Windows Server Security Hardening

# Windows Server Security Hardening

Introduction

Windows Server is a frequent target for attackers due to its prevalence in enterprise environments. Security hardening reduces the attack surface by disabling unnecessary services, restricting user rights, configuring the firewall, enabling auditing, and applying security baselines.

This tutorial provides a comprehensive guide to Windows Server security hardening, covering user rights assignment, Windows Defender, firewall configuration, auditing and logging, updates and patching, server role security, and Group Policy security baselines.

By the end of this guide, you will be able to harden Windows Server against common attack vectors and implement a layered security posture.

Technical Background

Defense in Depth

Defense in depth layers multiple security controls so that if one fails, others still protect the system:

Network Perimeter (Firewall) → Host Firewall → OS Security → Application Security → Data Protection

Attack Surface Reduction

Reducing the attack surface involves:

• Removing unused roles and features
• Disabling unnecessary services
• Restricting user rights and privileges
• Applying least-privilege principles

Windows Security Baselines

Microsoft publishes Security Compliance Toolkit baselines that provide recommended security settings for Windows Server. These baselines cover user rights, audit policies, password policies, and registry settings.

Prerequisites

• Windows Server 2025 installed
• Administrator privileges
• Maintenance window for security changes
• Backup before applying hardening changes

Architecture

Security Layers

┌─────────────────────────────────────────────────────────────┐
│                    Layer 1: Network Perimeter               │
│              Edge Firewall, WAF, IDS/IPS                    │
└─────────────────────────────────────────────────────────────┘
                              │
┌─────────────────────────────────────────────────────────────┐
│                    Layer 2: Host Firewall                   │
│              Windows Defender Firewall with Advanced        │
│                    Security (WFAS)                          │
└─────────────────────────────────────────────────────────────┘
                              │
┌─────────────────────────────────────────────────────────────┐
│                    Layer 3: OS Security                     │
│      User Rights, Services, Defender AV, BitLocker, Updates │
└─────────────────────────────────────────────────────────────┘
                              │
┌─────────────────────────────────────────────────────────────┐
│                    Layer 4: Application Security            │
│          Application Control, IIS, SQL Server Security      │
└─────────────────────────────────────────────────────────────┘

Step-by-Step Implementation

Step 1: Remove Unused Roles and Features

**Purpose**: Reduce attack surface by removing unnecessary server roles.

**Commands** (PowerShell):

# List installed roles and features
Get-WindowsFeature | Where-Object {$_.InstallState -eq 'Installed'}

# Remove unused role (example: Print-Services)
Uninstall-WindowsFeature -Name Print-Services -Remove

# Remove unused feature
Uninstall-WindowsFeature -Name RSAT-ADDS -Remove

# Verify removal
Get-WindowsFeature | Where-Object {$_.InstallState -eq 'Installed'}

**Expected output**: Unused roles and features removed.

**Verification**:

Get-WindowsFeature | Where-Object {$_.InstallState -eq 'Installed'}
# Shows only required roles and features

Step 2: Configure User Rights Assignment

**Purpose**: Restrict privileged rights to authorized accounts only.

**Commands** (PowerShell):

# View current user rights assignments
secedit /export /cfg C:\temp\current-security.inf
Get-Content C:\temp\current-security.inf | Select-String "SeDenyNetworkLogonRight"

# Restrict logon rights (example via Local Security Policy GUI)
# secpol.msc → Local Policies → User Rights Assignment

**Key rights to restrict**:

• `SeNetworkLogonRight` (Access this computer from the network): Administrators, Authenticated Users
• `SeDenyNetworkLogonRight`: Guests, Local account
• `SeBackupPrivilege`: Administrators, Backup Operators
• `SeDebugPrivilege`: Administrators only

**Expected output**: Privileged rights restricted to authorized accounts.

**Verification**:

# Test that restricted account cannot log on over network
# Verify User Rights Assignment in secpol.msc

Step 3: Configure Windows Defender Firewall

**Purpose**: Restrict inbound and outbound network traffic.

**Commands** (PowerShell):

# Enable firewall for all profiles
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

# Set default inbound block
Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultInboundAction Block

# Allow only necessary inbound rules
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
Enable-NetFirewallRule -DisplayGroup "File and Printer Sharing (SMB-In)"

# Block outbound traffic by default (optional, more restrictive)
# Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultOutboundAction Block

# Verify firewall state
Get-NetFirewallProfile

**Expected output**: Firewall enabled with restrictive inbound rules.

**Verification**:

Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction
# Shows all profiles enabled with Block inbound

