Windows Server Security Best Practices

4 Nov 2026, 11:2830 min readby ITYantra Admin

Complete guide to securing Windows Server including Active Directory, Group Policy, Windows Defender, firewall, PowerShell remoting, and patch management.

# Windows Server Security Best Practices

Introduction

Windows Server remains a cornerstone of enterprise infrastructure, hosting Active Directory, file services, application servers, and domain controllers. As such, it is a high-value target for attackers seeking domain persistence, credential theft, and lateral movement.

This tutorial provides a comprehensive guide to securing Windows Server 2019 and 2022 environments. The content covers Active Directory hardening, Group Policy security, Windows Defender, firewall configuration, privileged access management, and patch management.

Learning Objectives

By the end of this tutorial, you will be able to:

Harden Active Directory domain controllers against common attacks
Configure Group Policy security baselines for servers and workstations
Deploy and manage Windows Defender Antivirus and Exploit Guard
Configure Windows Firewall with advanced security rules
Implement Just Enough Administration (JEA) and Just-in-Time (JIT) access
Secure PowerShell remoting and execution policies
Manage Windows Server updates and patch compliance

Technical Background

Active Directory Security Model

Active Directory (AD) is the identity and access backbone of most Windows environments. Compromising AD typically means compromising the entire enterprise.

**Key AD Components:**

**Domain Controller (DC):** Server running AD DS, authenticates users and computers
**Organizational Unit (OU):** Container for grouping users, computers, and Group Policy
**Group Policy Object (GPO):** Collection of settings applied to users/computers
**Security Group:** Group used to assign permissions and rights
**Privileged Accounts:** Domain Admins, Enterprise Admins, Administrators, built-in Administrator

**Common AD Attacks:**

| Attack | Description | Mitigation | |--------|-------------|------------| | Kerberoasting | Extract service account TGS tickets, crack offline | Use managed service accounts, strong passwords | | Pass-the-Hash | Use NTLM hash to authenticate without password | Restrict admin credentials, Credential Guard | | Pass-the-Ticket | Use stolen Kerberos tickets | Reduce ticket lifetime, monitor for anomalies | | DCSync | Extract domain credentials via directory replication | Restrict DS-Replication-Get-Changes rights | | Golden Ticket | Forge Kerberos tickets using KRBTGT hash | Rotate KRBTGT account, detect unusual tickets |

Windows Security Features

| Feature | Description | |---------|-------------| | Windows Defender Antivirus | Built-in antivirus and antimalware | | Windows Defender Exploit Guard | Exploit protection, network protection, controlled folder access | | Credential Guard | Protects credentials using virtualization-based security | | Device Guard | Enforces code integrity policies | | Windows Firewall | Stateful host firewall with advanced security | | AppLocker | Application control policy | | Just Enough Administration | Role-based access for PowerShell remoting | | Windows Update for Business | Centralized update management |

Prerequisites

Windows Server 2019 or 2022 (Standard or Datacenter)
Domain Administrator or Enterprise Administrator privileges
Understanding of Active Directory, Group Policy, and PowerShell
RSAT (Remote Server Administration Tools) on management workstation

Hardware and Software Requirements

| Component | Requirement | |-----------|-------------| | OS | Windows Server 2019 or 2022 | | Management | Windows 10/11 with RSAT, or Windows Admin Center | | SIEM | Microsoft Sentinel, Splunk, or Elastic Security | | Vulnerability Scanner | Nessus, Qualys, or Microsoft Defender Vulnerability Management | | PAM | Microsoft Entra ID P2, CyberArk, or HashiCorp Boundary |

Step-by-Step Implementation

Phase 1: Active Directory Hardening

#### 1.1 Protect Built-in Administrator Account

# Rename the built-in Administrator account
Get-ADUser -Filter { SamAccountName -eq "Administrator" } |
  Rename-ADObject -NewName "svc-disabled-admin"

# Disable the built-in Administrator account
Disable-ADAccount -Identity "svc-disabled-admin"

# Create separate administrative accounts
New-ADUser -SamAccountName "jadmin.doe" -Name "John Doe (Admin)" `
  -Enabled $true -PasswordNeverExpires $false `
  -ChangePasswordAtLogon $true -AccountPassword (Read-Host -AsSecureString "Enter password")

