41 recommendations. Filter by category, criticality, maturity tier, or system.
Require multi-factor authentication for all users and block legacy protocols (IMAP, POP, SMTP AUTH) that bypass MFA entirely.
Give Domain Admins and other Tier 0 operators a dedicated, locked-down workstation that never touches email, browsing, or productivity apps.
Separate Domain Admin, server admin, and workstation admin credentials into isolated tiers to block lateral movement and privilege escalation.
Remove the legacy SMBv1 protocol and require SMB signing to stop relay attacks and exploits like EternalBlue.
Protect LSASS from memory dumping and credential theft attacks like Mimikatz by enforcing LSA Protection (RunAsPPL) and Credential Guard.
Optional analytics cookies help us improve Hardenly. They stay off unless you accept. Cookie policy