Windows Endpoint Hardening Guide: ASR Rules, Credential Guard, LAPS and Tamper Protection

Windows endpoints are routinely compromised through protections that were available but switched off, left in audit mode, or quietly undone by exclusions and shared local admin passwords. Windows 11 and Microsoft Defender ship with strong controls: attack surface reduction (ASR) rules, Credential Guard, LSA protection, memory integrity, exploit protection, tamper protection and Windows LAPS. The hard part is enabling them in the right order without breaking line-of-business applications, then proving they stay on. This guide gives the setting names, rule GUIDs, event IDs and rollout sequence for each control, with decision guidance for small and large estates. It is for endpoint engineers, security architects and SOC leads who own Windows hardening.

Key takeaways

• Start with credentials, not malware. Credential Guard, LSA protection, disabling WDigest and unique local admin passwords through Windows LAPS cut off the LSASS dumping and pass-the-hash techniques (T1003.001, T1550.002) that turn one infected laptop into a domain compromise.
• Put the three standard protection ASR rules straight into Block. Microsoft recommends Block for the vulnerable signed driver, LSASS credential stealing and WMI persistence rules without extensive testing; every other rule goes through Audit first.
• Tamper protection is what makes the rest stick. Without it, anyone with local admin can turn off real-time protection or add an exclusion.
• Exclusions quietly undo hardening. A folder exclusion covers every subfolder and file, and ASR, Defender Antivirus and controlled folder access each keep separate exclusion lists that need separate review.
• Measure the running state, not the policy. A policy assigned is not a control enforced: report where Credential Guard and memory integrity actually run, IsTamperProtected is true and ASR rules block.

What a hardened Windows endpoint looks like

Each layer closes a specific technique, and most depend on virtualisation-based security (VBS), Secure Boot and a TPM, so buy VBS-capable hardware.

Attack surface reduction rules

ASR rules are behaviour blocks inside Microsoft Defender Antivirus. They only work when Defender Antivirus is the primary antivirus in active mode with real-time protection and cloud-delivered protection on; in passive mode, including EDR in block mode, they do nothing. Rule modes are 0 Off, 1 Block, 2 Audit, 5 Not configured and 6 Warn. Warn lets a user unblock for 24 hours; from platform version 4.18.26060 that override needs administrator approval.

The other five (Adobe Reader child processes, Office creating executable content, Office communication app child processes, Safe Mode reboot, copied or impersonated system tools) follow the same path. The driver rule stops vulnerable signed drivers being written to disk but not drivers already present from loading.

• Intune: Endpoint security > Attack surface reduction > Create policy, profile Attack Surface Reduction Rules. Assign to device groups; user groups are not supported.
• Group Policy: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction > Configure Attack Surface Reduction rules.
• PowerShell: Add-MpPreference -AttackSurfaceReductionRules_Ids <GUID> -AttackSurfaceReductionRules_Actions AuditMode; Set-MpPreference overwrites all existing rules.
• Precedence: Group Policy wins over MDM for the same rule unless MDMWinsOverGP (ControlPolicyConflict CSP) is set to 1. Do not configure the same rule in both.

Protecting credentials on the endpoint

An attacker with local admin who can read LSASS memory (ProcDump, Mimikatz sekurlsa, or rundll32 calling comsvcs.dll MiniDump) gets reusable credentials for every account that signed in to the device.

Credential Guard

Credential Guard uses VBS to hold NTLM password hashes, Kerberos TGTs and application-stored domain credentials in an isolated process, LSAIso.exe, that malware running with administrative privileges cannot read. It is on by default from Windows 11 22H2 and Windows Server 2025 on eligible domain-joined, non-DC devices, but without UEFI lock, so it can be turned off remotely; the Intune security baseline sets Enabled with UEFI lock. It needs Windows Enterprise or Education licensing.

• What breaks: Kerberos DES, Kerberos unconstrained delegation, TGT extraction and NTLMv1. Digest, CredSSP, credential delegation and MS-CHAPv2 keep working but still expose credentials.
• Where not to use it: domain controllers and Exchange Server. It does not protect the SAM or the AD database, and VMs must be Hyper-V generation 2.

LSA protection

LSA protection runs LSASS as a protected process light so unprotected processes cannot read its memory or inject code. Set RunAsPPL under HKLM\SYSTEM\CurrentControlSet\Control\Lsa to 1 (with a UEFI variable) or 2 (without, Windows 11 22H2 and later), or use the policy Configures LSASS to run as a protected process under System > Local Security Authority (Intune OMA-URI ./Device/Vendor/MSFT/Policy/Config/LocalSecurityAuthority/ConfigureLsaProtectedProcess). It is on by default for new, enterprise-joined, HVCI-capable Windows 11 22H2 installs.

Plug-ins and drivers that fail Microsoft signing requirements will stop loading, so audit first: set AuditLevel = 8 under Image File Execution Options\LSASS.exe and review CodeIntegrity Operational events 3065 and 3066. Once enforced, WinInit event 12 in the System log confirms LSASS started as a protected process.

