Windows Server Hardening Guide: Baselines, Roles and Attack Surface Reduction

Most Windows Server compromises do not need a zero-day: they use a service nobody needed, a legacy protocol nobody turned off, or an administrator credential left behind on a server that was never hardened. This guide covers how to harden Windows Server 2019, 2022 and 2025 member servers and role servers from a recognised baseline: choosing and applying a baseline, cutting the installed footprint, hardening protocols and remote administration, protecting credentials, and role-specific settings. It also covers rollout with audit-first testing, detection and the measures that show the work is holding. It is written for Windows infrastructure engineers, security architects and auditors. Domain controller and directory hardening has its own page, and workstation hardening is covered in the Windows Endpoint Hardening Guide; this page links to both rather than repeating them.

Key takeaways

• Start from a published baseline, then tailor by role. The Microsoft security baselines, OSConfig scenarios for Windows Server 2025 and the CIS Microsoft Windows Server Benchmarks give you hundreds of reviewed settings; your job is the documented exceptions, not reinventing them.
• Less installed means less to defend. Server Core, removing unused roles and features, and disabling services such as Print Spooler where they are not needed remove whole classes of exposure, including ones later found in the CISA Known Exploited Vulnerabilities catalogue.
• Legacy protocols are the soft middle. SMBv1, unsigned SMB and LDAP, NTLM and internet-exposed RDP are still the routes attackers use to relay, harvest and move laterally.
• Servers are where privileged credentials sit. Credential Guard, LSA protection, Windows LAPS, Restricted Admin or Remote Credential Guard for RDP and a tiered admin model decide whether one compromised server becomes a domain compromise.
• Hardening that is not measured drifts. Use drift control or compliance scanning, track baseline compliance and exceptions per role, and alert on the events that show settings being undone.

Choosing a baseline

Microsoft describes its security baselines as groups of Microsoft-recommended configuration settings with an explanation of their security impact, and recommends using a well-tested baseline rather than building your own. A Windows Server build has thousands of Group Policy settings; only a fraction are security relevant, and working out each value yourself is slow and error prone. In practice teams choose one primary source, keep a second for cross-checking, and record every deviation.

For Windows Server 2025, OSConfig exposes the baseline as named scenarios: SecurityBaseline/WindowsServer/2025/MemberServer, SecurityBaseline/WindowsServer/2025/DomainController and SecurityBaseline/WindowsServer/2025/WorkgroupMember, plus SecuredCore, Defender/Antivirus/WindowsServer/2025 and LAPS/WindowsServer/2025/MemberServer. They are applied with Set-OSConfigDesiredConfiguration -Scenario <name> -Default, individual settings can be overridden with -Setting and -Value, and a restart is needed after applying. Drift control uses a refresh task to put back settings that have been changed, and Microsoft documents a precedence order where Azure Policy beats local configuration, which beats any other deployment tool. Decide which tool is authoritative before you switch it on, or Group Policy and OSConfig will fight.

• Small estates: apply the Microsoft baseline GPOs, add a handful of role GPOs and use the Policy Analyzer in the toolkit to compare what is applied against the baseline.
• Large or audited estates: pick CIS Level 1 (member server or domain controller profile) as the audit yardstick, implement it through Microsoft baseline GPOs plus a delta GPO, and keep an exceptions register mapped to each failed check.
• Hybrid and Azure Arc estates on Windows Server 2025: OSConfig with Azure Policy gives continuous enforcement and reporting without depending on Group Policy reaching the server.

Group Policy remains the delivery mechanism for most domain-joined servers, so securing it matters as much as the settings it carries. See the Group Policy Security Guide.

Reducing the installed footprint

Every role, feature and running service is code that can be attacked and must be patched. Reduce it before tuning anything else.

