A domain controller is the keys to the kingdom. Anyone who fully controls a DC controls every account, every group, and every machine that trusts the domain. That’s why hardening Windows Server in an Active Directory environment isn’t a one-time tickbox exercise — it’s a set of defaults you apply to every server and keep applying as the estate grows.
This checklist focuses on the controls that actually change an attacker’s odds: staying patched, killing off legacy protocols, locking down remote access, separating privilege so a workstation compromise doesn’t become a domain compromise, and logging enough to know when something’s wrong. None of it is exotic. Most of it is free and built into Windows. The hard part is doing it consistently.
Work through the sections in order. The early ones — patching and protocol cleanup — give you the biggest risk reduction for the least effort, so start there even if you can’t do everything at once.
1. Patch reliably, not occasionally
Most domains that get breached aren’t taken down by a zero-day. They’re taken down by a vulnerability that was patched months earlier, on a server nobody got around to updating. Patching is unglamorous and it’s the highest-value control you have.
- Patch domain controllers on a predictable schedule, after testing on a non-production DC where possible.
- Don’t let member servers drift. A forgotten print server or old application box is a perfectly good foothold.
- Track which servers are actually receiving updates, rather than assuming WSUS or your patch tool reached all of them.
# Quick check: when did this server last install updates?
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 102. Remove SMBv1 and other legacy protocols
SMBv1 is the protocol behind some of the most damaging worms of the last decade. Windows Server 2019 and 2022 don’t install it by default, but domains upgraded from 2012 R2 or earlier often still carry it, and the odd legacy scanner or NAS keeps it alive.
Check whether it’s present, then remove it:
# Is SMBv1 installed?
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
# Remove the SMBv1 feature (reboot required)
Disable-WindowsOptionalFeature -Online -FeatureName SMB1ProtocolA few other legacy items are worth disabling once you’ve confirmed nothing depends on them:
Legacy protocols to retire
| SMBv1 | Disable the feature entirely; modern clients use SMBv2/3. |
|---|---|
| NTLMv1 / LM | Set LmCompatibilityLevel to refuse LM and NTLMv1; require NTLMv2 at minimum. |
| LLMNR / NBT-NS | Disable via GPO to cut off a common credential-spoofing path. |
| TLS 1.0 / 1.1 | Disable on servers that host services; require TLS 1.2 or higher. |
3. Lock down RDP
Remote Desktop is how most admins reach servers, which makes it a top target. The goal is to keep it usable for you and useless to everyone else.
- Require Network Level Authentication (NLA) so a session needs valid credentials before the full RDP stack is exposed.
- Restrict who can RDP at all. Limit it to a dedicated admin group, not “Domain Admins logs on everywhere.”
- Use the host firewall to allow RDP only from specific management hosts or a jump server.
- Never expose RDP (TCP 3389) to the internet. If remote access is needed, put it behind a VPN or a gateway.
# Require Network Level Authentication for RDP
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" `
-Name "UserAuthentication" -Value 1
# Restrict RDP firewall rule to a specific management subnet
Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 10.0.50.0/244. Set a sane account lockout and password policy
Lockout policy is your basic defense against password guessing and spraying. The aim is to slow attackers without locking out your own users constantly.
Reasonable account lockout baseline
| Account lockout threshold | 10 invalid attempts (low enough to stop spraying, high enough to avoid noise) |
|---|---|
| Lockout duration | 15–30 minutes, or admin-reset for higher security |
| Reset counter after | 15 minutes |
| Minimum password length | 14+ characters for users; longer for admin and service accounts |
These are set in the Default Domain Policy (or a dedicated GPO) under Account Policies. When accounts do lock out, you’ll want a fast way to find the source — see how to find locked-out user accounts in Active Directory.
5. Enforce least privilege and tiering
This is the control that turns a single compromised machine into a contained incident instead of a domain-wide disaster. The principle is simple: high-privilege credentials should never be exposed on low-trust systems.
Microsoft’s tiered model splits the estate into three layers:
The administrative tier model
| Tier 0 | Domain controllers, AD, PKI, and anything that controls identity. Most sensitive. |
|---|---|
| Tier 1 | Member servers and the applications/data they host. |
| Tier 2 | User workstations and standard endpoints. |
The rule that makes it work: a Tier 0 account (like a domain admin) never logs on to a Tier 1 or Tier 2 machine, because doing so leaves its credentials in memory where an attacker on that lower tier can steal them. Each tier gets its own dedicated admin accounts.
Alongside tiering, apply everyday least-privilege hygiene:
Least-privilege essentials
- Separate admin accounts from day-to-day user accounts (no email/browsing on admin accounts)
- Keep Domain Admins and Enterprise Admins as small as possible
- Use the Protected Users group for sensitive admin accounts
- Give service accounts only the rights they need; prefer group Managed Service Accounts (gMSA)
- Remove standing local admin rights on workstations where you can
- Review privileged group membership on a schedule, not just when something breaks
6. Turn on meaningful audit logging
You can’t respond to what you can’t see. The default logging on Windows is thin, so configure the Advanced Audit Policy through Group Policy and make sure the events that matter are captured.
Key categories to enable on domain controllers:
- Account Logon (Kerberos and NTLM authentication)
- Logon/Logoff (interactive and network logons)
- Account Management (user/group changes)
- Directory Service Changes (modifications to AD objects)
- Account Lockout — event ID 4740 lands on the PDC Emulator and tells you which account locked and from where.
# View the current advanced audit policy settings
auditpol /get /category:*7. Use the host firewall to limit lateral movement
The perimeter firewall does nothing about traffic between two servers inside your network, and that internal traffic is exactly how attackers move from their first foothold to a domain controller. Windows Defender Firewall on each host narrows those paths.
- Leave the firewall on for all profiles. Don’t disable it “to make things work.”
- Restrict sensitive inbound ports (RDP 3389, SMB 445, WinRM 5985/5986) to known management subnets or jump hosts.
- Block server-to-server traffic that has no business reason to exist.
# Make sure the firewall is enabled on every profile
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True
# Limit WinRM (remote management) to an admin subnet
Set-NetFirewallRule -Name "WINRM-HTTP-In-TCP" -RemoteAddress 10.0.50.0/24Hardening checklist summary
Use this as the pass/fail list when you build a new server or review an existing one.
Windows Server hardening checklist
- OS fully patched, on a tested schedule, with reboots completed
- SMBv1 removed; NTLMv1/LM, LLMNR, and old TLS disabled after auditing
- RDP requires NLA, restricted to admin hosts, never internet-facing
- Account lockout and strong password policy enforced via GPO
- Tiered admin model: Tier 0 credentials never touch lower tiers
- Domain Admins/Enterprise Admins kept minimal; LAPS for local admin
- Advanced audit policy enabled; 4740 and account management logged
- Security logs forwarded to a central collector / SIEM
- Defender Firewall on; RDP/SMB/WinRM limited to management subnets
- Regular system state backups exist and have been test-restored
Wrapping up
Hardening a Windows Server estate isn’t about chasing every obscure registry tweak. It’s about getting the high-impact controls right and keeping them right: patch on a schedule, retire legacy protocols, lock down RDP, separate privilege so one bad workstation doesn’t hand over the domain, log enough to investigate, and use the host firewall to choke off lateral movement.
If you only have time for three things this week, do patching, SMBv1 removal, and tiering of your admin accounts. Pair this with a solid recovery plan — back up and restore Active Directory using system state — so that even a worst-case day has a clear way back.
