Windows Server security guide: Hardening and best practices —

Windows Server hardening checklist, at a glance:

1. Establish a hardened baseline (CIS Controls v8 or Microsoft security baseline) and patch on a schedule.
2. Remove or disable unused roles, features, and services.
3. Enforce least privilege, remove standing local admin rights, and set a strong account and password policy.
4. Segment networks, configure firewalls defensively, and restrict remote access with MFA.
5. Encrypt data at rest and in transit.
6. Turn on audit logging for logons, privilege use, and configuration changes.
7. Monitor continuously for configuration drift.
8. Revisit the checklist after every major change.

What is Windows Server security hardening?

Windows Server security hardening is the process of configuring a Windows Server system to reduce its attack surface. That means disabling unused features, tightening default settings, enforcing least privilege, and applying secure configuration baselines aligned to recognized standards.

Hardening is distinct from patching: patches close specific known vulnerabilities, while hardening reduces the exploitable surface that patches would otherwise need to defend.

A hardened Windows Server is one where only the services, ports, users, and permissions required by its role remain enabled. Everything else (legacy protocols, default shares, anonymous access, unused roles) is removed or restricted.

Windows Server security best practices

The practices below group into six categories that together cover the full Windows Server attack surface. Apply them sequentially when standing up new servers; apply them continuously against existing ones.

1. Start with a hardened baseline

Baseline hardening begins before the operating system is installed and extends through initial configuration. Treat every new server as a project (or as code if you think Intune), not a deployment.

Server preparation

• Establish and maintain a detailed inventory of all servers, including baseline configuration and make sure to detect every subsequent change (drift).
• Provide just-enough network and internet connectivity to new servers until they are fully hardened.
• Make sure UEFI Secure Boot is used to protect firmware to prevent unauthorized changes to boot-level settings.
• Secure WinRE and require Bitlocker recovery keys
• Configure the device boot order to prevent booting from alternate media such as USB or optical drives.
• Control and verify virtualized setups of servers.

Patching and updates

A hardened configuration is only as strong as the patch level beneath it. Apply updates early, apply them centrally, and test before deployment.

• After installing Windows Server, immediately apply the latest patches through Windows Autopatch or Microsoft Intune for modern deployments, or through Microsoft Endpoint Configuration Manager (formerly SCCM) where legacy infrastructure requires it. Use continuous monitoring to verify patch state across the fleet.
• Use centralized patch orchestration, and tools like SCCm only when if legacy requires it.
• Before deploying any patch, hotfix, or service pack to production, test it thoroughly in a staging environment.

Role, feature, and service reduction

Every role, feature, application, and service running on a server adds code an attacker can probe. Strip the server down to what it actually needs to do its job.

• Remove Windows Server roles and features outside the server’s intended purpose.
• Remove unused applications, services, and protocols.
• Avoid browsers on servers, or block by policy, and limit internet access for all users.
• Use Bitlocker to protect the Windows swap file, and use RAM-only workloads should the server have sufficient RAM.

System configuration

Several default Windows behaviors assume a friendlier environment than a production server actually runs in. These settings close low-level gaps that attackers reliably exploit.

• Protect the registry from anonymous access, and disable Remote Registry if it is not required.
• Disable NullSessionPipes and NullSessionShares to limit anonymous access to network resources.
• Grant only authorized users and administrators the ability to modify critical registry keys.
• Require Ctrl+Alt+Del for interactive logins and configure an inactivity timeout to end idle sessions automatically, but make sure to monitor these changes to detect malicious drift.
• Display a legal notice before user login, such as: “Unauthorized use of this computer and network resources is prohibited.”
• Disable removable media such as USB drives to reduce data exfiltration and malware injection risk using policies.

2. Lock down user accounts and access

Access management determines who can reach which resources and what they can do once they arrive. This category closes the identity-based paths attackers use to move laterally once inside.

User account security

Default user accounts and predefined groups carry permissions that are almost always too permissive for production. Tighten these before any other access work.

• Disable the guest account on every server.
• Disablethe local Administrator account where possible, use LAPS, orcreate a new, named account with just-in-time privileges.
• Audit the membership of predefined groups such as Administrators, Backup Operators, and Everyone, and remove accounts that don’t belong. Do not modify the permissions of built-in service accounts such as Local System and Network Service, as changes to these can break core Windows functionality.
• Change the default that grants Everyone the “Access this computer from the network” right. That one default exposes shared folders to every authenticated and anonymous user.
• Ensure system and administrator account passwords are at least 15 characters, combining letters, numbers, and special characters. Enforce MFA on all privileged accounts. Do not mandate periodic rotation unless there is evidence of compromise, per NIST SP 800-63B guidance.
• Ensure system and administrator account passwords are at least 15 characters, combining letters, numbers, and special characters. Enforce MFA on all privileged accounts. Do not mandate periodic rotation unless there is evidence of compromise, per NIST SP 800-63B guidance.
• Configure an account lockout policy in Group Policy to throttle brute-force attempts.
• Disable anonymous SID/Name translation.
• Disable or delete unused user accounts promptly.
• Use tiered administrative accounts (Tier 0 for domain and forest admin, Tier 1 for server admin, Tier 2 for workstation admin) and access those accounts through a Privileged Access Workstation. Never use domain admin accounts for routine server maintenance.

