Windows Server 2022: baseline hardening checklist

Hardening a Windows Server 2022 installation is a critical step in establishing a secure and resilient infrastructure. This guide outlines a comprehensive…

Hardening a Windows Server 2022 installation is a critical step in establishing a secure and resilient infrastructure. This guide outlines a comprehensive checklist of essential security measures, focusing on practical configurations and best practices applicable immediately after operating system deployment. The objective is to reduce the attack surface, mitigate common vulnerabilities, and enhance overall system integrity before the server is placed into production or joined to an Active Directory domain.

Initial Setup and Patching

Before any significant configuration, ensure the operating system is fully updated and prepared for hardening. This minimizes known vulnerabilities from the outset.

Apply Latest Updates

Upon initial installation, immediately apply the latest cumulative update and any available security updates. This should be done before connecting the server to a production network segment or domain, ideally on an isolated network. Use Windows Update or WSUS. For a standalone server, run:

Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate -Install -AcceptAll -AutoReboot

Verify successful installation by checking the update history in Settings > Windows Update > Update history.

Rename Local Administrator Account and Secure Passwords

The default "Administrator" account is a prime target for brute-force attacks. Rename it to an obscure name immediately. Additionally, ensure strong, unique passwords for all local accounts. For domain-joined servers, implement LAPS (Local Administrator Password Solution) for rotating local administrator passwords. For standalone servers, use complex, periodically changed passphrases.

• Open Computer Management (compmgmt.msc).
• Navigate to Local Users and Groups > Users.
• Right-click "Administrator," select Rename, and choose a new, non-obvious name.
• Right-click the renamed account, set a strong password.
• For all other unnecessary local user accounts, disable or delete them.

Network and Protocol Security

Securing network communication channels and disabling legacy, insecure protocols are foundational to server hardening.

Disable SMBv1

SMBv1 is an outdated and insecure protocol with known vulnerabilities, exploited by malware like WannaCry. It is disabled by default in Windows Server 2022, but verify its status.

Get-WindowsFeature -Name FS-SMB1
# If 'Installed' is checked, uninstall it:
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -Remove

A reboot is typically required after removal. Confirm removal with sc.exe qc lanmanworkstation; SMB1 should not be listed as a dependency.

Enforce SMB Signing and Encryption

SMB signing prevents man-in-the-middle attacks that could modify SMB traffic, while SMB encryption protects data in transit. Enforce these via Group Policy Objects (GPOs) for domain environments or directly via registry for standalone servers.

• SMB Signing:
  • Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network server: Digitally sign communications (always) - Enable
  • Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network client: Digitally sign communications (always) - Enable
• SMB Encryption:
  • Computer Configuration\Administrative Templates\Network\Lanman Workstation\Enable insecure guest logons - Disable (Prevents connections to shares requiring insecure guest logons)
  • SMB 3.0+ encrypts data by default when possible. Ensure negotiation is not downgraded.

Configure Windows Firewall

The Windows Defender Firewall should be configured to a "deny by default" inbound policy, allowing only explicitly required ports and protocols. For servers, this typically means allowing RDP (TCP 3389) from specific management subnets, and application-specific ports (e.g., HTTP/S 80/443 for web servers, SQL 1433 for database servers).

# Example: Allow RDP from a specific subnet
New-NetFirewallRule -DisplayName "Allow RDP from Mgmt Subnet" -Direction Inbound `
    -Action Allow -Protocol TCP -LocalPort 3389 `
    -RemoteAddress 192.168.1.0/24 -Enabled True

# Example: Block all other inbound for public profile (adjust for your active profile)
Set-NetFirewallProfile -Profile Public -DefaultInboundAction Block
Set-NetFirewallProfile -Profile Domain -DefaultInboundAction Block
Set-NetFirewallProfile -Profile Private -DefaultInboundAction Block

Review existing rules and disable any unnecessary default allowances.

Endpoint Protection and Data Security

Implementing robust endpoint protection and data encryption prevents unauthorized access and limits the impact of breaches.

Enable Windows Defender, Tamper Protection, and ASR Rules

Windows Defender is a powerful, built-in antivirus and anti-malware solution. Ensure it's active and up-to-date. Tamper Protection prevents malicious actors from disabling security features, and Attack Surface Reduction (ASR) rules block common malware behaviors.

• Windows Defender: Enabled by default. Verify its status via PowerShell: Get-MpComputerStatus | Format-Table AntivirusEnabled, RealTimeProtectionEnabled
• Tamper Protection:
  • For standalone servers: Settings > Update & Security > Windows Security > Virus & threat protection > Virus & threat protection settings > Manage settings > Tamper Protection.
  • For domain-joined servers: Configure via GPO at Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Tamper Protection.
• ASR Rules: Configure via GPO at Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Attack Surface Reduction. Start with audit mode for critical rules before enforcing them, e.g., "Block Adobe Reader from creating child processes."

Enable BitLocker on System and Data Drives

BitLocker Drive Encryption protects data at rest by encrypting entire volumes. This is crucial for both system and data drives, especially on physical servers or virtual machines that might be directly accessible or improperly decommissioned.