Step 4: Configure Auditing and Logging

**Purpose**: Track security events for detection and forensics.

**Commands** (PowerShell):

# Configure audit policy
Auditpol /set /subcategory:"Logon" /success:enable /failure:enable
Auditpol /set /subcategory:"Account Management" /success:enable /failure:enable
Auditpol /set /subcategory:"Policy Change" /success:enable /failure:enable
Auditpol /set /subcategory:"Privilege Use" /success:enable /failure:enable
Auditpol /set /subcategory:"Detailed File Share" /success:enable /failure:enable

# View current audit policy
Auditpol /get /category:*

# Configure Event Log retention
wevtutil el | ForEach-Object { wevtutil sl $_ /e:true /ms:512000 }

**Key audit categories**:

• Logon/Logoff: Track authentication events
• Account Management: Track user/group changes
• Policy Change: Track security policy modifications
• Privilege Use: Track sensitive privilege usage
• Object Access: Track file/folder access

**Expected output**: Auditing enabled for security-relevant events.

**Verification**:

Auditpol /get /category:*
# Shows enabled audit categories

Step 5: Configure Windows Updates and Patching

**Purpose**: Keep server patched against known vulnerabilities.

**Commands** (PowerShell):

# Configure automatic updates
Install-Module PSWindowsUpdate -Force

# Check for updates
Get-WindowsUpdate

# Install all updates
Install-WindowsUpdate -AcceptAll -AutoReboot

# Schedule automatic maintenance
sconfig  # Option 5: Download and install updates

**Expected output**: Security updates installed automatically.

**Verification**:

Get-WindowsUpdateLog -LastTime 1
# Shows recent update activity

Step 6: Enable BitLocker Drive Encryption

**Purpose**: Protect data at rest against physical theft.

**Commands** (PowerShell):

# Enable BitLocker on system drive
Enable-BitLocker -Drive C: -EncryptionMethod XtsAes256 -UsedSpaceOnly -RecoveryPasswordProtector

# Save recovery key
Backup-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector

# Verify BitLocker status
Get-BitLockerVolume

**Expected output**: System drive encrypted with BitLocker.

**Verification**:

Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, EncryptionPercentage
# Shows EncryptionComplete

Step 7: Configure Windows Defender Antivirus

**Purpose**: Protect against malware and malicious software.

**Commands** (PowerShell):

# Import Defender module
Import-Module Defender

# Set real-time protection
Set-MpPreference -RealtimeProtectionEnabled $true

# Configure scheduled scan
Set-MpPreference -ScanScheduleDay Everyday -ScanScheduleTime 2

# Set cloud protection
Set-MpPreference -MAPSReporting Advanced

# Verify Defender status
Get-MpPreference | Select-Object RealtimeProtectionEnabled, IOAVProtectionEnabled

**Expected output**: Windows Defender Antivirus enabled and configured.

**Verification**:

Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled
# Shows all protection features enabled

Step 8: Apply Security Baseline via Group Policy

**Purpose**: Apply Microsoft Security Compliance Toolkit baseline settings.

**Procedure** (Group Policy Management Console - GPMC.msc):

1. Download Security Compliance Toolkit from Microsoft 2. Import baseline GPOs into Group Policy Management 3. Link baseline GPO to appropriate OU 4. Configure:

• Account Policies (password complexity, length, history)
• Local Policies (audit policy, user rights, security options)
• Event Log (retention, size)
• Restricted Groups
• System Services (startup type)

**Commands** (PowerShell):

# Import baseline GPO (after downloading SCT)
Import-GPO -BackupId <guid> -Path \\server\baselines\ -TargetName "Windows Server 2025 Security Baseline"

# Link GPO to OU
New-GPLink -Name "Windows Server 2025 Security Baseline" -Target "OU=Servers,DC=ityantra,DC=lab" -LinkEnabled Yes -Enforced Yes

**Expected output**: Security baseline applied to servers.

**Verification**:

gpresult /r /scope computer
# Shows applied GPOs and settings

Configuration Examples

Firewall Rules Example

# Allow only required inbound traffic
New-NetFirewallRule -DisplayName "Allow HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow
New-NetFirewallRule -DisplayName "Allow RDP" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow -RemoteAddress 192.168.1.0/24
New-NetFirewallRule -DisplayName "Allow DNS" -Direction Inbound -Protocol UDP -LocalPort 53 -Action Allow

