Windows Server Hardening Checklist for 2026

Windows Server hardening is not a contest to enable the most restrictive settings. It is the work of leaving each server with only the capability its role requires.

The problem is not that Microsoft ships an unusable default. The problem is that one default must support domain controllers, file servers, application hosts, workgroup systems, and workloads nobody at Microsoft has seen. Your team knows the role. Your baseline has to express it.

A useful Windows Server hardening checklist therefore covers more than settings. It names the role, version, policy authority, dependency tests, exception owner, rollback method, and endpoint evidence that proves the change survived. Without those fields, the checklist is just a hopeful list of intentions.

What should a Windows Server hardening checklist cover?

Start with ten control areas: supported software, installed roles and features, accounts and privilege, network listeners, firewall policy, SMB and other protocols, credential protection, application execution, security logging, and recovery. Add management paths such as Remote Desktop, PowerShell remoting, backup agents, and monitoring because a server cannot be secured independently of the tools that administer it. If the OpenSSH Server feature is enabled, apply the SSH hardening guide to that access path.

• Record the exact Windows Server edition, build, role, owner, data, exposure, and support date.
• Remove unused roles, features, services, packages, scheduled tasks, and local accounts.
• Use separate administration, Windows LAPS, narrow service identities, and controlled elevation.
• Allow only required inbound sources and ports. Keep the firewall enabled on every profile.
• Disable obsolete protocols, require modern signing and encryption, and audit compatibility first.
• Protect credentials with LSA protection, Credential Guard where supported, and safe delegation.
• Configure Defender, application control, exploit protection, update policy, and tamper resistance.
• Capture process creation, logon, account, privilege, file share, policy, and firewall events.
• Test backup, restore, break glass access, management, authentication, and the business service.
• Requery the effective state and watch drift, missing evidence, policy conflict, and exception expiry.

Use our system hardening pillar guide to define the wider operating model. The checklist below focuses on the Windows decisions that create the most avoidable exposure.

Which Windows Server security baseline should you use?

Begin with Microsoft guidance for the exact supported server release. Add the CIS Benchmark when you need a detailed independent profile and assessment structure. Use a DISA STIG profile when a government obligation requires it. Do not merge three standards into one giant sheet and assume the strictest value wins. Compare intent, choose one policy authority, and record the local decision.

CIS currently lists Windows Server 2025 Benchmark v2.1.0 and Windows Server 2022 Benchmark v5.1.0 on its Microsoft Windows Server Benchmarks page. The page also separates domain joined, stand alone, and STIG content. Version and role matter. A domain controller should never inherit a member server profile by accident.

Keep a local tailoring record beside the deployed policy. It should identify accepted recommendations, changed values, excluded settings, technical reason, affected roles, test result, approver, and review date. That record turns “CIS compliant” into something an operator can examine.

How do you reduce Windows Server roles and services?

The safest service is one that is not installed. Inventory every server role, optional feature, service, listener, driver, and scheduled task. Compare each item with the approved workload. Removal beats disabling when the capability has no planned use, because a later policy refresh or update cannot casually restart what no longer exists.

Do not use a universal removal script. Print Spooler may have no place on most servers, yet a print server has a reason to run it. Remote Desktop may be necessary for a specific support path, while another role can be managed remotely without it. The role owner must explain the dependency and the test that proves it still works.

Group repeated findings by image and deployment source. If 400 servers expose the same unused feature because a template included it, repair the template and replace or correct the fleet. Four hundred tickets hide one ownership problem.

How should Windows Server credentials and privilege be hardened?

Remove shared local administrator passwords. Windows LAPS can rotate and protect a managed local account, but the directory permissions around retrieval still need review. Separate ordinary and administrative identities, deny routine browsing and email from administrator sessions, and give service accounts only the rights their service consumes.

Credential Guard and LSA protection can reduce access to secrets held by the Local Security Authority. Remote Credential Guard and restricted administration can reduce credential exposure during management. Test hardware, authentication, backup, clustering, and older agents before enforcement. A control that is disabled after an outage is weaker than one deployed in a measured stage.

Use the least privilege implementation guide to map observed administrative work to narrower grants and temporary elevation. Server hardening fails when permanent domain privilege becomes the workaround for a poor support process.

What network and SMB settings matter most?

Default deny inbound traffic, then allow named sources to named services. Record why every listener exists. Disable SMBv1, LLMNR, NetBIOS name resolution, insecure guest access, and weak TLS where the role does not need them. Require signing before enforcing encryption everywhere, because capability and performance vary across clients and storage products.