WDigest and legacy protocols

Set UseLogonCredential = 0 under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest so WDigest does not cache cleartext passwords in memory (CISA countermeasure CM0087; ATT&CK mitigation M1028). Treat NTLMv1 and unconstrained delegation as findings to remove, since Credential Guard breaks them anyway. See the Active Directory and Entra ID Hardening Guide.

Kernel and exploit mitigations

• Memory integrity: also called hypervisor-protected code integrity (HVCI), it runs kernel-mode code integrity inside VBS and protects the kernel CFG bitmap. Incompatible drivers can cause a boot failure; recovery is to remove the enabling policy, boot to Windows RE and set Enabled = 0 under HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity. With UEFI lock, recovery needs Secure Boot disabled, so pilot without lock.
• Exploit protection: the built-in successor to the retired Enhanced Mitigation Experience Toolkit (EMET). It applies per-application mitigations such as Data Execution Prevention (DEP), mandatory and bottom-up ASLR, Control Flow Guard (CFG), arbitrary code guard (ACG) and validate stack integrity (StackPivot). Several have no audit mode (CFG, mandatory ASLR, SEHOP, validate heap integrity), so test them on a pilot ring. Deploy as XML with Set-ProcessMitigation -PolicyFilePath, Group Policy or MDM. Removing the policy does not remove the settings it wrote, so keep a reset XML for rollback.
• Driver control: combine the ASR driver rule with the vulnerable driver block list and, for higher assurance, App Control for Business. Signed does not mean safe. See the Machine Identity, PKI and Certificate Lifecycle Guide.

Keeping protection on: tamper protection, exclusions and ransomware controls

Tamper protection locks real-time protection, behaviour monitoring, IOAV, cloud protection, security intelligence updates, automatic remediation, archive scanning and, where Intune or Configuration Manager alone manages exclusions, the exclusion list. Turn it on tenant-wide from the Defender portal, Intune or Configuration Manager. Group Policy changes to protected settings are then ignored, even when they appear to succeed; use troubleshooting mode for legitimate changes. Check state with Get-MpComputerStatus | Select-Object IsTamperProtected, RealTimeProtectionEnabled.

• Exclusion hygiene: a folder exclusion includes all subfolders and files; process exclusions cover files opened by the process, not the process itself, and apply only to real-time protection. Never exclude user-writable paths such as Downloads, Temp or a whole profile. Set HideExclusionsFromLocalAdmins so attackers cannot read the list.
• Separate lists: Defender Antivirus exclusions, ASR exclusions (AttackSurfaceReductionOnlyExclusions and per-rule exclusions) and controlled folder access allowed apps are distinct. Intune merges exclusions from all assigned policies into one superset, so one careless policy widens every device it targets.
• Controlled folder access: lets only trusted apps change files in protected folders (Documents, Pictures, Videos, Music, Favorites and boot sectors). Modes are 0 Disabled, 1 Block, 2 Audit, 3 Block disk modification only and 4 Audit disk modification only. Script engines such as PowerShell are not trusted even with an allow indicator. Audit it for a month before Block.
• BitLocker: use TPM plus PIN where the threat model includes stolen laptops (NCSC recommends it), and confirm recovery keys escrow to Entra ID or AD DS through Choose how BitLocker-protected operating system drives can be recovered.

Where identity fits: local administrators and Windows LAPS

Local administrator accounts are non-human in practice: nobody owns them, they rarely change, and an identical password across a fleet lets one dumped hash unlock every device. Windows LAPS, built into Windows and free, rotates a unique password per device and backs it up to Microsoft Entra ID or Active Directory (not both). Legacy Microsoft LAPS is deprecated; its emulation mode stores passwords in clear text in AD, so use it only during migration.

Limit who can read LAPS passwords (ADPasswordEncryptionPrincipal defaults to Domain Admins) and alert on retrievals. Service accounts that log on interactively to workstations still leave reusable credentials; restrict their logon rights. See the Service Account Security Guide and the Privileged Access Management Guide.

Baselines, firewall, UAC and SmartScreen

Deliver Microsoft's security baseline as the Intune security baseline (currently the Security Baseline for Windows, version 26H2) or as GPOs from the Security Compliance Toolkit. Treat CIS Benchmarks as a second opinion, not a second baseline to merge.

• Windows Firewall: the baseline enables Domain, Private and Public profiles, sets default inbound to Block, and sets the log size to 16,384 KB. Do not open inbound SMB (TCP 445) or RDP (TCP 3389) on workstations except from management hosts.
• User Account Control: keep Run all administrators in Admin Approval Mode and Switch to the secure desktop when prompting for elevation enabled (both default). Set Apply UAC restrictions to local accounts on network logons to Enabled, which stops local accounts being used with full rights over the network.
• SmartScreen and Defender cloud: the baseline sets SmartScreen to warn and prevent bypass, Cloud Block Level High, PUA protection on and network protection in block mode.
• Services: remove SMBv1 and disable services a device does not need, such as Print Spooler on servers that never print (CIS Safeguard 4.8).
• Standard users: provision non-administrative daily accounts, as the NCSC recommends.

