Every Windows Server deployment begins with Microsoft's default configuration — which prioritises compatibility over security. Before putting a server into production, these 18 hardening steps are non-negotiable for any organisation that values its data.
Critical First Steps (Do These Before Anything Else)
Disable SMBv1 Immediately
SMBv1 is the protocol behind WannaCry and NotPetya. It is disabled by default in Windows Server 2025 but verify it: Get-SmbServerConfiguration | Select EnableSMB1Protocol
Enable Windows Defender ATP
Windows Defender Advanced Threat Protection in Server 2025 is enterprise-grade EDR. Activate tamper protection in Group Policy under Computer Configuration → Administrative Templates → Windows Defender Antivirus.
Implement Tiered Administrative Model
Tier 0 (Domain Controllers), Tier 1 (Member Servers), Tier 2 (Workstations). Never use a Tier 0 account on a workstation. This single change stops 80% of pass-the-hash attacks cold.
Deploy Windows Firewall with Advanced Security
Create an inbound rule blocking all traffic except explicitly allowed ports. RDP (3389) should only be accessible from known management IPs — never open to the internet.
The Complete 18-Point Checklist
Need Expert Help With This?
Our certified engineers are available 24/7 to implement every step in this guide on your system — remotely and securely.