• Server Core by default: Microsoft describes Server Core as having a smaller disk footprint and smaller code base, which reduces the attack surface. It has no desktop shell, Explorer, Edge or Server Manager locally; administration happens through PowerShell, RSAT and Windows Admin Center from a privileged access workstation. Use Desktop Experience only for workloads that genuinely require it, and record why.
• One role per server: do not co-locate a web application with file shares, a certificate authority or a sync service. Mixed roles make the tier of the server ambiguous and the baseline a compromise.
• Remove, do not just stop: uninstall unused roles and features with Uninstall-WindowsFeature so they are not re-enabled or patched needlessly. Review the installed list at build and quarterly.
• SMBv1: the SMB1Protocol feature is not installed by default on Windows Server 2019 and later. Where it still exists on older builds, turn on Set-SmbServerConfiguration -AuditSmb1Access $true, watch for event 3000 in Microsoft-Windows-SMBServer/Audit, then remove the feature. CVE-2017-0144, the SMBv1 flaw used by WannaCry-era worms, is in the CISA KEV catalogue with known ransomware use.
• Print Spooler: Microsoft's service guidance says the spooler is OK to disable if the server is not a print server or a domain controller, and notes that print pruning needs the spooler running on at least one DC per site. The PrintNightmare flaw (CVE-2021-34527) is a KEV entry with known ransomware use. See the Printer and Print Spooler Security Guide.
• Other services: the same Microsoft page lists consumer services that are safe to disable on servers, such as Bluetooth Support, Downloaded Maps Manager, Geolocation and the Xbox services. These are low risk but reduce noise in audits.

Protocols and remote administration

Microsoft recommends keeping NLA enabled and not exposing Remote Desktop directly to the internet. CVE-2019-0708 (BlueKeep) is a pre-authentication RDP flaw in the KEV catalogue, and exposed RDP remains a leading ransomware entry route; see the Top 10 Ransomware Initial Access Vectors. Relay attacks against SMB and LDAP (ATT&CK T1557.001, Name Resolution Poisoning and SMB Relay) are blocked by signing, so plan the signing rollout together with NTLM reduction. See the SMB Signing Guide and NTLM Relay Guide.

Where identity fits: credentials on servers

Servers are where service accounts run and where administrators log on, so credential exposure on a member server is the usual step from foothold to domain. Credential theft from LSASS (T1003.001) and use of valid domain accounts (T1078.002) are the techniques this section blocks.

• Credential Guard: on Windows Server 2025 it is enabled by default when the server meets licensing and hardware requirements, is domain joined, is not a domain controller and has not been explicitly configured to disable it. The default is without UEFI lock. It isolates NTLM hashes, Kerberos TGTs and stored domain credentials in a virtualisation-based security container. Microsoft does not recommend it on domain controllers, and it does not protect the AD database or the SAM. On 2019 and 2022, enable it through the baseline where hardware allows.
• LSA protection: run LSASS as a protected process (RunAsPPL under HKLM\SYSTEM\CurrentControlSet\Control\Lsa) after auditing for drivers and plug-ins that fail to load.
• Local administrator passwords: unique, rotated passwords through Windows LAPS; OSConfig ships a LAPS scenario for member servers. See the Local Administrator Password Solution (LAPS) Guide.
• Admin logons: use Restricted Admin or Remote Credential Guard so reusable credentials are not left on the target, put human administrators in Protected Users (never service or computer accounts, which then fail to authenticate) and enforce logon restrictions by tier. See the Tiered Administration and Enterprise Access Model Guide.
• Service accounts: replace domain user service accounts with group managed service accounts where the application supports them, deny interactive and RDP logon, and remove them from local Administrators unless proven necessary. Server-side secrets such as ASP.NET machine keys, certificate private keys and sync account credentials are non-human identities and need owners and rotation.

Platform protections: Secured-core and code integrity

Microsoft's Secured-core server definition groups hardware, firmware and OS protections in three pillars: a hardware root of trust (Secure Boot, TPM 2.0, Boot DMA protection), defence against firmware attacks (System Guard Secure Launch using DRTM, from Windows Server 2022) and protection against unverified code (virtualisation-based security and Hypervisor-protected Code Integrity, also called memory integrity). Buy certified hardware for new tier 0 and tier 1 hosts, enable the features in the baseline, and confirm HVCI driver compatibility on a pilot before broad rollout. For application control, App Control for Business (formerly WDAC) policies in audit mode first are well suited to servers because the software set is small and stable.

