Liste de contrôle pour le renforcement de Windows
MAG212 CYBER · Learn · Security
Windows hardening: a practical checklist.
The settings below close the gaps we most often see attackers and penetration testers use on Windows 11 and Windows Server networks. Start from a baseline, check each control with the PowerShell commands provided, and roll changes out in audit mode first.
1. Stay supported and patched
- Windows 10 reached end of support on 14 October 2025. Microsoft later extended the free consumer Extended Security Updates (ESU) programme to 12 October 2027; businesses can buy commercial ESU for up to three years. Plan the move to Windows 11 rather than relying on ESU.
- Each Windows 11 version has its own end date. Check the Microsoft lifecycle page and keep devices on a supported release.
- Patch monthly, and urgently for known-exploited bugs. Anything on CISA’s Known Exploited Vulnerabilities (KEV) catalogue jumps the queue. See Explication des systèmes CVE et CVSS.
- Update everything else too: browsers, Office, PDF readers, VPN clients and drivers.
2. Start from a baseline
Don’t invent settings one by one. Apply the Microsoft Security Baselines (from the free Security Compliance Toolkit) or the CIS Benchmarks through Group Policy or Intune, then document every exception and the reason for it. Re-check after each feature update.
3. Core checklist
| Control | Pourquoi c'est important |
|---|---|
| Microsoft Defender Antivirus on, with tamper protection | Stops attackers and malware from simply switching protection off. |
| Attack surface reduction (ASR) rules | Blocks common tricks such as Office apps launching child processes and credential theft from LSASS. Start in audit mode. |
| BitLocker on every laptop and desktop | A lost or stolen device does not become a data breach. Store recovery keys in AD or Entra ID. |
| Windows Firewall on for all profiles | Limits lateral movement between workstations. |
| Internet macros blocked in Office | Microsoft blocks VBA macros in files from the internet by default; don’t re-enable them by policy. |
| App Control for Business or AppLocker | Only approved software runs, especially in user-writable folders. |
| Users are not local administrators | Most malware and many attacks need admin rights to do real damage. |
Check the current state from an elevated PowerShell prompt:
# Defender: real-time protection and tamper protection Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, IsTamperProtected # ASR rules configured (IDs) and their actions (0 off, 1 block, 2 audit, 6 warn) Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions # BitLocker status for each drive Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, ProtectionStatus # Firewall enabled on Domain, Private and Public profiles Get-NetFirewallProfile | Select-Object Name, Enabled # Who is a local administrator? Get-LocalGroupMember -Group Administrators
4. Protect credentials
- Windows LAPS gives every machine a unique, rotating local administrator password stored in Active Directory or Entra ID. It is built into Windows from the April 2023 updates onwards, so no separate install is needed; the older Microsoft LAPS is deprecated.
- Credential Guard isolates secrets such as NTLM hashes and Kerberos tickets using virtualisation-based security. On Windows 11 22H2 and later it is turned on by default for devices that meet the licensing and hardware requirements; confirm it rather than assume it.
- LSA protection runs LSASS as a protected process, making credential dumping harder.
- Separate admin accounts: admins browse and read email with a normal account and use a dedicated account only for administration, ideally from a dedicated workstation.
- Turn off NTLMv1 and audit remaining NTLM use as a step towards Kerberos-only.
# Credential Guard running? (1 in the list = Credential Guard) (Get-CimInstance -Namespace root\Microsoft\Windows\DeviceGuard -ClassName Win32_DeviceGuard).SecurityServicesRunning # LSA protection configured? (1 or 2 = enabled) Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -ErrorAction SilentlyContinue # Windows LAPS: read a machine's managed password (needs permission) Get-LapsADPassword -Identity PC-NAME -AsPlainText
5. Quiet the network
These legacy protocols are a favourite first step in internal penetration tests, because they let an attacker on the same network capture or relay password hashes.
- Disable LLMNR (Group Policy: “Turn off multicast name resolution”) and NetBIOS over TCP/IP where nothing depends on it.
- Require SMB signing and make sure SMBv1 is removed.
- Disable WPAD automatic proxy discovery if you don’t use it.
- Restrict remote management (RDP, WinRM) to admin networks and require MFA for remote access.
# Is the SMBv1 feature installed? (should be Disabled) Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol | Select-Object State # SMB server signing required? Get-SmbServerConfiguration | Select-Object RequireSecuritySignature, EnableSMB1Protocol
6. Logging you will actually need
| Allumer | Gives you |
|---|---|
| Advanced audit policy for logon events | Event IDs 4624 (logon) and 4625 (failed logon) to spot password spraying and odd logons. |
| Process creation with command line | Event ID 4688 shows what ran and how. |
| PowerShell script block logging | Event ID 4104 records the PowerShell code that was executed, including decoded scripts. |
| Sysmon (free, from Microsoft Sysinternals) | Detailed process, network and file activity for investigations. |
Forward logs to a central server or SIEM and keep them long enough to investigate: an attacker may have been inside for weeks before anyone notices.
7. Roll out safely
- Test each change on a pilot group that includes IT, finance and anyone with unusual software.
- Use audit mode for ASR rules and application control, and review the events for a week or two.
- Switch to enforcement in rings, with a documented rollback.
- Re-verify after every Windows feature update, and keep an up-to-date asset inventory so no machine is forgotten.
Tip: a penetration test is the quickest way to prove your hardening works. See penetration testing: what to expect.
Sources: Microsoft Learn (Windows LAPS overview; Credential Guard overview; attack surface reduction rules reference; Microsoft Security Baselines; Windows 10 consumer ESU); CISA Known Exploited Vulnerabilities catalogue; CIS Benchmarks. Reviewed November 2026.
Besoin d'aide d'experts ?
MAG212 CYBER offers network and cybersecurity consultation, penetration testing with MAG212 Atlas, and security seminars for organisations around the world.