Hardening items

16 recommendations. Filter by category, criticality, maturity tier, or system.

Critical (3)High (13)Medium (0)Low (0)

Block unauthorized executables, scripts, and installers by allowlisting trusted applications with AppLocker or Windows Defender Application Control.

Updated Jul 9, 2026Microsoft Windows 10/11 · Microsoft Windows Server

Separate Domain Admin, server admin, and workstation admin credentials into isolated tiers to block lateral movement and privilege escalation.

Updated Jul 9, 2026Microsoft Active Directory · Microsoft Windows Server

Remove the legacy SMBv1 protocol and require SMB signing to stop relay attacks and exploits like EternalBlue.

Updated Jul 9, 2026Microsoft Windows Server · Microsoft Windows 10/11 · GPO

Protect LSASS from memory dumping and credential theft attacks like Mimikatz by enforcing LSA Protection (RunAsPPL) and Credential Guard.

Updated Jul 9, 2026Microsoft Windows Server · Microsoft Windows 10/11