Comprehensive Windows Hardening & Credential Protection Guide - ToddMaxey/Technical-Documentation GitHub Wiki

Comprehensive Windows Hardening & Credential Protection Guide

1. Disable or Minimize Password Caching

Why It Matters

By default, Windows caches domain credentials locally, allowing domain users to log on if the domain controller (DC) is unavailable. However, if an attacker compromises the system, they can potentially extract these cached credentials, enabling lateral movement or privilege escalation in the domain.

Implementation Steps

Group Policy (Recommended for Domain Environments)

  1. Open Group Policy Management Console (gpmc.msc) on a domain controller or an admin workstation.
  2. Create or edit a GPO linked to the organizational unit (OU) or domain you want to secure.
  3. Navigate to: 
    Computer Configuration
  → Windows Settings
    → Security Settings
      → Local Policies
        → Security Options
  4. Find Interactive logon: Number of previous logons to cache (in case domain controller is not available).
  5. Double-click to open, set Value to 0, click OK.
  6. Close the GPO and run gpupdate /force (optional immediate refresh) on the target machines.

Local Security Policy (Standalone or Single Machine)

  1. Launch secpol.msc.
  2. Expand: 
    Security Settings
  → Local Policies
    → Security Options
  3. Locate the same policy Interactive logon: Number of previous logons to cache, set it to 0.
  4. Reboot or log off to confirm changes.

Registry (Advanced or Scripted Deployment)

  1. Open regedit.exe with administrative privileges.
  2. Go to: 
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. Find or create a REG_SZ named CachedLogonsCount.
  4. Set Value data to "0".
  5. Close regedit, restart for full effect.

Note: Disabling caching means users cannot log on with domain credentials if the DC is offline. Carefully assess the impact on laptops/remote users.

2. Protect Stored Credentials (LSASS, Registry, etc.)

2.1 Windows Defender Credential Guard

Why It Matters
Credential Guard uses virtualization-based security (VBS) to isolate and protect credentials from compromise. Attackers that typically dump lsass.exe to harvest credentials will be blocked by Credential Guard’s isolated environment.

Requirements

  • Windows 10 Enterprise or Education, Windows 11 Enterprise or Education, or corresponding Windows Server with Desktop Experience.
  • Secure Boot, hardware-assisted virtualization (Intel VT-x or AMD-V), and ideally TPM 2.0.

How to Enable

Option A: Group Policy

  1. In Group Policy Management Console, edit an appropriate GPO.
  2. Navigate to: 
    Computer Configuration
  → Administrative Templates
    → System
      → Device Guard
  3. Open Turn On Virtualization Based Security, set it to Enabled.
  4. Under Credential Guard Configuration, choose Enabled with UEFI lock (preferred).
  5. Apply the GPO, and reboot target machines.

Option B: Registry/Boot Configuration (For Testing/Lab)

  1. Set the following registry keys (requires caution): 
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
"EnableVirtualizationBasedSecurity" (DWORD) = 1
"RequirePlatformSecurityFeatures" (DWORD) = 1 or 3 (depending on the hardware capabilities)
"LsaCfgFlags" (DWORD) = 1 (enables Credential Guard)
  2. Update boot configuration: 
    bcdedit /set hypervisorlaunchtype auto
  3. Reboot twice to finalize.

2.2 LSA Protection (RunAsPPL)

Why It Matters
Running LSASS as a protected process prevents unauthorized code (e.g., Mimikatz) from reading LSASS memory.

How to Enable

Group Policy

  1. Open or create a GPO.
  2. Go to: 
    Computer Configuration
  → Administrative Templates
    → System
      → Local Security Authority
  3. Locate Configure LSASS to run as protected process, set to Enabled.
  4. Reboot target machines.

Registry

  1. Open regedit.exe.
  2. Navigate to: 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
  3. Create or set RunAsPPL (DWORD) = 1.
  4. Optionally set RunAsPPLBoot (DWORD) = 1 to enforce from boot.
  5. Reboot.

2.3 Disable Legacy/Unneeded Authentication Protocols

  1. WDigest

    • Registry path: 
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest
    • Set UseLogonCredential (DWORD) = 0 (prevents storing plaintext credentials).

  2. Disable LM Hash Storage

    • Registry path: 
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA
    • NoLMHash (DWORD) = 1.

