLMNR and NetBIOS

Both are exploited by tools like Responder to capture NTLMv2 hashes via poisoning attacks.

# Disable LLMNR via GPO:
Computer Configuration → Administrative Templates →
  Network → DNS Client → Turn off multicast name resolution: Enabled

# Disable NetBIOS via DHCP scope option or per-adapter registry:
HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\{GUID}\NetbiosOptions = 2

4. Windows Firewall

Enable and configure the Windows Firewall on all profiles (Domain, Private, Public) even for servers behind a perimeter firewall — defence in depth.

# Enable all profiles
Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True

# Set default policy: block all inbound, allow established outbound
Set-NetFirewallProfile -DefaultInboundAction Block -DefaultOutboundAction Allow

# Verify
Get-NetFirewallProfile | Select Name, Enabled, DefaultInboundAction, DefaultOutboundAction

Only open ports for services explicitly running on the server. Common server roles:

Log all dropped packets:

Set-NetFirewallProfile -LogFileName "%systemroot%\system32\LogFiles\Firewall\pfirewall.log" `
  -LogMaxSizeKilobytes 32767 -LogBlocked True -LogAllowed False

5. Privileged Access and UAC

User Account Control (UAC)

UAC should be enabled and set to prompt for credentials (not consent) even on servers.

Restrict Interactive Logon

Computer Configuration → Windows Settings → Security Settings →
  Local Policies → User Rights Assignment

Tiered Administration Model

Align with Microsoft's Enterprise Access Model (formerly tier model):

• Tier 0: Domain Controllers, PKI, ADFS — access only from Tier 0 PAWs
• Tier 1: Member servers — access only from Tier 1 PAWs
• Tier 2: Workstations — standard admin workstations

Never use Tier 0 credentials on Tier 1 or Tier 2 systems.

6. Credential Protection

Credential Guard / Protected Users

Enable Credential Guard on Hyper-V capable servers to isolate LSASS from process injection:

Computer Configuration → Administrative Templates →
  System → Device Guard → Turn On Virtualization Based Security
  Credential Guard: Enabled with UEFI lock

Enrol all privileged accounts in the Protected Users security group:
- Prevents NTLM authentication (Kerberos only)
- Prevents credential delegation
- Enforces 4-hour TGT lifetime

Restrict WDigest and Credential Caching

# Disable WDigest (cleartext passwords in memory)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" `
  -Name "UseLogonCredential" -Value 0

# Limit cached domain credentials (set to 0 on servers; they should have DC connectivity)
# Via GPO: Computer Configuration → Windows Settings → Security Settings →
#   Local Policies → Security Options →
#   Interactive logon: Number of previous logons to cache = 0

7. Patch Management

Unpatched servers are the leading cause of ransomware and data breach incidents.

• Use WSUS, SCCM, or Intune for managed deployment
• Stage patches: DEV → TEST → PROD with a defined rollout window
• Track compliance with a dashboard — target 95% within SLA
• Patch third-party software (redistributables, .NET, VCRedist) on the same cadence
• Subscribe to MSRC Security Update Guide notifications

8. Audit Policy and Event Logging

Enable comprehensive audit policy via Group Policy under:
Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration

PowerShell Logging

Computer Configuration → Administrative Templates → Windows Components → Windows PowerShell
- Script Block Logging: Enabled
- Module Logging: Enabled
- Transcription: Enabled (to central share)

Event Log Sizing

# Increase Security log size (default 20MB is insufficient)
wevtutil sl Security /ms:1073741824  # 1 GB

# Also expand Application and System
wevtutil sl Application /ms:104857600  # 100 MB
wevtutil sl System /ms:104857600

Forward Logs to SIEM

Configure Windows Event Forwarding (WEF) or the SIEM agent to ship events in real time. Minimum retention: 90-day hot, 1-year cold.

Critical events to alert on:

9. Encryption at Rest

• OS drive: BitLocker with TPM 2.0; store recovery keys in AD
• Data drives: BitLocker or application-level encryption for sensitive data
• Backups: Encrypt backup media and verify encryption before offsite transport
• Database files: Enable TDE for SQL Server; use column-level encryption for PII/secrets

# Enable BitLocker on OS drive with TPM
Enable-BitLocker -MountPoint "C:" -TpmProtector

# Add recovery key and back up to AD
Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector
Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId (Get-BitLockerVolume C:).KeyProtector[1].KeyProtectorId

10. Domain Controller Specific Controls

If the server is a domain controller, apply additional restrictions:

Protect the SYSVOL and NTDS.DIT

• Restrict SYSVOL access — it should not be writable by standard users
• Enable file auditing on %SYSTEMROOT%\SYSVOL and %SYSTEMROOT%\ntds
• Protect ntds.dit with BitLocker and tight NTFS permissions

Tier 0 Access Restrictions

# Via GPO on Domain Controllers OU:
Deny log on locally: All accounts except designated Tier 0 admin accounts
Allow log on locally: Domain Controllers OU Admin group only
Deny access to this computer from the network: Everyone (use explicit allow instead)

AdminSDHolder and ACL Hygiene

Review AdminSDHolder permissions annually. Any unexpected users with GenericAll, WriteDacl, or WriteOwner permissions on AdminSDHolder can gain domain admin equivalent rights.

# List effective permissions on AdminSDHolder
$AdminSDHolder = [ADSI]"LDAP://CN=AdminSDHolder,CN=System,DC=domain,DC=local"
$AdminSDHolder.ObjectSecurity.Access | Select IdentityReference, ActiveDirectoryRights

Protect KRBTGT

• Reset the krbtgt account password twice (replication latency) immediately after any suspected domain compromise
• Schedule annual krbtgt password rotation as a preventive measure (use Microsoft's KRBTGT Reset Script)

Hardening Checklist

References

• CIS Benchmark for Windows Server 2022
• Microsoft Security Baselines (Windows Server)
• DISA STIG for Windows Server 2022
• NIST SP 800-171 Rev 2
• Microsoft LAPS
• Microsoft Enterprise Access Model