Access management

With accounts cleaned up, the next question is what those accounts can actually do. Access management controls answer that question, and they are where least privilege and authentication hygiene live.

• Enforce the principle of least privilege by granting users and processes only the minimum rights required. Be especially conservative with permissions granted to the Everyone group.
• Allow only authenticated users to access any computer from the network.
• Configure the encryption types allowed for Kerberos authentication, disabling weaker legacy options.
• Avoid storing LAN Manager hash values.
• Disable file and printer sharing if it is not required.
• Disable NTLMv1 unless a legacy technology requires it.

Remote access

Remote Desktop Protocol is convenient for administrators and equally convenient for attackers. Treat it as a last-resort interface and wrap it in strong authentication when it is used at all.

• Enable Remote Desktop Protocol (RDP) only when necessary. Attackers commonly exploit RDP as an initial-access vector.
• Where RDP is required, set the connection encryption level to high.
• Grant remote access only to specific users who need it.
• Require multi-factor authentication (MFA) to add a second factor beyond the password.

Netwrix Change Tracker: CIS-Certified Configuration Hardening. Launch a demo in your browser.

3. Configure network and firewall defensively

Network architecture determines how exposed a hardened server actually is. A well-hardened server behind an over-permissive firewall still gets attacked.

Network configuration

Network-level controls decide who can even attempt to talk to the server. Segment aggressively, and close the legacy name-resolution protocols that still create unnecessary exposure.

• Isolate servers by using approaches like Zero-Trust network segmentation, micro-segmentation or identity-based segementation. .
• Verify DNS and hostname configurations to prevent DNS-based manipulation, employ DNSSEC or DNS over TLS/HTTPS..
• Implement IP restrictions and filtering rules to control which addresses or ranges can communicate with each server.
• Where remote administration is required, restrict RDP access to specific IP addresses or networks and use PAWs (privileged access workstations) for the task.
• Disable NetBIOS over TCP/IP and LMHosts lookup unless a legacy application requires them.

Firewall configuration

Windows Firewall is the server’s last line of defense against unsolicited traffic that makes it past network-level controls. Default-deny is the posture that keeps it useful.

• Enable Windows Firewall on every server.
• Configure each firewall profile (Domain, Private, and Public) to block inbound traffic by default. When inbound access is required, limit it to essential protocols, ports, and IP ranges. Consider outbound filtering as well.
• Open only the network ports actually in use for the time they are in use, and deny access to all others.

Network Time Protocol (NTP)

Accurate time is a security control. Kerberos authentication enforces tight clock skew tolerances, and log correlation during incident investigation depends on synchronized timestamps across every server and workstation.

• Designate a primary time server synchronized with a reliable atomic clock source.
• Require all servers and workstations to synchronize exclusively with that server In virutalized environments, the NTP source should not be .virtualized.

4. Encrypt data at rest and in transit

Encryption converts a successful system-level compromise into a much narrower outcome, because the data itself remains protected.

• Enable and configure BitLocker disk encryption on the system disk and any disks containing sensitive data.
• Where granular file-level protection is required beyond disk encryption, use Microsoft Purview Information Protection to apply sensitivity labels and rights management policies that travel with the file.
• Implement IPsec to encrypt network traffic between servers, protecting data in transit across the network.

5. Enforce audit policy and monitor for drift

Hardening without monitoring decays. Audit policy provides the raw visibility; drift detection provides the discipline to keep baselines intact.

Audit policy configuration

Audit policy determines what the server records about its own activity. Without a deliberate policy, the events you need during an investigation will not be there.

• Configure an audit policy that captures authentication events, privileged account use, account management, policy changes, and object access on sensitive resources. Native logs viewed through Windows Event Viewer provide a starting point.
• Set the event log retention method to overwrite as needed, and reserve adequate log storage (4 GB or more per server).
• Ship security logs to a security information and event management (SIEM) platform to enable correlation across servers and retention beyond local log rotation.

Continuous monitoring

Logs tell you what happened; continuous monitoring tells you what is happening right now and whether it is authorized. This is where drift detection turns hardening from a project into a practice.

• Deploy file integrity monitoring (FIM) to detect unauthorized changes to the filesystem, registry, services, and local accounts in real time.
• Correlate configuration changes with authorized change-management tickets to separate legitimate administrator activity from suspicious changes.
• For comprehensive visibility, implement an enterprise auditing solution that offers user behavior analytics (UEBA), real-time alerting, and automated incident response. These capabilities go beyond what native logs can provide.

6. Maintain hardening over time

Hardening is not a project with an end date. Several practices keep baselines intact as administrators, software, and adversaries make changes.

• Run regular IT risk assessments and feed the results into your risk management plan.
• Deploy an endpoint security solution across servers and workstations. Windows Server includes Windows Defender by default; third-party options extend detection and response coverage.
• Install a data loss prevention (DLP) solution to protect sensitive information from inappropriate access or exfiltration.
• Keep every server at the same revision level to simplify configuration management and patch testing.
• Review hardened baselines against current CIS or STIG versions at least annually, and update standards when Microsoft releases major Windows Server versions.