Lesson 7 — Windows Server Security

Windows Firewall with Advanced Security (wf.msc) is a stateful host firewall built into Windows Server. It controls network traffic at the OS level, independent of any perimeter firewall.

Three Firewall Profiles

# View firewall status on all profiles
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction

# Enable/disable all profiles
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

# --- Create Firewall Rules ---

# Allow a specific application (inbound)
New-NetFirewallRule -DisplayName "Allow MyApp Inbound" `
  -Direction Inbound -Program "C:\Apps\myapp.exe" -Action Allow -Profile Domain

# Allow a TCP port (inbound)
New-NetFirewallRule -DisplayName "Allow HTTPS Inbound" `
  -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow -Profile Domain,Private

# Block outbound to a specific IP (e.g., block access to known malicious IP)
New-NetFirewallRule -DisplayName "Block Malicious IP" `
  -Direction Outbound -RemoteAddress "10.99.99.99" -Action Block

# Allow RDP only from specific subnet
New-NetFirewallRule -DisplayName "RDP from Admin Network Only" `
  -Direction Inbound -Protocol TCP -LocalPort 3389 `
  -RemoteAddress "192.168.10.0/24" -Action Allow

# View existing rules
Get-NetFirewallRule | Where-Object {$_.Enabled -eq "True" -and $_.Direction -eq "Inbound"} |
  Select-Object DisplayName, Action, Profile | Sort-Object DisplayName

# Disable a rule (instead of deleting)
Disable-NetFirewallRule -DisplayName "Allow HTTPS Inbound"

# netsh commands (legacy but still useful in scripts)
netsh advfirewall show allprofiles
netsh advfirewall firewall add rule name="Allow SQL" protocol=TCP dir=in localport=1433 action=allow
netsh advfirewall export "C:\Firewall-Backup.wfw"   # Export all rules
netsh advfirewall import "C:\Firewall-Backup.wfw"   # Import rules

The Security event log is the most important log for detecting security incidents. Memorizing key Event IDs is essential for any Windows administrator.

Authentication Events

Account Management Events

Group Membership Events

Kerberos and System Events

# Query security events via PowerShell

# Find all failed logons in the last hour
$start = (Get-Date).AddHours(-1)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$start} |
  ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
      Time       = $_.TimeCreated
      Account    = $xml.Event.EventData.Data[5].'#text'
      Domain     = $xml.Event.EventData.Data[6].'#text'
      Source     = $xml.Event.EventData.Data[19].'#text'
      FailCode   = $xml.Event.EventData.Data[7].'#text'
    }
  } | Format-Table -AutoSize

# Alert: Someone added a member to Domain Admins
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4728} |
  Where-Object {$_.Message -like "*Domain Admins*"} |
  Select-Object TimeCreated, Message | Format-List

# CRITICAL: Check if audit log was cleared (Event ID 1102)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} |
  Select-Object TimeCreated, Message

# Check current audit policy
auditpol /get /category:*

# Set specific audit policies (run as admin)
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Account Logon" /success:enable /failure:enable
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable
auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable

# Export audit policy to a file (for backup/import to other servers)
auditpol /backup /file:C:\Audit-Policy-Backup.csv
auditpol /restore /file:C:\Audit-Policy-Backup.csv

# View advanced audit policy (more granular than basic)
# GPO: Computer Config → Policies → Windows Settings → Security Settings →
#      Advanced Audit Policy Configuration

# Check Windows Defender status
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntispywareEnabled, `
  AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated, `
  QuickScanAge, FullScanAge

# Update definitions
Update-MpSignature

# Run a quick scan
Start-MpScan -ScanType QuickScan

# Run a full scan
Start-MpScan -ScanType FullScan

# Scan a specific path
Start-MpScan -ScanType CustomScan -ScanPath "C:\Downloads"

# View recent threats detected
Get-MpThreatDetection | Select-Object ThreatID, Resources, ActionSuccess, InitialDetectionTime

# View threat history
Get-MpThreat | Select-Object ThreatName, SeverityID, IsActive, DetectionID

# Configure exclusions (e.g., exclude SQL Server data directory — database files)
Add-MpPreference -ExclusionPath "D:\SQLData"
Add-MpPreference -ExclusionProcess "sqlservr.exe"
Add-MpPreference -ExclusionExtension ".mdf"  # Be careful with file extension exclusions

# View current exclusions
Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess, ExclusionExtension

# Configure via GPO: Computer Config → Policies → Administrative Templates →
#   Windows Components → Microsoft Defender Antivirus

BitLocker encrypts the entire drive to protect data if the physical drive is stolen or the server is decommissioned without proper data wiping.

# Check BitLocker status on all drives
Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, ProtectionStatus, `
  EncryptionPercentage, KeyProtector

# Enable BitLocker on C: with TPM protector
Enable-BitLocker -MountPoint "C:" -TpmProtector

# Add a recovery key protector (numeric recovery password)
Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector

# Get the recovery password (SAVE THIS!)
(Get-BitLockerVolume "C:").KeyProtector | Where-Object {$_.KeyProtectorType -eq "RecoveryPassword"} |
  Select-Object KeyProtectorId, RecoveryPassword

# Backup recovery key to Active Directory (highly recommended)
Backup-BitLockerKeyProtector -MountPoint "C:" `
  -KeyProtectorId (Get-BitLockerVolume "C:").KeyProtector[1].KeyProtectorId

# Check if BitLocker key is stored in AD:
# In ADUC with Advanced Features → Computer object → BitLocker Recovery tab

# Encrypt an additional data drive (non-OS drive) with auto-unlock
Enable-BitLocker -MountPoint "D:" -RecoveryPasswordProtector
Enable-BitLockerAutoUnlock -MountPoint "D:"

# Suspend BitLocker temporarily (for BIOS update, etc.)
Suspend-BitLocker -MountPoint "C:" -RebootCount 1   # Re-enables after 1 reboot

# Disable BitLocker (decrypts drive — takes time)
Disable-BitLocker -MountPoint "C:"

Windows Server Update Services (WSUS)

WSUS lets administrators control which updates are downloaded, tested, and deployed to computers in the domain. This prevents uncontrolled updates from breaking production systems.