#### 1.2 Implement Protected Users Group

Members of the Protected Users group receive additional Kerberos protections:

# Add administrative users to Protected Users
Add-ADGroupMember -Identity "Protected Users" -Members "jadmin.doe", "jadmin.smith"

# Protected Users restrictions:
# - No NTLM authentication
# - No DES/RC4 encryption types
# - No delegation
# - No credential caching (Credential Guard required)

#### 1.3 Configure Admin Tier Model

Separate administrative privileges into tiers:

Tier 0 (Domain Controllers, AD, PKI):
  - Domain Admins, Enterprise Admins, Schema Admins
  - Only log on to Tier 0 assets

Tier 1 (Member Servers, Applications):
  - Server administrators, application admins
  - Manage servers but not domain controllers

Tier 2 (Workstations, End-User Devices):
  - Help desk, local administrators
  - Manage workstations only

Enforce tier isolation using Group Policy and network segmentation.

#### 1.4 Enable Account Policies via GPO

Create GPO "Domain Security Baseline":

Password Policy:
  - Enforce password history: 24 passwords remembered
  - Maximum password age: 60 days
  - Minimum password age: 1 day
  - Minimum password length: 14 characters
  - Password must meet complexity requirements: Enabled
  - Store passwords using reversible encryption: Disabled

Account Lockout Policy:
  - Account lockout duration: 15 minutes
  - Account lockout threshold: 5 invalid attempts
  - Reset account lockout counter after: 15 minutes

Kerberos Policy:
  - Enforce user logon restrictions: Enabled
  - Maximum lifetime for service ticket: 600 minutes
  - Maximum lifetime for user ticket: 10 hours
  - Maximum lifetime for user ticket renewal: 7 days
  - Maximum tolerance for computer clock synchronization: 5 minutes

Apply to the Domain Controllers OU.

Phase 2: Group Policy Security Baselines

#### 2.1 Server Security GPO

Create GPO "Server Security Baseline" applied to member servers:

Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment:
  - Access this computer from the network: Administrators, Authenticated Users
  - Allow log on locally: Administrators
  - Allow log on through Remote Desktop Services: Administrators
  - Back up files and directories: Administrators, Backup Operators
  - Deny access to this computer from the network: Guests, Local account
  - Deny log on as a service: Guests
  - Deny log on locally: Guests
  - Deny log on through Remote Desktop Services: Guests

Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options:
  - Accounts: Administrator account status: Disabled
  - Accounts: Guest account status: Disabled
  - Interactive logon: Do not display last user name: Enabled
  - Interactive logon: Smart card removal behavior: Lock Workstation
  - Network access: Do not allow anonymous enumeration of SAM accounts: Enabled
  - Network access: Do not allow anonymous enumeration of SAM accounts and shares: Enabled
  - Network access: Let Everyone permissions apply to anonymous users: Disabled
  - User Account Control: Run all administrators in Admin Approval Mode: Enabled

#### 2.2 Domain Controller Security GPO

Additional settings for domain controllers:

- Domain controller: Refuse machine account password changes: Disabled
- Domain controller: Allow server operators to schedule tasks: Disabled
- Domain controller: LDAP server signing requirements: Require signing
- Domain member: Digitally encrypt or sign secure channel data (always): Enabled
- Domain member: Digitally encrypt secure channel data (when possible): Enabled

Phase 3: Windows Defender Configuration

#### 3.1 Windows Defender Antivirus

Configure via PowerShell:

# Enable real-time protection
Set-MpPreference -DisableRealtimeMonitoring $false

# Enable cloud-delivered protection
Set-MpPreference -MAPSReporting Advanced

# Enable automatic sample submission
Set-MpPreference -SubmitSamplesConsent SendAllSamples

# Enable behavior monitoring
Set-MpPreference -DisableBehaviorMonitoring $false

# Configure exclusions (only for legitimate performance needs)
Add-MpPreference -ExclusionPath "C:\Program Files\SQL Server\MSSQL\DATA"
Add-MpPreference -ExclusionProcess "sqlservr.exe"

# Schedule quick scan
Set-MpPreference -ScanParameters 1  # Quick scan
Set-MpPreference -RemediationScheduleDay Everyday
Set-MpPreference -RemediationScheduleTime 2

#### 3.2 Windows Defender Exploit Guard

Configure Attack Surface Reduction (ASR) rules:

