Checklist · Servers

Windows Server baseline

Hardening and handover steps for a new Windows Server, domain-joined or standalone.

Owner: SysadminTime: 45 minISO 27001 A.8.9ISO 27001 A.8.2ISO 27001 A.8.15ISO 27001 A.8.7

0 of 24

Build and patching

Deployed from the hardened template; edition and role match the request.
Supported Windows Server release; latest cumulative update installed.
Only required roles and features installed; SMBv1 and legacy protocols removed.
Server joined to the correct OU so the baseline Group Policy applies.
Registered in the asset inventory with owner, environment and data classification.

Accounts and administration

Built-in Administrator renamed or disabled; local admin password managed by LAPS or equivalent.
Administrative groups contain named admin accounts only, not daily-use accounts.
Remote Desktop limited to an administrative group, with NLA on, from the admin network only.
Service accounts are group-managed (gMSA) where the service supports it.
Privileged access runs through a jump host or PAM tool; sessions are recorded.
Password policy, lockout threshold and MFA for admins match the identity policy.

Network and protocols

Windows Firewall enabled on all profiles; inbound rules reviewed, no "any/any".
NTLM restricted or audited; LLMNR and NetBIOS over TCP/IP disabled unless needed.
SMB signing required; TLS 1.0/1.1 disabled; weak cipher suites removed.
Open ports compared with the expected list; nothing unexplained is listening.

Logging and protection

Advanced audit policy set: logon, account management, privilege use, process creation.
Security log size raised so it does not wrap in under a week; events forwarded to the SIEM.
PowerShell script block and module logging enabled.
Defender or the EDR agent is running, up to date and cannot be disabled by local admins.
BitLocker enabled on data volumes for sensitive workloads; recovery key escrowed.

Handover

Backup agent installed; a test restore of a file and of the system state is scheduled.
Monitoring and alerting confirmed with a test alert.
Vulnerability scan completed and critical or high findings fixed or excepted.
Build documented as a change; any deviation from the baseline has an approved exception.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed. ISO references show where a list helps, not that it satisfies a control.

See these as tasks in Cisodium All checklists

Klar til å gå
forbi klassisk GRC?

14 dagers gratis prøve. Ikke noe kort. Nettskyen eller on-premises.

Bestill demo Snakk med salg →