Windows Hardening

Prevent users from copying data to or from removable USB storage devices by enforcing a Group Policy that blocks USB storage drivers.

Enforce full disk encryption across the fleet with Group Policy — TPM-backed protection, XTS-AES ciphers, and recovery keys safely escrowed to Active Directory.

The shortlist of Windows security events that actually indicate attacks — logons, privilege use, account changes, and log tampering — and how to collect them.

Default Windows auditing misses the events that matter — deploy Microsoft's recommended Advanced Audit Policy via GPO so logons, privilege use, and account changes are actually recorded.

Directly exposed RDP is the top ransomware entry vector — find every instance, close it now, and move remote access behind VPN/ZTNA, a gateway, or Bastion.

Automatically randomize and rotate the local administrator password on every machine, ending the single-shared-password problem that enables domain-wide lateral movement.