Windows Server Security Hardening in Practice: Security Baseline Configuration Guide

Hands-on Windows Server security hardening covering local security policy, user rights, RDP protection, audit logging, and common attack-surface reduction, with ready-to-run PowerShell commands and verification steps.

Applicable Scenarios

Windows Server security hardening applies when: enterprises run workloads on Windows Server 2016/2019/2022 and must meet MLPS 2.0 or internal security baseline requirements; servers are internet-exposed and face RDP brute force, weak-password spraying, and unauthorized access; operators need a repeatable hardening process to cut post-compromise lateral movement. This article gives a ready-to-run plan covering local security policy, account policy, Remote Desktop, audit logging, and common attack surfaces.

Prerequisites

• Windows Server 2016 or later, with local administrator rights
• Create a system restore point or full snapshot before hardening so you can roll back
• Confirm script execution policy with Get-ExecutionPolicy; if needed, run Set-ExecutionPolicy RemoteSigned

How It Works

Windows Server hardening is least privilege plus defense in depth. Attackers usually take three steps: get in via weak passwords or RDP brute force, escalate to SYSTEM with a local privilege-escalation bug, then persist. Hardening breaks each step: account policy limits password guesses, local security policy disables unnecessary services and shares, audit policy leaves a full intrusion trail, and baseline scripts freeze those rules as standard config.

Procedure

1. Harden Account and Password Policy

Set password complexity, minimum length, and lockout threshold via secpol.msc or PowerShell:

# Set password policy: min length 14, complexity on, max age 90 days
net accounts /minpwlen:14 /maxpwage:90 /uniquepw:5

# Set account lockout policy: lock 30 minutes after 5 failures
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name "MaximumPasswordAge" -Value 90

# Enable account lockout (secedit command set)
secedit /configure /db secedit.sdb /cfg lockout.cfg /areas SECURITYPOLICY
echo "[System Access]" > lockout.cfg
echo "LockoutBadCount = 5" >> lockout.cfg
echo "ResetLockoutCount = 30" >> lockout.cfg
echo "LockoutDuration = 30" >> lockout.cfg

Key parameters: LockoutBadCount is the lockout threshold; LockoutDuration is lockout minutes. Disable default accounts other than the local Administrator, and rename the admin account:

# Rename built-in Administrator and disable Guest
Rename-LocalUser -Name "Administrator" -NewName "SecAdmin2026"
Disable-LocalUser -Name "Guest"
Get-LocalUser

2. Remote Desktop Protection

RDP is the most commonly brute-forced entry point. Enable NLA (Network Level Authentication) and change the default 3389 port:

# Enable NLA (Network Level Authentication)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Value 1

# Change RDP port to 53389 (open the firewall as well)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "PortNumber" -Value 53389
Restart-Service TermService

# Allow the new port on the firewall and restrict source IPs
New-NetFirewallRule -DisplayName "RDP-Custom" -Direction Inbound -LocalPort 53389 -Protocol TCP -RemoteAddress 192.168.1.0/24 -Action Allow

Key parameter: set RemoteAddress to your office subnet for allowlist access. If you access via a bastion host, restrict the source to the bastion IP.

3. Disable High-Risk Services and Shares

# Stop and disable high-risk services: Telnet, FTP Publishing, Print Spooler (if not needed)
Set-Service -Name "TlntSvr" -StartupType Disabled -ErrorAction SilentlyContinue
Set-Service -Name "FTPSVC" -StartupType Disabled -ErrorAction SilentlyContinue

# Remove default shares
Remove-SmbShare -Name "ADMIN$" -Force -ErrorAction SilentlyContinue
Remove-SmbShare -Name "C$" -Force -ErrorAction SilentlyContinue

# Enable SMB signing to prevent MITM
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force

4. Enable Audit Policy and Log Hardening

# Enable audit for logon, account management, and process creation
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Account Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Process Creation" /success:enable

# Increase Security log size and enable Sysmon (download Sysmon first)
wevtutil sl Security /ms:104857600
# Sysmon config example: log process creation and network connections
sysmon64 -accepteula -i sysmon-config.xml

5. One-Click Baseline Hardening Script

Combine the rules above into a script at C:\Scripts\Harden.ps1, and run a weekly scheduled task to verify:

# Harden.ps1 - Windows security baseline hardening script
$ErrorActionPreference = "Continue"
net accounts /minpwlen:14
Set-Service -Name "TlntSvr" -StartupType Disabled
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
Write-Host "[OK] Security baseline applied $(Get-Date)"

Verify the Configuration

# Verify password policy
net accounts

# Verify account enabled state
Get-LocalUser | Select-Object Name, Enabled

# Verify RDP port is listening
netstat -ano | findstr 53389

# Verify audit policy
auditpol /get /subcategory:"Logon"

# Verify Security log events (failed logon 4625)
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4625} -MaxEvents 10 | Select-Object TimeCreated, Message

FAQ

Q1: Cannot connect remotely after changing the RDP port?

First confirm the service on the local console: Get-Service TermService. If it is running, check that the firewall allows the new port and is not still bound to the old one. If the RemoteAddress allowlist does not include your current source IP, the connection is dropped. Keep one IP-restricted admin rule so you are not locked out.

Q2: Will disabling default shares break production?

ADMIN$ and C$ are administrative shares used only for remote admin. Normal business apps are unaffected. Confirm backup software and monitoring agents do not depend on admin shares; if they do, switch the backup policy to a dedicated share with explicit permissions.

Q3: Security log growing too fast?

Set a log size cap (100MB or more recommended) and overwrite policy: wevtutil sl Security /ms:104857600 /rt:true /ab:true. Also forward logs to a SIEM or central log platform (ELK, Windows Event Forwarding) for off-box retention so attackers cannot wipe local logs.

Summary

Windows Server hardening should follow least privilege and defense in depth, focusing on RDP brute force, weak passwords, and default shares. Password policy, account lockout, NLA, and port allowlists are the high-impact basics; audit policy and Sysmon cover what you cannot see. Bake the steps into a baseline script, put it under change control, and periodically check for config drift with a baseline scanner.