Role-specific hardening

Rolling it out

1. Inventory and tier: list every server with its role, operating system version, owner and tier. Servers you cannot classify are your first finding.
2. Choose the baseline and the authoritative tool: Group Policy, OSConfig, Configuration Manager or Azure Policy. One tool owns each setting.
3. Audit before enforcing: enable SMBv1 access auditing, NTLM auditing, LDAP interface event logging (16 LDAP Interface Events set to 2) and App Control audit mode, and collect for at least one full business cycle including month-end.
4. Pilot ring: apply the baseline to a small set per role, including one server per application team, with a named rollback owner.
5. Broad rings by role and tier: roll out in waves, lowest risk roles first and tier 0 last but with the strictest settings. Use separate role GPOs so a problem in one role does not force a rollback for all.
6. Rollback: keep the previous GPO backup or OSConfig scenario version, and know that removing an OSConfig baseline does not restore prior values, so record the pre-change state for settings you may need to revert.
7. Bake into the build: apply the baseline in the image or deployment pipeline so new servers start compliant, then enforce drift control.

Detection and measurement

Forward these to your SIEM and see the Windows Event Log Guide for audit policy. Measures that show hardening is working:

• Baseline compliance: percentage of servers passing the chosen baseline per role and tier (target 95 percent or better, tier 0 at 100 percent with documented exceptions).
• Exceptions: number of open baseline exceptions and how many are past their review date.
• Legacy protocols: count of hosts with SMBv1 installed and weekly volume of NTLM and unsigned LDAP authentications, trending to zero.
• Footprint: share of servers on Server Core and servers running Print Spooler without a print role.
• Credential exposure: servers without Credential Guard or LSA protection where hardware supports it, and LAPS coverage of member servers.
• Drift: number of settings corrected by drift control or flagged by compliance scans per month, by setting.

Framework mapping

Common failure patterns

• Baseline applied to workstations only: servers built years ago from a gold image that predates the baseline, never revisited because "they are behind the firewall".
• Exceptions that never close: one application needed NTLM or SMBv1 in 2019, so the setting was relaxed for the whole server OU and is still relaxed.
• Tier 0 servers treated as ordinary member servers: sync, federation and certificate servers managed by the general server team with general admin accounts, as the Storm-0501 attacks exploited.
• Patching without cleaning up: the vulnerability is patched but secrets stolen before the patch are left valid, as in the ToolShell SharePoint exploitation. Rotate keys and credentials on any server that may have been breached.
• Two tools fighting: Group Policy sets one value, OSConfig or a configuration management agent sets another, and compliance reports flap. Assign one owner per setting.
• Security agents excluded into uselessness: broad antivirus exclusions on database and Exchange servers copied from old vendor advice, giving attackers a safe folder.

Practitioner checklist

• Pick a primary baseline (Microsoft, OSConfig or CIS) and one authoritative tool per setting, and record it.
• Inventory every server with role, owner and tier; treat sync, federation, PKI and DCs as tier 0.
• Default new builds to Server Core and one role per server; remove unused roles and features.
• Remove SMBv1, require SMB and LDAP signing, audit then restrict NTLM.
• Disable Print Spooler where the server is neither a print server nor a DC needed for print pruning.
• Close RDP to the internet, require NLA, and use Restricted Admin or Remote Credential Guard from privileged workstations.
• Confirm Credential Guard and LSA protection on member servers, and Windows LAPS coverage.
• Roll out audit first, then pilot, then rings by role, with GPO backups for rollback.
• Forward the key events to the SIEM and report baseline compliance, exceptions and legacy protocol use monthly.

Standards and references

• Microsoft Learn: Windows security baselines
• Microsoft Learn: Deploy security baselines with OSConfig
• Microsoft Learn: Secured-core server
• Microsoft Learn: Credential Guard overview
• Microsoft Learn: Guidance on disabling system services on Windows Server
• CIS: Microsoft Windows Server Benchmarks
• NIST: SP 800-53 Rev. 5
• CISA: Known Exploited Vulnerabilities Catalog

Related NHI Mgmt Group resources: Windows Endpoint Hardening Guide · Linux Server Hardening Guide · Tiered Administration and Enterprise Access Model Guide · Group Policy Security Guide · Patch Management Guide