Windows Hardening

Scope

What this is: Securing Windows systems through Group Policy, Windows Firewall, service hardening, and registry configuration.

Competition relevance: Infrastructure hardening, alongside Linux hardening.

Why it matters: Windows hardening tasks test both GUI and PowerShell skills. High marks for correct configuration without breaking functionality.

WSOS 2026 alignment: This topic directly supports Section 4: Secure systems operation and maintenance (system configuration and management) and Section 5: Secure systems protection and defence (implementing security controls). Demonstrates proficiency in Windows security baseline configuration.

Competition area: Core to the infrastructure hardening area, focusing on Windows server/workstation hardening in enterprise environments.

Offline competence: Use built-in Windows help (Get-Help in PowerShell, netsh /? for firewall), Microsoft offline documentation (downloadable via Zeal), and pre-prepared Group Policy reference guides. Many Windows security settings are discoverable via gpedit.msc exploration.

---

Competency Matrix

Level	Expectation
Regional	Windows Firewall rules (inbound/outbound). Disable Guest account. User Account Control (UAC) settings. Service hardening (disable unnecessary services).
National	Group Policy Objects (GPOs) for security baselines. Advanced firewall with IPsec. Registry hardening. Audit policy configuration.
Squad/Team Selection	Domain-level GPO deployment. AppLocker/WDAC policies. Advanced persistent threat (APT) mitigation configurations.
International	Just-Enough-Administration (JEA). Credential Guard. Attack Surface Reduction (ASR) rules. Zero-trust architecture.

---

Technical Content

Windows Firewall Rules

GUI method (regional):

1. Open Windows Defender Firewall with Advanced Security
2. Inbound Rules → New Rule
3. Select Port / Program / Predefined
4. Specify port number or executable path
5. Action: Allow/Block
6. Profile: Domain/Private/Public (or all)
7. Name and description

PowerShell method (faster, national+):

# View existing rules
Get-NetFirewallRule | Where-Object {$_.Enabled -eq 'True'}

# Create inbound rule to allow RDP
New-NetFirewallRule -DisplayName "Allow RDP" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow

# Block outbound SMB
New-NetFirewallRule -DisplayName "Block SMB Out" -Direction Outbound -Protocol TCP -LocalPort 445 -Action Block

# Enable/disable rules
Enable-NetFirewallRule -DisplayName "Allow RDP"
Disable-NetFirewallRule -DisplayName "File and Printer Sharing"

# Remove rule
Remove-NetFirewallRule -DisplayName "Allow RDP"

Common competition scenarios:

• Allow RDP (3389) from management subnet only
• Block SMB (445) outbound to prevent lateral movement
• Allow HTTP/HTTPS inbound for web servers
• Block all inbound except explicitly allowed (implicit deny)

Competition context: Screenshot rule details before/after. Test connectivity after rule creation. Export firewall config for backup.

---

Service Hardening

Identify and disable unnecessary services:

# List running services
Get-Service | Where-Object {$_.Status -eq 'Running'}

# Stop and disable service
Stop-Service -Name "Telnet"
Set-Service -Name "Telnet" -StartupType Disabled

# Common insecure services to disable:
# - Telnet
# - FTP (if not required)
# - Remote Registry
# - Server (if not file server)
# - Print Spooler (if not print server)

GUI method:

1. services.msc
2. Right-click service → Properties
3. Startup type: Disabled
4. Service status: Stopped

Competition context: Disable services that are clearly insecure. Don’t disable services required for the system to function (e.g., Windows Update, DNS Client).

---

User Account Management

Disable Guest account:

# Disable Guest
Disable-LocalUser -Name "Guest"

# Verify
Get-LocalUser | Where-Object {$_.Name -eq "Guest"}

Password policies:

# View current policy
net accounts

# Set password policy (domain)
# Use Group Policy Editor: gpedit.msc
# Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy

Local Security Policy settings (secpol.msc):

• Minimum password length: 12 characters
• Password complexity: Enabled
• Account lockout threshold: 3 invalid attempts
• Account lockout duration: 30 minutes

---

Group Policy Security

Local Group Policy (gpedit.msc):

Essential security settings:

