Chapter 1: Securing the Windows Server operating system
We start with the server itself. Think of it like a house. Before you worry about the neighbourhood, you lock your own doors and windows.
Labs
| Lab | Attack | Control |
|---|---|---|
| 1.1 Password and lockout baseline with Group Policy | Brute force / password spray | Password + lockout policy (Group Policy) |
| 1.2 Exploit protection | Memory exploit (buffer overflow) in an unpatched app | Exploit protection: DEP, ASLR, CFG, ACG |
| 1.3 App Control for Business (WDAC) | Unknown malware or attacker tools dropped on the server | App Control for Business (WDAC) allow list |
| 1.4 Credential Guard | Pass-the-hash after reading LSASS memory | Credential Guard (virtualization-based security) |
| 1.5 Microsoft Defender SmartScreen | Phishing download / fake download site | Microsoft Defender SmartScreen, prevent bypass |
| 1.6 Microsoft Defender for Endpoint | Vulnerable third-party app (old 7-Zip) | Microsoft Defender for Endpoint (EDR + vulnerability management) |