Choosing and rolling out

Decision guidance

Small organisations without an endpoint team get most value from the Intune security baseline, tenant-wide tamper protection, Windows LAPS to Entra ID and the standard protection ASR rules, all of which need little tuning. Without E5-level licensing there is no central ASR report, so forward the Defender Operational log to your SIEM. Large organisations should run rule-by-rule audit analysis per business unit, keep per-rule exclusions in change control, and use controlled configuration so only Intune or Defender security settings management can set protected values.

Phased rollout without breaking things

1. Inventory and prerequisites: confirm edition (Enterprise or Education for Credential Guard), TPM 2.0, UEFI with Secure Boot, VBS capability and Defender Antivirus in active mode. Win32_DeviceGuard reports VirtualizationBasedSecurityStatus = 2 when VBS is running.
2. Quick wins in Block: enable tamper protection, the three standard protection ASR rules, WDigest off and Windows LAPS on an IT pilot ring, then broadly.
3. Audit everything else: set remaining ASR rules to Audit (2), LSA protection to audit (AuditLevel = 8) and controlled folder access to Audit (2) for 30 days.
4. Analyse and fix: group events 1122, 1124 and CodeIntegrity 3065/3066 by process and path. Fix the application first; add a narrow per-rule exclusion only when the vendor cannot.
5. Ring deployment: move to Block in rings (IT, early adopters, 10 percent, everyone), one rule at a time, a week between rings, with a named owner per rule.
6. Lock in: enable UEFI lock for Credential Guard and LSA protection after a clean ring; enable memory integrity on hardware models that passed the pilot.
7. Rollback plan: switch a rule back to Audit (2) rather than deleting the policy. LSA protection set with a UEFI variable needs the LsaPplConfig.efi opt-out tool; Not Configured does not undo it. Keep an exploit protection reset XML and WinRE steps for HVCI.

Detection and measurement

Alert on 5001, 5013 and any 5007 that adds an exclusion: someone is weakening defences. Defender for Endpoint advanced hunting exposes ASR action types such as AsrLsassCredentialTheftBlocked. Metrics that show it is working:

• ASR enforcement coverage: percentage of devices with each targeted rule in Block.
• Credential isolation coverage: percentage of eligible devices where Credential Guard and memory integrity are running (not just configured).
• Tamper protection coverage: percentage of devices reporting IsTamperProtected = true, target 100 percent.
• LAPS rotation health: percentage of devices whose local admin password was rotated within PasswordAgeDays.
• Exclusion debt: count of folder and process exclusions, and the share with an owner and review date.
• Audit-to-block time: median days a rule spends in Audit before Block; long tails mean audits nobody reads.

Framework mapping

Common failure patterns

• Audit mode forever: rules left in Audit "to be safe". Event 1122 later shows the rule would have stopped the attack.
• Third-party AV with Defender passive: the ASR policy shows as assigned, but nothing is enforced because Defender is not in active mode.
• Broad exclusions: excluding C:\Temp, a developer's whole profile or a software share to fix one false positive gives attackers a ready-made staging folder.
• Same local admin password everywhere: a gold image with a fixed local admin password and no LAPS lets one dumped hash move laterally across the fleet.
• Hardening the OS but not the browser: Credential Guard does not cover passwords saved in browsers or synced to personal profiles. In the Okta Support System Breach 2023 a service account credential was saved in a personal Google profile on a work device, and in the Cisco Breach 2022 a synced browser password started the intrusion. Block personal profile sign-in and password sync on managed browsers.
• Infostealers treated as a malware problem only: stolen cookies and saved passwords are identity incidents. In the Snowflake Breach 2024, credentials harvested by infostealers were used against accounts without MFA; rotate credentials and revoke sessions after any stealer detection. See the Token and Session Security Guide.

Practitioner checklist

• Confirm Defender Antivirus runs in active mode with real-time and cloud protection on.
• Enable tamper protection tenant-wide and alert on events 5001, 5013 and exclusion changes in 5007.
• Put the three standard protection ASR rules in Block now; audit the rest for 30 days, then promote in rings.
• Run Credential Guard and LSA protection on eligible clients (UEFI lock after a clean pilot) and set WDigest UseLogonCredential to 0.
• Enable memory integrity on validated hardware models, with documented WinRE recovery.
• Deploy Windows LAPS with post-authentication reset, restrict who can read passwords and retire legacy LAPS.
• Review every AV, ASR and controlled folder access exclusion; remove user-writable paths and hide exclusions from local admins.
• Apply the current Microsoft security baseline from one management plane only.
• Report running state monthly: ASR in Block, Credential Guard and HVCI running, IsTamperProtected true, LAPS rotation health.

Standards and references

• Microsoft Learn: Attack surface reduction rules reference
• Microsoft Learn: Credential Guard overview
• Microsoft Learn: Configure added LSA protection
• Microsoft Learn: Windows LAPS overview
• Microsoft Learn: Protect security settings with tamper protection
• Microsoft Learn: Enable memory integrity
• MITRE ATT&CK: OS Credential Dumping: LSASS Memory (T1003.001)
• NCSC: Device Security Guidance, Windows

Related NHI Mgmt Group resources: Active Directory and Entra ID Hardening Guide · Service Account Security Guide · Privileged Access Management Guide · ITDR Guide