# Block Office applications from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids D3E037E1-3EB8-44C8-A917-57927947596D -State Enable

# Block credential stealing from Windows local security authority subsystem
Add-MpPreference -AttackSurfaceReductionRules_Ids B2B3F03D-6A65-4F71-A925-1DA77B0C7A4E -State Enable

# Block untrusted and unsigned macros
Add-MpPreference -AttackSurfaceReductionRules_Ids 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC -State Enable

# Block Adobe Reader from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids 7674BA52-37EB-4A4F-A9A1-0D7F5709C651 -State Enable

Enable Controlled Folder Access:

Set-MpPreference -EnableControlledFolderAccess Enabled
Add-MpPreference -ControlledFolderAccessProtectedPaths "C:\Users\*\Documents", "C:\Users\*\Desktop"

Phase 4: Windows Firewall Configuration

#### 4.1 Configure Firewall Rules

# Reset to default profile
netsh advfirewall reset

# Set domain profile to block inbound by default
netsh advfirewall set domainprofile state on
netsh advfirewall set domainprofile firewallpolicy blockinbound,allowoutbound

# Allow required inbound rules
netsh advfirewall firewall add rule name="DNS (TCP)" dir=in action=allow protocol=tcp localport=53 profile=domain
netsh advfirewall firewall add rule name="DNS (UDP)" dir=in action=allow protocol=udp localport=53 profile=domain
netsh advfirewall firewall add rule name="Kerberos" dir=in action=allow protocol=tcp localport=88 profile=domain
netsh advfirewall firewall add rule name="LDAP" dir=in action=allow protocol=tcp localport=389 profile=domain
netsh advfirewall firewall add rule name="LDAPS" dir=in action=allow protocol=tcp localport=636 profile=domain
netsh advfirewall firewall add rule name="Global Catalog" dir=in action=allow protocol=tcp localport=3268 profile=domain
netsh advfirewall firewall add rule name="SMB" dir=in action=allow protocol=tcp localport=445 profile=domain
netsh advfirewall firewall add rule name="RPC Endpoint Mapper" dir=in action=allow protocol=tcp localport=135 profile=domain

# Allow HTTPS
netsh advfirewall firewall add rule name="HTTPS" dir=in action=allow protocol=tcp localport=443 profile=domain

# Enable logging
netsh advfirewall set allprofiles logging enabled true
netsh advfirewall set allprofiles logging maxsizeinmb 4096

Phase 5: PowerShell Security

#### 5.1 Configure Execution Policy

# Set execution policy for all users
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine

# Set for current user
Set-ExecutionPolicy -ExecutionPolicy AllSigned -Scope CurrentUser

# Verify
Get-ExecutionPolicy -List

#### 5.2 Enable Module and Script Block Logging

# Enable via Group Policy or registry
# Registry path: HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging

# Enable transcription
Set-Item -Path WSMan:\localhost\Shell\MaxShellsPerUser -Value 10

Configure via GPO:

Computer Configuration > Policies > Administrative Templates > Windows Components > Windows PowerShell:
  - Turn on Module Logging: Enabled, include * (all modules)
  - Turn on PowerShell Script Block Logging: Enabled
  - Turn on PowerShell Transcription: Enabled, output directory: C:\Logs\PowerShell\

#### 5.3 Just Enough Administration (JEA)

Create a JEA role capability file:

# C:\Program Files\WindowsPowerShell\Modules\HelpDesk\1.0\RoleCapabilities\HelpDesk.psrc
@{
    LanguageMode = "NoLanguage"
    VisibleAliases = @()
    VisibleCmdlets = @(
        'Get-ADUser',
        'Set-ADAccountPassword',
        'Unlock-ADAccount',
        'Get-ADGroupMember'
    )
    VisibleExternalCommands = @()
    VisibleProviders = @()
    Variables = @()
    FunctionDefinitions = @()
}

Register-PSSessionConfiguration -Name HelpDesk `
    -RoleDefinitionPath 'C:\Program Files\WindowsPowerShell\Modules\HelpDesk\1.0\RoleCapabilities\' `
    -ShowSecurityDescriptorUI

Phase 6: Patch Management

#### 6.1 Configure Windows Update for Business

# Configure via Group Policy or PowerShell
# GPO path: Computer Configuration > Administrative Templates > Windows Components > Windows Update

