Kategori: Hardening
Scheduled Tasks and Autoruns: Auditing Weak Permissions
A practical guide to finding scheduled task privilege escalation paths: weak ACLs on tasks, services, Run keys, and startup folders, plus triage…
Why Your Security GPO Is Not Applying: Precedence Rules
A gpo not applying troubleshooting guide: precedence order, security filtering, WMI filters, gpresult analysis, replication delay, and registry checks.
SeImpersonate and Potato Attacks: Blocking Token Abuse
How SeImpersonatePrivilege turns a compromised IIS or SQL service account into SYSTEM through Potato attacks, and the concrete steps that close the…
Unquoted Service Paths and Weak Service ACLs on Windows
Learn when an unquoted service path is actually exploitable, find real risk fast with PowerShell, and fix Windows service ACLs so the…
RDP Hardening: NLA, Restricted Admin and Exposure Limits
A practical RDP hardening checklist: NLA and TLS settings, Restricted Admin vs Remote Credential Guard, session limits, deny logon rules and drift…
ASR Rules: Moving From Audit Mode to Block Mode Safely
A staged plan for moving Microsoft Defender ASR rules from audit to block mode: telemetry sizing, rule ranking, exclusions, and enforcement verification.
PowerShell Logging and Constrained Language Mode Setup
How module, script block and transcription logging differ, sizing and retention that survive an incident, and how to make Constrained Language Mode…
Disabling NTLM: Audit First, Then Enforce Domain-Wide
How to disable NTLM domain-wide: enable 8001-8004 auditing, build the exception inventory, apply interim controls, then stage Restrict NTLM enforcement.
LSASS Protection: Credential Guard, RunAsPPL and Gaps
RunAsPPL and Credential Guard for LSASS: hardware prerequisites, enablement steps, what stays exposed, compatibility breakage, and how to verify it is really…
Windows Server Hardening Checklist for 2022 and 2025
A role-based Windows Server hardening checklist for 2022 and 2025: identity, SMB, RDP, audit policy subcategories, GPO rollout and drift checks.