# Install WSUS role (needs sufficient disk space — minimum 30 GB recommended)
Install-WindowsFeature -Name UpdateServices, UpdateServices-WidDB, `
  UpdateServices-Services, UpdateServices-RSAT, UpdateServices-API, `
  UpdateServices-UI -IncludeManagementTools

# Initial WSUS configuration (run after install)
CD "C:\Program Files\Update Services\Tools"
.\wsusutil.exe postinstall CONTENT_DIR=D:\WSUS

# Configure clients to use WSUS via GPO:
# Computer Config → Policies → Administrative Templates → Windows Components → Windows Update
# "Specify intranet Microsoft update service location":
#   Set update service URL:    http://WSUS-SERVER:8530
#   Set statistics server URL: http://WSUS-SERVER:8530
# "Configure Automatic Updates": 4 = Auto download and schedule install
# "Automatic Updates detection frequency": 4 hours

# PowerShell: Check Windows Update status on a server
$wu = New-Object -ComObject "Microsoft.Update.Session"
$searcher = $wu.CreateUpdateSearcher()
$result = $searcher.Search("IsInstalled=0")  # Find uninstalled updates
$result.Updates | Select-Object Title, MsrcSeverity | Format-Table

# Force Windows Update check (client)
wuauclt /detectnow
wuauclt /reportnow

# Get update history (last 20 updates installed)
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 20 |
  Select-Object HotFixID, Description, InstalledOn

# Open Local Security Policy (member server without domain, or for local settings)
secpol.msc

# Key Security Options (Computer Config → Windows Settings → Security Settings → Local Policies → Security Options):
# Interactive logon: Do not display last user name = Enabled  (don't show who logged in last)
# Interactive logon: Machine inactivity limit = 900 seconds   (lock after 15 min idle)
# Network access: Do not allow anonymous enumeration of SAM accounts = Enabled
# Network security: LAN Manager authentication level = Send NTLMv2 only (disable LM/NTLM)
# Accounts: Rename administrator account = (change from "Administrator" to something else)
# Accounts: Rename guest account = (then disable Guest)

# UAC (User Account Control) levels:
# Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
# ConsentPromptBehaviorAdmin:
#   0 = No prompt (always elevated — NOT RECOMMENDED)
#   1 = Prompt for credentials on secure desktop
#   2 = Prompt for consent on secure desktop (default for Admins)
#   5 = Prompt for consent for non-Windows binaries

# Check UAC level via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" |
  Select-Object EnableLUA, ConsentPromptBehaviorAdmin, ConsentPromptBehaviorUser

# Ensure UAC is enabled:
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" `
  -Name EnableLUA -Value 1

These are Virtualization-Based Security (VBS) features that use Hyper-V technology to isolate sensitive OS processes.

# Enable Credential Guard via registry (Server 2016/2019/2022)
# OR via GPO: Computer Config → Policies → Administrative Templates →
#   System → Device Guard → Turn On Virtualization Based Security
#   Credential Guard Configuration: Enabled with UEFI lock

# Verify Credential Guard status
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object VirtualizationBasedSecurityStatus, SecurityFeaturesRunning

# Status values:
# 0 = Not running
# 1 = Running (look for "CredentialGuard" in SecurityFeaturesRunning)

The Security Compliance Toolkit (successor to MBSA) is a free Microsoft tool providing security baselines — pre-configured GPO settings aligned with CIS Benchmarks and Microsoft hardening guidance.

• Download: microsoft.com/en-us/download/details.aspx?id=55319
• Includes baselines for: Windows Server 2022, 2019, 2016, Windows 11, Windows 10, Microsoft 365 Apps, Edge, Defender
• Policy Analyzer: Compare your current GPO settings against the baseline and highlight differences
• LGPO.exe: Command-line tool to apply/export local group policy

# Import Security Baseline GPOs into your domain (from SCT download):
# 1. Extract the baseline zip
# 2. Run the "Baseline-ADImport.ps1" script from the Scripts folder
# 3. The script imports baseline GPOs into your domain
# 4. Link them to appropriate OUs (test first!)

# Use Policy Analyzer to compare settings:
PolicyAnalyzer.exe
# File → Add Files to Compare → add your current GPO backup vs baseline XML

# Quick hardening commands — run on every new server

# Disable SMBv1 (forever)
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

# Enable SMB signing (required — prevents man-in-the-middle)
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force
Set-SmbClientConfiguration -RequireSecuritySignature $true -Force

# Disable NetBIOS over TCP/IP on all adapters (reduces attack surface)
$adapters = Get-WmiObject Win32_NetworkAdapterConfiguration -Filter "IPEnabled=True"
$adapters | ForEach-Object { $_.SetTcpipNetbios(2) }  # 2 = Disable NetBIOS

# Disable LLMNR (Link-Local Multicast Name Resolution — used in Responder attacks)
# Via GPO: Computer Config → Admin Templates → Network → DNS Client
# "Turn off multicast name resolution" → Enabled
# Via registry:
New-Item "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Force
Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" `
  -Name EnableMulticast -Value 0

# Ensure TLS 1.0 and 1.1 are disabled (use TLS 1.2+ only)
# Use IIS Crypto tool (GUI) or manually via registry:
# HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
# Enabled = 0, DisabledByDefault = 1