# Block all other inbound
Set-NetFirewallProfile -DefaultInboundAction Block

Password Policy (Local Security Policy)

Password must meet complexity requirements: Enabled
Minimum password length: 14 characters
Password history: 24 passwords remembered
Maximum password age: 90 days
Minimum password age: 1 day
Store passwords using reversible encryption: Disabled
Account lockout threshold: 5 invalid attempts
Account lockout duration: 30 minutes
Reset account lockout counter after: 30 minutes

Security Options (Key Settings)

Accounts: Administrator account status: Disabled
Accounts: Rename administrator account: Enabled (new name: svc_admin)
Devices: Allowed to format and eject removable media: Administrators
Devices: Restrict CD-ROM access to locally logged-on user only: Enabled
Domain controller: Refuse machine account password changes: Disabled
Interactive logon: Do not require CTRL+ALT+DEL: Disabled
Interactive logon: Display user information when session is locked: Disabled
Microsoft network server: Digitally sign communications (always): Enabled
Network access: Do not allow anonymous enumeration of SAM accounts: Enabled
Network access: Do not allow anonymous enumeration of SAM accounts and shares: Enabled

Verification

Security Verification Commands

# Check firewall state
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction

# Check Defender status
Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled

# Check audit policy
Auditpol /get /category:*

# Check BitLocker status
Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus

# Check installed roles
Get-WindowsFeature | Where-Object {$_.InstallState -eq 'Installed'}

# View security event log
Get-EventLog -LogName Security -Newest 10

# Verify GPO application
gpresult /r /scope computer

Expected Results

• Firewall enabled with Block default inbound
• Defender Antivirus real-time protection enabled
• Auditing enabled for Logon, Account Management, Policy Change
• BitLocker encryption complete on system drive
• Unused roles and features removed
• Security baseline GPO applied

Troubleshooting

| Symptom | Possible Cause | Diagnostic Command | Corrective Action | Verification | |---------|---------------|-------------------|-------------------|--------------| | Cannot RDP after firewall change | RDP port blocked | `Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*RDP*"}` | Allow RDP rule; restrict to admin subnet | RDP connects | | Defender not updating | Cloud protection disabled | `Get-MpPreference | Select-Object MAPSReporting` | Enable MAPS reporting | Definition updates | | Audit logs not generated | Auditing not enabled | `Auditpol /get /category:` | Enable relevant audit categories | Events in Security log | | BitLocker suspended | TPM or recovery issue | `Get-BitLockerVolume` | Resume BitLocker; backup recovery key | Encryption resumes | | GPO not applied | Link or enforcement issue | `gpresult /r /scope computer` | Check GPO link; run gpupdate /force | GPO applied | | Service fails after hardening | User rights restricted | Event Log System | Grant required rights to service account | Service starts | | Update installation fails | WSUS or connectivity | `Get-WindowsUpdateLog` | Fix connectivity; check WSUS | Updates install |

Best Practices

1. **Apply security baseline**: Use Microsoft Security Compliance Toolkit baselines as starting point. 2. **Remove unused roles**: Every role adds potential vulnerabilities. 3. **Use least privilege**: Assign only required user rights and permissions. 4. **Enable auditing**: Track security events for detection and forensics. 5. **Keep patched**: Apply security updates promptly. 6. **Encrypt data at rest**: Use BitLocker for system and data drives. 7. **Restrict network access**: Firewall default deny; allow only required traffic. 8. **Use dedicated admin accounts**: Separate daily use from administrative accounts. 9. **Implement Just Enough Administration (JEA)**: Limit PowerShell administrative capabilities. 10. **Regular security assessment**: Run vulnerability scans and review configurations quarterly.

Conclusion

Windows Server security hardening is an ongoing process that reduces the attack surface and strengthens the server against attacks. By removing unused roles, configuring user rights, enabling the firewall, implementing auditing, keeping the system patched, encrypting data at rest, and applying security baselines, administrators create a layered defense that protects against common attack vectors. Regular review and testing of security configurations ensures the hardening remains effective as threats evolve.

References

• Microsoft Security Compliance Toolkit (https://www.microsoft.com/download/details.aspx?id=55319)
• Windows Server Security Guide (https://learn.microsoft.com/windows-server/security/)
• Windows Defender Firewall with Advanced Security (https://learn.microsoft.com/windows-server/security/windows-firewall/)
• BitLocker Deployment Guide (https://learn.microsoft.com/windows-server/protection/bitlocker/)
• Audit Policy Recommendations (https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/)