Hello! Our company’s Windows servers, responsible for critical data and services, are they truly managed securely? π§ Many servers operate with default settings, unknowingly exposing themselves to numerous security threats.
Today, we’ve prepared an Essential Windows Server Security Diagnostic Checklist to turn your server into a strong fortress, preventing it from becoming a hacker’s prey. Follow each item carefully and check your server’s security status right now!
π€ Account Management: Lock Down the Security Gates
90% of server security starts with account management. Let’s look at the items that need thorough management as they are the most basic.
- π΅οΈββοΈ Change Administrator Account Name (W-01) ‘Administrator’ is the most famous account name in the world. Attackers target this name first. Change it to a completely different name to neutralize the first step of guessing attacks.
- πͺ Disable Guest Account (W-02) The Guest account is like a door for anonymous users. If this door doesn’t need to be open, you must disable and lock it.
- π Minimize Administrator Group (W-06) The ‘Administrators’ group is a powerful group with all server privileges. Include only the absolute minimum necessary users in this group to reduce the risk of privilege abuse and misuse.
- π Strong Password Policy is Essential (W-48, W-49, W-50, W-51, W-55) Easy-to-guess passwords are forbidden! In the Password Policy of the Local Security Policy, you must set the following items:
- Password must meet complexity requirements: Enforce a combination of English letters, numbers, and special characters.
- Minimum password length: 8 characters or more.
- Maximum/Minimum password age: Encourage periodic changes (90 days or less / 1 day or more).
- Remember recent passwords: Prevent reuse of previously used passwords.
- π€« Do Not Use Reversible Encryption (W-05) Passwords should never be stored like plain text. Set the “Store passwords using reversible encryption” policy to Disabled to protect passwords securely.
- π Defend Against Brute-Force Attacks with Account Lockout Policy (W-04, W-47) You must prevent attackers from continuously trying incorrect passwords. In the Account Lockout Policy, set the login failure threshold to 5 attempts or less and the lockout duration to 60 minutes or more to protect accounts.
- π Do Not Display Last User Name (W-52) Displaying the last logged-on user’s name on the login screen is like giving account information to an attacker. Disable this feature to avoid exposing information.
- π« Restrict Use of Blank Passwords (W-56) All accounts must have a password. Block local logons for accounts without passwords to ensure minimum security.
βοΈ Service Management: Block All Unnecessary Pathways
Unused services or features only broaden the attack surface. Keep only essential services and remove the rest.
- π Remove Default Hard Disk Shares (W-08) Default administrative shares like C$ and D$ are convenient but can be pathways for malware propagation through the internal network. If unnecessary, disable the automatic sharing feature by modifying the registry.
- π₯ Configure Shared Folder Permissions (W-07) Granting ‘Everyone’ group permissions to shared folders is very dangerous. Remove this permission and grant only the minimum necessary permissions (e.g., read/write) to essential users.
- π§βπ» Restrict Remote Terminal User Groups (W-57) Remote Desktop (RDP) is a very useful feature, but not just anyone should be able to connect. Restrict access to specific authorized users or groups, allowing only administrators to connect.
- π Set Terminal Services Encryption Level (W-58) To prevent data leakage during remote connections, you must protect communication content by setting the encryption level to “High”.
- π Remove Unnecessary NetBIOS Bindings (W-24) Disabling NetBIOS, which is closely related to file sharing, from TCP/IP can reduce the possibility of external attacks through related ports.
- π Check Unnecessary IIS Services (W-10, W-11, W-14, W-19, W-23) If not used as a web server, it’s best to stop the IIS service itself. If you do use it, be sure to check the following items:
- Disable Directory Listing (Browsing): Prevent exposure of the web server’s file structure.
- Disable WebDAV: If not used, turn it off to remove potential vulnerabilities such as authentication bypass.
- Delete Unnecessary Sample Files and Virtual Directories: Sample files created during default installation can be a good source of information for attackers.
- π Remove Unnecessary Services (W-09) Old services like Alerter and Messenger that are no longer used can waste system resources and weaken security. Boldly set them to “Disabled”.
- πΊοΈ Restrict DNS Zone Transfer (W-29) If you operate a DNS server, the Zone file containing all domain information should not be transferred to just anyone. Allow transfers only to authorized secondary DNS servers.
- FTP Anonymous Access Prohibition (W-27) When operating an FTP server, anonymous access, which allows anyone to connect, must be disabled to block unauthorized file access.
π Patch and Log Management: Continuous Monitoring and Response
Security is not a one-time event. You must prepare for threats through continuous management and monitoring.
- β¨ Apply Latest Service Packs and Security Patches (W-31, W-32) Windows Update is not an option, but a necessity. Apply all the latest service packs and security patches (Hotfixes) without fail to eliminate all known vulnerabilities.
- π¦ Keep Antivirus Program Up-to-Date (W-33, W-36) Install a reliable antivirus program and always keep its engine and patterns up-to-date to protect your server from malware.
- βοΈ Configure Audit Policy and Review Logs (W-34, W-69) The “Event Viewer” is a black box that records all server activities. In the Audit Policy of the Local Security Policy, configure it to record important events such as logons, account management, and policy changes, and regularly review these logs to detect and respond to intrusion attempts.
- π§ Block Remote Registry Access (W-35) It is very dangerous if external parties can modify the server’s core settings, the registry. Stop the ‘Remote Registry’ service to completely block remote modifications.
π‘οΈ Other Important Security Management
Finally, here are additional settings to strengthen the server’s physical and logical security.
- β³ Screensaver Settings (W-38) You must prevent someone from manipulating the server while you are away. Set the screensaver wait time to 10 minutes or less and be sure to check “On resume, display logon screen”.
- π Prohibit System Shutdown Without Logon (W-39) If anyone can reboot the server, it can cause significant service disruption. Restrict system shutdown to only logged-on users.
- π€« SAM File Access Control and Anonymous Enumeration Blocking (W-37, W-42) The critical SAM file containing user account information should be inaccessible to anyone other than Administrators and System, and anonymous users should be prevented from enumerating account lists.
- π Prevent Removable Media AutoRun (PC-13) The AutoRun feature, which automatically executes programs when USB memory or other removable media is connected, is one of the main routes for malware infection. Disable this feature to prevent risks.
There were indeed many items, weren’t there? But if you consistently review and apply these checklists, your Windows server security level will rise to that of an expert. Remember that security is the result of continuous attention and effort!
Leave a Reply