Windows¶
How to harden a Windows 11 or Windows Server 2022 image. The lessons are grouped by the question a defender asks, in the order an attacker moves. Each page covers one task, with the steps, the command to verify it, and an example of what the problem looks like on an image.
Start with the README¶
You can't decide whether an account, a service, or a program belongs until you know what the machine is for and who uses it. The README on the desktop tells you: the scenario, the authorized users and which are administrators, and the services and software that must keep working. Read it before touching anything. Write the lists down. Reread it when a change feels risky.
Every decision from here on is the same question: does the README, or the machine's obvious job, give a reason for this to be here? If not, it goes. If you're unsure, find out what it does first. Removing something the scenario needs is also a failure, and it costs points.
The groups¶
| Group | The question it answers |
|---|---|
| Getting Around | Where are the settings, and how do I read a value back to prove a change took? |
| Accounts | Who can log in, and who is an administrator? |
| Password and Lockout Policy | What rules do passwords have to follow, and what happens after too many wrong guesses? |
| Rights and Security Options | What can an account do once it's in, and how hard is it to become an administrator? |
| Network Doors | What's listening on the network, and which of those doors should be closed or locked? |
| Built-in Protections | What stops known attacks, and which of those protections has been switched off? |
| Updates | Is Windows patched, and is every application patched? |
| Unwanted Software and Malware | What's on the disk that shouldn't be? |
| Browsers | What does the browser let a bad website do? |
| Server Roles | What does the server application expose, and how do I lock it down? (Server 2022) |
| File Permissions | Who can read or change which files? |
| Auditing | Can we see what happened? |
| Privacy | What leaves the machine without anyone asking? |
Work through them in order the first time. After that, use the sidebar to jump to whatever the image needs.
Together these groups cover every Level 1, Level 2, and BitLocker recommendation in the CIS Microsoft Windows 11 Benchmark v5.0.0, placed by what each setting defends against rather than by benchmark section. Settings are Level 1 unless marked Level 2 or BitLocker; Level 1 and Level 2 Settings explains the difference and which Level 2 items to check against the README first.
Before you start¶
Take a snapshot in VMware. Take another after each group. A snapshot is the only undo button you have.