  3. NTLMv2 Enforcement

    • In Group Policy: 
      Computer Configuration
  → Windows Settings
    → Security Settings
      → Local Policies
        → Security Options
          → Network security: LAN Manager authentication level
    • Set to Send NTLMv2 responses only. Refuse LM & NTLM.

2.4 Microsoft Local Administrator Password Solution (LAPS)

Why It Matters
LAPS randomizes and securely stores the local admin password for each domain-joined machine in Active Directory, stopping attackers from using the same local password to jump among hosts.

Implementation Steps

  1. Schema Extension

    • Download and install the LAPS .msi on a domain controller.
    • Run Update-LapsADSchema (PowerShell) or Set-AdmPwdComputerSelfPermission commands as needed.

  2. Client Installation

    • Install the LAPS client on each Windows machine (can be done via SCCM, Intune, or manual .msi).

  3. Group Policy Configuration

    • In GPMC, create or edit a GPO.
    • Go to: 
      Computer Configuration
  → Administrative Templates
    → LAPS
    • Enable Password Settings to define password complexity, length, and reset frequency.
    • Ensure Enable Local Admin Password Management is set to Enabled.

  4. Verify

    • On a domain-joined workstation, run gpupdate /force.
    • AD Users & Computers: check the computer object’s ms-Mcs-AdmPwd attribute for the stored password.

3. General Operating System Hardening

3.1 Patch Management and Vulnerability Remediation

  1. Regular OS Updates: Use Windows Server Update Services (WSUS), Microsoft Update, or other patch management solutions to automate updates.
  2. Third-Party Apps: Keep browsers, plugins, PDF readers, etc., patched.
  3. Firmware: Apply vendor BIOS/UEFI and firmware updates to fix low-level vulnerabilities.

3.2 Application Control (WDAC or AppLocker)

Why It Matters
Only approved (whitelisted) executables, DLLs, and scripts can run, significantly reducing malware infection risk.

How to Enable

  1. AppLocker (Windows Enterprise/Education)

    • Open a GPO, navigate to: 
      Computer Configuration
  → Windows Settings
    → Security Settings
      → Application Control Policies
        → AppLocker
    • Create rules for Executables, Windows Installers, Scripts, and DLLs.
    • Start in Audit Mode before enforcing.

  2. Windows Defender Application Control (WDAC)

    • Create a WDAC policy via PowerShell:
      • New-CIPolicy -FilePath "C:\Policy\DeviceControl.xml" -Level Publisher -UserPEs -Fallback Hash
      • ConvertFrom-CIPolicy -XmlFilePath "C:\Policy\DeviceControl.xml" -BinaryFilePath "C:\Policy\DeviceControl.bin"
    • Deploy the .bin policy using Group Policy or Intune MDM.
    • Reboot to apply.

3.3 Lock Down RDP and Other Services

  1. Use Network Level Authentication (NLA):
    • In System Properties → Remote tab → check “Allow connections only from computers running Remote Desktop with NLA.”
    • Or GPO: 
      Computer Configuration
  → Administrative Templates
    → Windows Components
      → Remote Desktop Services
        → Remote Desktop Session Host
          → Security
    • Set Require user authentication for remote connections by using NLA to Enabled.
  2. RDP Gateway or VPN: Avoid exposing RDP directly on the internet.
  3. Disable Unused Services:
    • Use Services.msc or PowerShell Disable-Service -Name "ServiceName" to stop Telnet, SMBv1, or other legacy services not needed.

3.4 Windows Firewall and Network Segmentation

Windows Firewall

  1. Go to Control Panel → Windows Defender Firewall → Advanced Settings.
  2. Configure Inbound Rules to Block by default, only Allow needed ports (RDP if you must, or custom application ports).
  3. For advanced setups, consider Outbound Rules to block unknown traffic.

Network Segmentation

  • Place high-value servers (e.g., domain controllers) on separate VLANs with stricter ACLs.
  • Restrict east-west traffic so compromised endpoints cannot freely scan or attack other machines.

3.5 Enhanced Anti-Malware & Threat Detection

  1. Microsoft Defender
    • Ensure real-time protection and cloud-delivered protection are on.
    • Use Settings > Update & Security > Windows Security or enterprise tools like Intune.
  2. Attack Surface Reduction (ASR) Rules
    • GPO or Intune path: 
      Computer Configuration
  → Administrative Templates
    → Windows Components
      → Microsoft Defender Antivirus
        → Microsoft Defender Exploit Guard
          → Attack Surface Reduction
    • Enable rules like “Block credential stealing from LSASS” and “Block Office applications from injecting code into other processes.”
  3. Endpoint Detection & Response (EDR)
    • Microsoft Defender for Endpoint or third-party EDR for advanced threat visibility and response.