# Configure automatic updates
Set-WUroSettings -AutomaticInstallation 4  # Auto download and schedule install
Set-WUroSettings -ScheduledInstallDay EveryWednesday
Set-WUroSettings -ScheduledInstallTime 2  # 2 AM

#### 6.2 WSUS / Windows Update for Business Synchronization

# Force synchronization
Get-WUroSettings
Invoke-WUroScan

Verification and Expected Outputs

| Check | Method | Expected Result | |-------|--------|-----------------| | Domain Admin count | `Get-ADGroupMember "Domain Admins"` | 2-5 emergency accounts only | | Password complexity | Run password audit tool | All passwords meet complexity | | GPO applied | `gpresult /h report.html` | Server Security Baseline applied | | Windows Defender active | `Get-MpComputerStatus` | Real-time protection enabled | | Firewall active | `netsh advfirewall show allprofiles` | All profiles ON | | PowerShell logging | Event Viewer > Windows PowerShell | Event IDs 4104, 4103 present | | Patch compliance | WSUS reports or WUfB | All critical patches installed within 30 days |

Troubleshooting Scenarios

| Issue | Diagnosis | Resolution | |-------|-----------|------------| | Users locked out after GPO | Account lockout threshold too low | Review lockout policy, increase threshold | | Windows Defender blocking legitimate app | False positive detection | Add exclusion path/process, submit to Microsoft | | GPO not applying | GPO link or filtering issue | Run `gpresult /r`, check OU linkage and security filtering | | Firewall blocking domain services | Overly restrictive rules | Verify required ports are open for domain communication | | PowerShell scripts blocked | Execution policy restriction | Sign scripts or adjust execution policy | | JEA endpoint unavailable | Role capability file error | Verify JEA role capability syntax and path |

Security Best Practices

**Use dedicated administrative accounts:** Separate daily user accounts from administrative accounts
**Implement LAPS:** Local Administrator Password Solution for unique local admin passwords
**Enable Credential Guard:** Protect against credential theft attacks on Windows 10/11 and Server 2016+
**Restrict RDP access:** Use RD Gateway, VPN, or jump boxes; never expose RDP directly to internet
**Enable bitlocker:** Encrypt operating system drives on all servers
**Disable SMBv1:** Legacy protocol vulnerable to ransomware (WannaCry, NotPetya)
**Monitor for Pass-the-Hash:** Alert on Event ID 4624 with Logon Type 3 and NTLM
**Implement MFA:** Require MFA for all remote access and privileged operations

Enterprise Considerations

**Forest trust:** Limit cross-forest trusts and use selective authentication
**SDAdmin protection:** Use AdminSDHolder and SDProp to protect privileged accounts
**Read-only domain controllers:** Deploy RODC in branch offices or less secure locations
**Domain functional level:** Raise to Windows Server 2016 or higher for enhanced security features
**Password policies:** Implement fine-grained password policies for different user types
**Disaster recovery:** Maintain offline domain controller backups for forest recovery

Conclusion

Windows Server security requires a defense-in-depth approach combining Active Directory hardening, Group Policy security baselines, endpoint protection, firewall configuration, and continuous monitoring. By implementing least-privilege administration, credential protection, and regular patching, you significantly reduce the risk of domain compromise and lateral movement.

Frequently Asked Questions

**Q: Should I disable SMBv1?** A: Yes. SMBv1 is deprecated and vulnerable to remote code execution. Disable it on all systems unless required for legacy devices.

**Q: How often should I rotate the KRBTGT account password?** A: Rotate KRBTGT at least once every 2 years, and immediately after any suspected domain compromise. Rotate twice with a gap between rotations to invalidate golden tickets.

**Q: Can I use Windows Defender with third-party antivirus?** A: No. Windows Defender automatically disables when another antivirus is detected. Use one or the other.

Official Technical References

Microsoft Security Compliance Toolkit: https://www.microsoft.com/en-us/download/details.aspx?id=55319
Windows Server Security Guide: https://learn.microsoft.com/en-us/windows-server/security/
Active Directory Security: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/
CIS Microsoft Windows Server Benchmark: https://www.cisecurity.org/benchmark/microsoft-windows-server/
MITRE ATT&CK for Windows: https://attack.mitre.org/matrices/windows/