Windows Server 2025 requires SMB signing by default and includes an SMB authentication rate limiter. Microsoft documents a two second delay after each failed NTLM or Local KDC Kerberos authentication attempt in its SMB security hardening guidance. A tool attempting 100 guesses against one account now spends at least 200 seconds on those failures, before network delay. The control raises cost. It does not excuse weak passwords or exposed SMB.

Audit compatibility before enforcement on older servers. Identify clients that cannot sign, systems that still use NTLM, and applications that depend on old name resolution. Give every dependency an owner and removal date. Permanent audit mode is observation, not hardening.

Which Windows Server events and protections should be enabled?

Turn on advanced audit policy for logon, credential validation, account management, sensitive privilege use, process creation, policy change, file share access, and system integrity. Include command lines in process creation events where policy and privacy allow. Size logs for the expected event rate and forwarding delay, then protect the collector path.

Microsoft's Server 2025 baseline sets the Security log to at least 192 MB and captures success and failure for nearly all advanced audit subcategories. The baseline also requires a three attempt account lockout threshold with a 15 minute duration. Those numbers appear in the Windows Server 2025 OSConfig baseline guide. Treat them as a tested starting point, then measure event volume and help desk impact.

Defender configuration needs the same discipline. Protect cloud delivered protection, behavior monitoring, script scanning, exclusions, tamper controls, and update health. An exclusion with no owner or expiry becomes a quiet execution path. Review exclusions as security changes, not application trivia.

How can Windows Server 2025 baselines be deployed and verified?

Microsoft now supports role aware baseline deployment through OSConfig on Windows Server 2025. It does not support earlier Server releases. Install the module in an elevated PowerShell session, apply the scenario that matches the role, restart as required, and query compliance. These commands are taken from the official OSConfig guide linked above:

Apply the DomainController or WorkgroupMember scenario when that is the actual role. OSConfig protects the baseline against drift, so do not let Group Policy, configuration code, and OSConfig fight over the same value. Microsoft warns that conflicting authorities can keep changing a setting back and forth. Assign ownership before enabling drift control.

Pilot on representative hardware and workloads. Test service startup, authentication, management, backup, restore, monitoring, patching, failover, and user transactions. Define automatic halt conditions. A change that raises authentication failure, service error, or support volume beyond the agreed limit should stop the wave.

How should a hardening queue be prioritized?

Suppose 1,200 servers are checked against 175 automated settings. That creates 210,000 observations. A 96 percent pass rate still produces 8,400 failures. At four minutes per review, the queue costs 560 analyst hours. Nobody should pay experts to read 8,400 lines one by one.

Route by exposure, privilege, data, exploit path, control failure, and repair source. An exposed management listener, reused administrator secret, disabled endpoint protection, or missing audit trail belongs at the top. A low consequence setting on an isolated lab host can wait. Repair common policy sources before individual systems, then verify every affected endpoint.

Our older security misconfiguration guide explains how to connect a failed value to actual system context. That connection is what turns a compliance queue into a repair order.

What changed in Windows Server hardening during 2026?

Microsoft published Server 2025 baseline revision 2602 on February 23, 2026. It added stronger NTLM auditing, blocked Windows Hello for Business keys vulnerable to ROCA on domain controllers, disabled Internet Explorer 11 launch through COM automation, and raised printer RPC authentication guidance. The February 2026 baseline announcement also describes September 2025 audit support for SMB signing and server SPN compatibility.

In June 2026, Microsoft published the local OSConfig deployment and verification workflow used above. The practical change is bigger than another policy file. Windows Server 2025 can now apply a role specific baseline, report item level compliance, customize selected values, and resist drift through one supported interface.

Operators should review both developments now. Baseline content changes, and delivery methods change with it. A server that passed last year's export may not reflect this year's threat or policy model.

Frequently asked questions

Does Windows Server hardening replace patching?

No. Patching repairs known defects. Hardening removes unnecessary capability, narrows access, strengthens protocols, protects credentials, and improves evidence. A mature server program does both.

Should domain controllers use the same baseline as member servers?

No. Domain controllers have different services, rights, audit needs, and recovery consequences. Use a profile written for the role and test directory operations before broad deployment.

Can Windows Server hardening break applications?

Yes. Protocol, identity, execution, firewall, and cryptography changes can expose old dependencies. That is why representative testing, staged deployment, monitoring, and rollback are part of the control.

How often should hardened servers be checked?

Check before release, after material change, after baseline updates, and on a cadence tied to consequence. Watch identity, protection, network, and logging settings more often. Track stale or missing results as unknown.

The executive takeaway

Select one server role and one current baseline. Remove features the role does not need, protect administrative credentials, narrow the network path, stage the change on representative systems, and verify the effective state after restart. Assign one policy authority and one exception owner. A hardening checklist earns trust when the service still works and the forbidden path does not.