3.6 Least Privilege and Access Control

  1. Limit Local Administrators:
    • In a domain environment, use GPO to enforce restricted groups for local Administrators.
    • Avoid having normal user accounts in local Administrators group.
  2. Privileged Access Workstations (PAWs):
    • Provide separate hardened machines for domain/enterprise admin tasks.
  3. Multi-Factor Authentication (MFA):
    • Enforce for privileged logons (e.g., via Azure AD or on-prem RADIUS solutions).

3.7 Logging and Auditing

  1. Advanced Audit Policy Configuration (via GPO): 
    Computer Configuration
  → Policies
    → Windows Settings
      → Security Settings
        → Advanced Audit Policy Configuration
    • Enable detailed logs for account logon, privilege use, object access, etc.
  2. Sysmon (System Monitor)
    • Download from Microsoft Sysinternals.
    • Run sysmon –i –accepteula –h or specify a configuration file with advanced rules.
  3. SIEM Integration:
    • Forward event logs to a central Security Information and Event Management platform (e.g., Microsoft Sentinel, Splunk).
  4. Tamper Protection:
    • Enable in Windows Security → Virus & threat protection → Manage settings → Tamper Protection.

4. Strengthen Disk Encryption with BitLocker

Why It Matters

BitLocker protects data at rest by encrypting the entire drive. If a system is physically stolen or offline-attacked, data and credentials remain safeguarded. However, relying only on the TPM with automatic unlock can be risky—attackers who manipulate hardware might bypass it.

Implementation Steps

  1. Enable Secure Boot
    • Required for robust boot chain integrity. Access BIOS/UEFI → Enable Secure Boot.
  2. Turn On BitLocker
    • Control Panel → BitLocker Drive Encryption → Turn On BitLocker.
    • Or run Manage-bde –on C: in an elevated PowerShell/Command Prompt.
  3. Configure Authentication
    • Use TPM + PIN or Passphrase: Choose a strong alphanumeric passcode or phrase.
    • FIDO2 Key (If hardware supports it): Some modern Windows editions and hardware combinations allow unlocking with a FIDO2 device.
    • In enterprise environments, set this via Group Policy: 
      Computer Configuration
  → Administrative Templates
    → Windows Components
      → BitLocker Drive Encryption
    • Set or enforce “Require additional authentication at startup,” specifying TPM + PIN or TPM + FIDO2.
  4. Recovery Key Management
    • Store recovery keys securely in Azure AD, Active Directory, or a secure offline vault.

5. Embrace Zero Trust Architecture and Network Strategy

  1. Micro-Segmentation
    • Use VLANs, subnets, or software-defined networking to isolate critical resources.
  2. Continuous Verification
    • MFA for every access attempt; ensure devices meet compliance (updated, healthy) before granting resource access.
  3. Least-Privilege Networking
    • Whitelist only the ports/protocols necessary for each user/device’s job function.

6. Plan for Incident Response and Resilience

  1. Incident Response Playbooks:
    • Document steps to isolate compromised machines, collect forensic artifacts, and eradicate threats.
  2. Regular Testing:
    • Perform red-team exercises or penetration tests to find weaknesses in your environment or response processes.
  3. Backup Strategy:
    • Maintain offline or immutable backups to mitigate ransomware or destructive attacks.
    • Regularly test restore processes to confirm data integrity.

Final Words

Strengthening Windows security is not just about turning off cached credentials or enabling a single feature—it’s a multilayered process. By combining these defensive measures—disabling password caching, implementing Credential Guard and LSA Protection, minimizing legacy protocols, locking down RDP, applying strong BitLocker settings, and adopting Zero Trust concepts—you position your organization to better withstand an ever-evolving threat landscape.

Use this guide as a “checklist” and adapt each recommendation to your specific environment. While every control adds complexity, the layered approach ensures that if one defense is bypassed, multiple other protective measures can still contain or mitigate damage. Ultimately, an environment configured with robust security controls, continuous monitoring, and a well-practiced incident response plan stands the best chance of staying a step ahead of malicious actors.