# Enable BitLocker for OS drive (C:) with TPM (Trusted Platform Module)
# Ensure TPM is enabled in BIOS/UEFI.
Manage-bde -on C: -RecoveryPassword
# Output will include a recovery key. Store it securely (e.g., AD, printout).

# Enable BitLocker for a data drive (D:)
Manage-bde -on D: -RecoveryPassword
# For data drives, also consider auto-unlock if the OS drive is BitLocker protected.
Manage-bde -autounlock -enable D:

Regularly back up BitLocker recovery keys, preferably to Active Directory for domain-joined servers.

System Management and Logging

Robust management practices and comprehensive logging are essential for maintaining security posture and enabling incident response.

Apply Microsoft Security Baseline (SCT) via GPO

Microsoft provides Security Compliance Toolkits (SCT) with baseline GPO templates. These baselines incorporate best practices and are highly recommended. Download the latest Windows Server 2022 Security Baseline from the Microsoft Security Compliance Toolkit website.

1. Download and extract the Security Compliance Toolkit.
2. Import the recommended GPO backups (e.g., "Windows Server 2022 - Domain Controller Security Baseline," "Windows Server 2022 - Member Server Security Baseline") into Group Policy Management Editor (gpmc.msc).
3. Review and customize the GPOs to fit your environment's specific requirements, paying close attention to password policies, account lockout, audit policies, and user rights assignments.
4. Link the GPOs to the appropriate OUs.
5. Verify application with gpresult /h output.html on target servers.

Enable PowerShell Script Block and Module Logging

PowerShell is a powerful administrative tool, but it can also be abused. Enabling detailed logging helps detect malicious activity.

• Script Block Logging: Logs the content of PowerShell script blocks as they are executed.
  • GPO path: Computer Configuration\Administrative Templates\Administrative Templates\Windows Components\Windows PowerShell\Turn on PowerShell Script Block Logging - Enable.
• Module Logging: Logs pipeline execution details for specific PowerShell modules.
  • GPO path: Computer Configuration\Administrative Templates\Administrative Templates\Windows Components\Windows PowerShell\Turn on Module Logging - Enable, and specify '*' for all modules.

These logs are found in the "Microsoft-Windows-PowerShell/Operational" event log.

Forward Security & PowerShell Logs to a SIEM

Local event logs are insufficient for long-term storage, correlation, and analysis. Configure Windows Event Forwarding (WEF) or use a SIEM agent to centralize Security (Event ID 4624, 4625, 4634, 4647, 4720, 4732, 4733, 4740, 4768, 4769, 4776, 5136, 5137), System, Application, and PowerShell logs to a Security Information and Event Management (SIEM) system.

# Example: Set up a subscription for Windows Event Collector (WEC) on a source server
# This assumes a Collector server (e.g., WECCONFIG.domain.com) is already configured.
# Run on the server to be monitored:
winrm quickconfig -q
winrm set winrm/config/client @{TrustedHosts="WECCONFIG.domain.com"}
wecutil ss "SubscriptionName" /f:true /c:"WECCONFIG.domain.com"
# Alternatively, deploy an agent (e.g., Splunk Universal Forwarder, Elastic Agent, Azure Monitor Agent)

Ensure the SIEM has appropriate parsers and correlation rules for Windows event data.

Maintenance and Oversight

Security is an ongoing process. Regular maintenance and auditing are crucial.

Schedule Monthly Patching and Quarterly Config Drift Checks

Establish a rigorous schedule for applying security updates. For most production servers, a monthly patching cycle is standard, following a test/dev deployment to catch potential regressions. Leverage WSUS, SCCM, or Azure Update Management. Additionally, perform quarterly configuration drift checks to ensure that hardening policies remain in effect and no unauthorized changes have occurred. Tools like Desired State Configuration (DSC), Microsoft Endpoint Configuration Manager (MECM), or third-party compliance tools can automate this.

# Example for DSC (Local Configuration Manager - LCM) to enforce a configuration
# Configuration defined in a .ps1 file (e.g., MyServerConfig.ps1)
# Push configuration to target server:
Start-DscConfiguration -Path "C:\DSCConfigs\MyServerConfig" -Wait -Verbose -Force

Regularly review audit logs for compliance and anomalous activity.

Common Pitfalls

• Over-hardening and Breaking Functionality: Aggressive firewall rules or GPO settings can inadvertently disable essential services. Test changes thoroughly in a staging environment before deploying to production.
• Neglecting Recovery Keys: Failing to securely store BitLocker recovery keys can lead to data loss if a TPM fails or a password is forgotten.
• Ignoring Application Requirements: Hardening should always be done with an understanding of the applications running on the server. Certain legacy applications might require SMBv1 or older TLS versions, necessitating specific exceptions or migration plans.
• Inadequate Monitoring: Implementing security features without forwarding logs to a central SIEM means blind spots and delayed incident response.
• "Set and Forget" Mentality: Security is not a one-time task. Regular patching, configuration reviews, and vulnerability assessments are vital for maintaining a strong security posture.