1. Password Policy:

   • Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy
   • Minimum password length: 12
   • Password complexity requirements: Enabled
   • Maximum password age: 90 days

2. User Rights Assignment:

   • Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment
   • Deny log on locally: Guest
   • Deny access to this computer from the network: Guest

3. Security Options:

   • Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
   • Accounts: Limit local account use of blank passwords to console logon only: Enabled
   • Interactive logon: Do not display last user name: Enabled
   • Network security: LAN Manager authentication level: Send NTLMv2 response only

Apply Group Policy:

# Force update
gpupdate /force

# View applied policies
gpresult /r

# Generate HTML report
gpresult /h C:\gpreport.html

Competition context: GPO tasks appear at national+. Screenshot policy settings before/after. Run gpresult to prove policy applied.

---

Registry Hardening

Common competition registry changes:

1. Disable SMBv1 (security risk):

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name "SMB1" -Value 0 -Type DWord

2. Disable AutoRun/AutoPlay:

Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun" -Value 255 -Type DWord

3. Enable LSA Protection:

New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL" -Value 1 -PropertyType DWord -Force

Competition context: Registry changes usually provided in task spec. Take registry export before changes:

reg export HKLM\SYSTEM\CurrentControlSet\Services backup.reg

---

Audit Policy

Configure auditing (national+):

# Enable audit policy via auditpol
auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
auditpol /set /category:"Account Logon" /success:enable /failure:enable
auditpol /set /category:"Object Access" /success:enable /failure:enable

# View current policy
auditpol /get /category:*

# Advanced audit policy (Group Policy)
# Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration

Competition context: Auditing is what makes later forensics possible. Screenshot auditpol output before/after.

---

Competition Strategy & Marking

What gets marked:

• Firewall rules created correctly (netsh/PowerShell export)
• Services disabled (Get-Service output)
• Group Policy settings applied (gpresult /r)
• User accounts secured (Get-LocalUser output)

Evidence and reporting requirements:

• Screenshots of firewall rule details (via GUI or Get-NetFirewallRule output)
• Before/after service status (Get-Service output showing StartType and Status)
• GPO applied confirmation (gpresult /r or HTML report)
• Registry backups before changes (reg export commands and output files)
• PowerShell command history showing exact commands used (Get-History)
• Test results proving services still function after hardening
• Clear file naming: hostname_firewall_before.png, hostname_gpo_after.png
• Written summary of changes and security justification

Time allocation:

• Firewall configuration: 15-20 minutes
• Service hardening: 10-15 minutes
• User account lockdown: 5-10 minutes
• Group Policy (national+): 15-25 minutes

Common marking criteria:

• Functionality preserved: 50%
• All requirements met: 30%
• Documentation quality: 20%

Time-boxed drill suggestion: 90-minute Windows hardening grind: Given a Windows Server VM, create firewall rules to allow RDP from management subnet only, disable Telnet and Remote Registry services, configure password policy (12 char minimum, complexity enabled), disable Guest account, apply GPO for security options (NTLMv2 only, disable SMBv1), enable audit logging, and document all changes. Reboot and verify all settings persist.

---

False Flags / Wrong Paths

Common Traps

Disabling critical services Disabling Windows Update, DNS Client, or Workstation service will break functionality. Only disable clearly insecure services.

Firewall rules in wrong profile If rule is created for “Domain” profile but system uses “Private,” rule won’t apply. Use “Any” or correct profile.

Group Policy not applying Run gpupdate /force after changes. If still not applying, check gpresult /r for errors.

Breaking RDP access If you block RDP before allowing it from specific subnet, you’ll lock yourself out. Always allow before deny.

---

Practice Checklist

• Can create Windows Firewall rules via GUI and PowerShell
• Can disable insecure services (Telnet, Remote Registry)
• Can configure password policy via Local Security Policy
• Can disable Guest account and enforce account lockout policy
• Understand Group Policy basics (password, user rights, security options)
• Can apply GPO and verify with gpresult
• Can make registry changes safely (with backups)
• Can configure audit policy for security events
• Can produce competition-compliant screenshots
• Can verify hardening persists after reboot

---

References

• Regional Roadmap: Infrastructure hardening
• National Roadmap: Infrastructure hardening
• Cheat Sheet: Windows Hardening Checklist (planned)