Windows Workstation Hardening

Hardening Windows workstations reduces the attack surface available to adversaries who gain or attempt to gain access to your environment. This guide applies a layered defence strategy aligned with CIS Benchmarks Level 1 & 2, NIST SP 800-171, and Microsoft Security Baselines for Windows 11.

Principle: No single control is sufficient. Layer prevention, detection, and response controls to contain the impact of any individual failure.

1. Full-Disk Encryption (BitLocker)

Every workstation must have BitLocker enabled. If a device is lost or stolen, encryption is the last line of defence protecting your data.

Configuration

• Algorithm: AES-256 (not the default AES-128 on some configurations)
• Protector: TPM 2.0 + PIN — TPM-only is insufficient for high-security environments
• Recovery keys: Stored in Active Directory / Entra ID only — never on the same device
• Suspension: Require admin approval; alert on any BitLocker suspension event

Group Policy Path

Computer Configuration → Administrative Templates →
  Windows Components → BitLocker Drive Encryption → Operating System Drives

Key settings:

• Require additional authentication at startup: Enabled (require PIN with TPM)
• Choose drive encryption method and cipher strength: AES-256
• Store BitLocker recovery information in AD DS: Enabled, require backup before BitLocker is enabled

2. Credential Protection

Credential theft is the primary lateral movement vector in modern attacks. These controls directly counter tools like Mimikatz and DCSync.

Local Administrator Password Solution (LAPS)

Without LAPS, a single compromised local admin password gives attackers admin access to every workstation. With LAPS, each machine has a unique, automatically rotated password.

• Deploy Microsoft LAPS (built into Windows Server 2022 and Windows 11 22H2+)
• Set rotation to every 30 days
• Restrict read access to LAPS passwords via AD delegation
• Audit all LAPS password reads

Windows Credential Guard

Isolates NTLM hashes and Kerberos tickets in a virtualization-based secure (VBS) enclave. Even a SYSTEM-level process cannot read credentials from LSASS.

Requirements: TPM 2.0, UEFI Secure Boot, 64-bit CPU with virtualization extensions

Computer Configuration → Administrative Templates →
  System → Device Guard → Turn On Virtualization Based Security

Set Credential Guard Configuration to Enabled with UEFI lock (prevents easy disabling via registry).

Additional Credential Hardening

3. Application Control

Preventing unauthorised code from executing is one of the highest-value controls against malware, ransomware, and commodity attacks.

Microsoft Defender Application Control (WDAC)

WDAC operates at the kernel level and cannot be bypassed by a local admin. It is more robust than AppLocker.

Deployment approach:

1. Audit mode (2–4 weeks) — log all binaries that execute, identify legitimate software inventory
2. Policy refinement — build allow rules for signed Windows components and managed software
3. Enforce mode — block any unsigned or unapproved binary

Baseline block rules (always deny):

• Living-off-the-land binaries: mshta.exe, wscript.exe, cscript.exe, regsvr32.exe
• psexec, psexesvc
• Dual-use offensive tools: Mimikatz, Cobalt Strike artefacts

AppLocker (Legacy Alternative)

If WDAC cannot be deployed, configure AppLocker:

• Executable rules: Allow from %PROGRAMFILES% and %WINDIR% only
• Script rules: Block scripts in user-writable paths
• DLL rules: Enable with care (performance impact)

4. Attack Surface Reduction (ASR) Rules

ASR rules are Defender for Endpoint behavioural controls targeting specific techniques used by malware.

# Enable an ASR rule
Set-MpPreference `
  -AttackSurfaceReductionRules_Ids "d4f940ab-401b-4efc-aadc-ad5f3c50688a" `
  -AttackSurfaceReductionRules_Actions Enabled

5. PowerShell Hardening

PowerShell is the most abused administrative tool in post-exploitation. Comprehensive logging is essential.

Logging Configuration

Constrained Language Mode

Restrict PowerShell capabilities for standard users. Prevents access to .NET types and COM objects commonly used in attacks.

# Applied via WDAC policy or system-wide:
[System.Environment]::SetEnvironmentVariable('__PSLockdownPolicy', '4', 'Machine')

Disable PowerShell v2

PowerShell v2 bypasses all modern logging. Remove it:

Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root

6. Windows Defender / MDE

Critical: Enable Tamper Protection before deploying other Defender controls.

7. User Account Control (UAC)

Best practice: Users should operate as standard users day-to-day. Privileged access should be a separate account used only when needed.

8. Windows Firewall

• Ensure Windows Firewall is enabled on all three profiles (Domain, Private, Public)
• Default posture: block all inbound connections, allow established outbound
• Log all dropped packets and ship to SIEM

# Verify all profiles are active
Get-NetFirewallProfile | Select Name, Enabled, DefaultInboundAction

# Block inbound SMB on Public profile
New-NetFirewallRule `
  -DisplayName "Block SMB Inbound (Public)" `
  -Direction Inbound -Protocol TCP -LocalPort 445 `
  -Action Block -Profile Public

9. Audit Policy and Logging

Enable command-line logging for Process Creation (Event 4688):

Computer Configuration → Administrative Templates →
  System → Audit Process Creation →
  Include command line in process creation events: Enabled

Forward all Security event logs to a SIEM with minimum 90-day hot retention.

10. Patch Management

Hardening Checklist