Almost every SME with Windows servers has an Active Directory. That means a powerful tool is already in place but often unused: group policies (GPOs). Used correctly, they close many of the entry points attackers routinely exploit.
Approach: test first, then roll out
Create a dedicated organisational unit with a few test devices and link new policies there first. Only after a week without problems does the policy apply to everyone. Document every change.
The settings with the biggest impact
- Manage local administrator passwords with Windows LAPS. Every device gets its own automatically rotating password. One compromised PC no longer opens all the others.
- Disable legacy protocols. SMBv1, NTLMv1 and LLMNR are hardly needed anymore but are readily abused.
- Block macros from the internet. Office macros in downloaded files are a classic malware vector.
- Log PowerShell. Script Block Logging shows what was executed on a system in case of an incident.
- Manage the Windows firewall centrally. Incoming connections between workstations are unnecessary in most offices.
- Modernise the password policy. Long passphrases and multi-factor authentication are better than forced changes every 90 days.
- Enable auditing. Logins, group changes and failed access attempts belong in the event log – ideally in a central SIEM.
Use recognised baselines
For details, the Microsoft Security Baselines and CIS Benchmarks are worth a look. Both are freely available and can be imported as templates. But don’t adopt them blindly: not every setting suits every business application.
Conclusion
With an afternoon of work and a week of testing, the security level of a typical SME network can be raised significantly. If you would like support, we are happy to review your existing policies as part of our IT security service.
Frequently asked questions
Can hardening disrupt operations?
Yes, if settings are rolled out without testing. That is why you should always start with a test group and document changes.
Do I need a Windows server for this?
Group policies require an Active Directory. Without a domain, many settings can be applied via local policies or a device management solution.
What is Windows LAPS?
A Microsoft feature that assigns each device its own automatically rotating local administrator password and stores it securely in Active Directory.
