Windows Server Hardening Checklist (2026 Edition) – Practical Security Guide

Windows Server • Security • Hardening • Active Directory

Hardening Windows Server is not about “ticking boxes”. It is about reducing attack surface, limiting privilege, enforcing secure defaults, and improving detection. This checklist is written for real environments: small IT teams, enterprise networks, and segmented infrastructures.

1) Patch & Update Discipline

• Implement a monthly patch cycle (OS + applications + firmware where applicable).
• Use WSUS/SCCM/Intune or an equivalent controlled patching process.
• Prioritize “exploited in the wild” vulnerabilities (emergency out-of-band patching).
• Remove or update end-of-life software/components immediately.

2) Identity & Access Control

• Enforce MFA for privileged access (where possible, especially for remote access gateways).
• Separate admin accounts from normal user accounts (no daily browsing with admin).
• Use least privilege: remove Domain Admin membership from non-essential accounts.
• Implement tiering model (Tier 0/1/2) for admin activities where feasible.
• Disable or restrict local administrator usage; manage via LAPS / Windows LAPS.

3) Secure Baselines (GPO / Local Policies)

• Apply Microsoft Security Baseline templates when possible (adapted to your environment).
• Disable legacy protocols: SMBv1, old TLS/SSL where business allows.
• Enforce strong password policy and account lockout policy.
• Disable guest accounts and unused local accounts.
• Restrict “Log on locally” and “Log on through Remote Desktop Services”.

4) RDP Hardening (Most Common Entry Point)

• Do not expose RDP directly to the internet.
• Use VPN + firewall restrictions, or Remote Desktop Gateway with MFA.
• Enable Network Level Authentication (NLA).
• Restrict RDP to specific admin groups only.
• Consider changing default RDP settings only as a minor measure — not a control.

Quick checks

# Check if RDP is enabled
(Get-ItemProperty "HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server").fDenyTSConnections

# Check firewall rules for RDP
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Select DisplayName, Enabled

5) Windows Firewall & Network Segmentation

• Default deny inbound where possible, allow only required services.
• Segment DCs, servers, and admin workstations (admin access should be controlled).
• Block lateral movement paths where feasible (SMB, WMI, RPC between segments).
• Document required ports (do not allow “any any” rules).

6) Services & Attack Surface Reduction

• Remove unused roles/features (IIS, Print services, legacy services, etc.).
• Disable unnecessary scheduled tasks and services.
• Restrict PowerShell to signed scripts for sensitive systems where appropriate.
• Disable autorun and reduce macro exposure on admin workstations.

7) Logging & Detection (Hardening Without Visibility is Incomplete)

• Enable advanced auditing (logon events, privilege use, object access as needed).
• Centralize logs (SIEM or Windows Event Forwarding).
• Monitor for: 4624/4625, privilege escalations, service creation, scheduled task creation.
• Ensure time sync is correct (domain hierarchy, NTP).

Useful PowerShell for event review

# Failed logons
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 30 |
Select TimeCreated, Id, Message

# New service installed (often used by attackers)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045} -MaxEvents 30 |
Select TimeCreated, Id, Message

8) Backup & Recovery (Your Last Line of Defense)

• Maintain offline/immutable backups (ransomware-resistant).
• Test restores regularly (backup without restore testing is a false sense of security).
• Keep DC recovery procedures documented (authoritative/non-authoritative restore).
• Protect backup accounts and consoles with strong access controls.

9) Endpoint Protection & Vulnerability Management

• Ensure Defender for Endpoint (or equivalent) is deployed and actively monitored.
• Run regular vulnerability scans and track remediation (ownership + deadlines).
• Prioritize internet-facing systems and privileged systems first.

10) Practical “Minimum Baseline” You Can Apply Immediately

Conclusion

Windows Server hardening is a continuous process. Start with a realistic baseline, reduce exposure step-by-step, and improve monitoring and recovery. The most effective security posture comes from strong identity controls, controlled remote access, good patch hygiene, and verified backups.

If you want a tailored hardening baseline for your infrastructure (including GPO templates, audit policy, and monitoring), contact me for consulting or training.