Windows server hardening: security policy, GPO, RDP, SMB
You harden a Windows server with local security policy and Group Policy, configuring RDP, SMB, legacy protocols and PowerShell logging securely.
Level 201 · 17 lessons · 18 practice labs
Lessons
Security policy
- Local security policy: account and audit policies
- User rights assignment: who may log on locally
- Advanced audit policy: which events to record
- Exporting and comparing policy with secedit
- Short task: enable auditing for logons, process creation and account changes
Remote access and sharing
- Hardening RDP: NLA, restricted groups, network limits
- Hardening SMB: disabling SMBv1, signing, encryption
- Disabling legacy protocols: LLMNR, NetBIOS, WPAD
- Setting up WinRM and PowerShell remoting securely
- Short task: prove that SMBv1 and LLMNR are disabled
Logging and services
- PowerShell logging: script block and module logging
- Removing unneeded roles and services
- Reviewing scheduled tasks and service accounts
- Log sizes and event forwarding (WEF)
- Short task: find a command run through PowerShell in the log
Capstone
- Packaging the settings as a GPO and applying them to servers
- Capstone: harden a file server and report on it
Practice labs
- Turn on process creation auditing with command lines: Enable process creation with auditpol, turn on command-line logging and show the command in a 4688 event.
- Set advanced audit policy for account changes: Enable the user and group management subcategories, change a group membership and find the 4732 record.
- Diff two servers’ policies with secedit: Export policy from two servers, list the security settings that differ and fix the weaker one.
- Leave local logon rights to administrators only: Remove the Users group from the user rights assignment and show a standard user cannot log on to the server.
- Find the account that was given debug rights: List the accounts holding SeDebugPrivilege, remove the unneeded one and confirm the policy applied.
- Prove SMBv1 is disabled: Query SMBv1 on the server and client side, disable it if on and prove it with a connection attempt.
- Require NLA for RDP and set session limits: Turn on NLA, limit idle session time and show a client without NLA cannot connect.
- Require SMB signing on the file server: Query the signing settings, make signing required and show an unsigned session is refused.
- Switch off LLMNR, NetBIOS and WPAD together: Disable the three legacy protocols in their settings and test that the host no longer answers name poisoning.
- Turn on PowerShell script block logging: Set the policy, run a command and find its full text in a 4104 record.
- Find a hidden PowerShell download command in the log: Find an encoded and split command in 4104 records, decode it and extract the download address.
- Size the event logs and set up forwarding: Grow the Security log to hold a week of events and show it is forwarded to the collector.
- Find a suspicious scheduled task running with high privileges: Filter scheduled tasks for those running as SYSTEM, find the one launching a script from a user folder and disable it.
- Find a service account whose password never changes and limit it: Map services to their accounts, find the service account that can log on interactively and cut its rights.
- List the server’s scheduled tasks with the accounts that run them: Use PowerShell to produce a list of all non-Microsoft scheduled tasks with the account that runs each and the command it executes.
- Secure the writable script behind a task that runs as SYSTEM: Find that standard users can write to the folder holding the task’s script, fix the permission and move the task to a least-privileged service account.
- Query the server’s SMB signing state: Use PowerShell to show whether signing is enabled and required on the server and client side.
- Roll SMB signing out to all servers without breaking a legacy client: Identify clients connecting unsigned from audit logs, plan the transition for a legacy print server, apply the policy in stages and confirm SMBv1 is off.
About this course
You harden a Windows server with local security policy and Group Policy, configuring RDP, SMB, legacy protocols and PowerShell logging securely.
What you will learn
- Security policy
- Remote access and sharing
- Logging and services
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.