Which ten group policy settings deliver the most protection, what to disable immediately, and how to roll it out without breaking anything.
Windows defaults are optimised for compatibility, not security. A handful of group policy settings deliver disproportionate protection, and most require no new product.
This list runs in order of return.
When a machine cannot resolve a name via DNS, it broadcasts on the local network. An attacker device answers and receives the credential hash. This works passively, with no interaction.
Disabling it is a few clicks in group policy and breaks nothing in modern environments. It is the best value-for-money setting on this list.
Without signing, intercepted authentication can be relayed to another machine. Enforcing signing breaks relaying. It can cause trouble with older devices, so survey first.
Both are obsolete with known, exploited weaknesses. SMBv1 often remains only because of old printers and scanners.
If every machine shares the same local admin password, compromising one means the entire estate. LAPS is free and provides a unique, automatically rotated password per machine.
Prevents credentials being read from memory. On supported hardware it is a single setting, and it removes one of the main instruments of lateral movement.
Off by default. Without it, the process log shows a script engine started but not what it ran. A single setting that multiplies the value of your logs. We covered this in our logging article.
Enable script block logging and, where possible, constrained language mode. Most attackers use PowerShell because it is already on the machine.
Macro-infected documents are the most common initial delivery method. Blocking macros by default in internet-sourced files is now a built-in option.
Only approved applications may run. Substantial work to do comprehensively, but even blocking execution from user profiles and temporary folders helps considerably, because malware typically lands there.
A built-in rule set: office applications may not spawn child processes, scripts may not run downloaded content, and so on. First in audit mode, then blocking.
Do not import a ready-made baseline untested. Vendor and community baselines are good starting points, but they contain hundreds of settings and some will certainly conflict with your environment.
Do not start with servers. Workstations are the entry point, deliver the highest return, and carry the lowest risk of disruption.
Do not skip measurement. Hardening is worth something when verified. Actual enforcement must be re-measured regularly, because a mis-scoped group policy can silently disable it.
Our IT security services include surveying the Windows environment and establishing a security baseline.
Comprehensive IT security services including firewalls, WAF, IPS, SIEM, DLP and endpoint protection from…
Kerberoasting, AS-REP roasting, password spraying, ACL abuse and the rest. What an attacker looks for in…
Most incident investigations fail because the decisive log is missing or already rotated. Which sources to…
Our specialists are happy to discuss what this means in your organisation's environment.