Windows Server Core Hardening with CIS Benchmarks

CIS Benchmarks provide scored recommendations for Windows Server hardening. This guide applies Level 1 and Level 2 controls.

Account Policies via Group Policy

POWERSHELL

# Minimum password length: 14
Set-ADDefaultDomainPasswordPolicy -MinPasswordLength 14 -MaxPasswordAge (New-TimeSpan -Days 90) -LockoutThreshold 5 -LockoutDuration (New-TimeSpan -Minutes 30)

Audit Policy

POWERSHELL

# Enable advanced audit
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Account Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Privilege Use" /success:enable /failure:enable
auditpol /set /subcategory:"Process Creation" /success:enable
auditpol /set /subcategory:"Object Access" /failure:enable

Registry Hardening

POWERSHELL

# Disable SMBv1
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

# Disable LLMNR
Set-ItemProperty -Path "HKLM:SOFTWAREPoliciesMicrosoftWindows NTDNSClient" -Name EnableMulticast -Value 0

# Disable NetBIOS
$nics = Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled}
$nics | ForEach-Object { $_.SetTcpipNetbios(2) }

# Disable WPAD
Set-ItemProperty -Path "HKCU:SoftwareMicrosoftWindowsCurrentVersionInternet SettingsWpad" -Name WpadOverride -Value 1

Windows Firewall Baseline

POWERSHELL

# Enable all firewall profiles
Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True -DefaultInboundAction Block -DefaultOutboundAction Allow

# Allow management
New-NetFirewallRule -DisplayName "Allow RDP from Management" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 10.0.0.0/8 -Action Allow

Disable Unnecessary Services

POWERSHELL

$services = @(
    'XblAuthManager', 'XblGameSave', 'XboxNetApiSvc',
    'Fax', 'TabletInputService', 'WMPNetworkSvc',
    'lfsvc', 'MapsBroker', 'SharedAccess'
)
$services | ForEach-Object {
    Stop-Service $_ -ErrorAction SilentlyContinue
    Set-Service $_ -StartupType Disabled -ErrorAction SilentlyContinue
}

Microsoft Security Compliance Toolkit

Use SCT to apply and report on CIS/MSFT baselines:

POWERSHELL

# Apply security baseline
.Baseline-LocalInstall.ps1 -Win2022NonDomainJoined

# Check compliance
.Compare-GPOtoBaseline.ps1 -BaselineName "Windows Server 2022"