{"id":3814,"date":"2026-11-01T15:23:44","date_gmt":"2026-11-01T23:23:44","guid":{"rendered":"https:\/\/cyber.mag212.com\/learn\/windows-hardening\/"},"modified":"2026-11-01T15:23:44","modified_gmt":"2026-11-01T23:23:44","slug":"windows-hardening","status":"publish","type":"page","link":"https:\/\/cyber.mag212.com\/fr\/learn\/windows-hardening\/","title":{"rendered":"Liste de contr\u00f4le pour le renforcement de Windows"},"content":{"rendered":"\n<div class=\"m212x\" id=\"m212-windows-hardening\">\n<style>\n.m212x{--bg:#0a0f15;--panel:#0f1720;--panel2:#121c27;--line:#1f2d3a;--line2:#2a3b4b;--ink:#e6edf3;--mute:#9fb0c0;--green:#3ee6a0;--red:#ff5468;--cyan:#3cc8f0;--amber:#f6b544;--violet:#a98bff;\n font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif;color:var(--ink);line-height:1.6;font-size:16px}\n.m212x *{box-sizing:border-box}\n.m212x h2,.m212x h3,.m212x h4,.m212x p,.m212x ul,.m212x ol{margin:0}\n.m212x a{color:var(--cyan)}\n.m212x .hero{position:relative;background:radial-gradient(ellipse at 90% 0%,rgba(60,200,240,.14),transparent 60%),var(--bg);border:1px solid var(--line);border-radius:14px;padding:34px 30px;overflow:hidden;margin-bottom:22px}\n.m212x .hero::before{content:\"\";position:absolute;left:0;right:0;top:0;height:4px;background:linear-gradient(90deg,var(--green),var(--cyan) 60%,var(--red))}\n.m212x .kick{font-size:12px;font-weight:800;letter-spacing:.2em;text-transform:uppercase;color:var(--cyan);margin-bottom:8px}\n.m212x .hero h2{font-size:clamp(26px,4.6vw,40px);line-height:1.1;font-weight:800;margin-bottom:10px}\n.m212x .hero h2 span{color:var(--green)}\n.m212x .hero p{color:var(--mute);font-size:17px;max-width:680px}\n.m212x .sec{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:24px;margin-bottom:22px;scroll-margin-top:110px}\n.m212x .sec h3{font-size:22px;font-weight:800;margin-bottom:8px}\n.m212x .sec h4{font-size:16px;font-weight:800;margin:16px 0 6px}\n.m212x .sec p{color:#cdd8e2;margin-bottom:10px}\n.m212x .lead{color:var(--mute) !important;margin-bottom:16px !important}\n.m212x .grid{display:grid;gap:14px;grid-template-columns:repeat(auto-fit,minmax(230px,1fr))}\n.m212x .card{display:block;background:var(--panel2);border:1px solid var(--line2);border-radius:10px;padding:18px;text-decoration:none;color:var(--ink)}\n.m212x a.card:hover{border-color:var(--green)}\n.m212x .card b{display:block;font-size:17px;margin-bottom:6px}\n.m212x .card p{color:var(--mute);font-size:14.5px;margin:0}\n.m212x .card .go{display:inline-block;margin-top:10px;font-size:13px;font-weight:800;letter-spacing:.06em;color:var(--green)}\n.m212x .ic{font-size:26px;display:block;margin-bottom:8px}\n.m212x ul.l,.m212x ol.l{padding-left:22px;color:#cdd8e2;margin-bottom:10px}\n.m212x ul.l li,.m212x ol.l li{margin-bottom:6px}\n.m212x table{width:100%;border-collapse:collapse;font-size:14.5px;margin:6px 0 12px}\n.m212x th{text-align:left;font-size:12px;letter-spacing:.12em;text-transform:uppercase;color:var(--mute);border-bottom:1px solid var(--line2);padding:8px}\n.m212x td{border-bottom:1px solid var(--line);padding:8px;vertical-align:top;color:#d3dde6}\n.m212x code,.m212x .mono{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:.9em}\n.m212x code{background:rgba(60,200,240,.1);color:#bfe9ff;padding:1px 5px;border-radius:4px}\n.m212x pre{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:13.5px;background:#060a0f;border:1px solid var(--line);border-left:3px solid var(--green);border-radius:6px;padding:12px 14px;overflow-x:auto;color:#cfe8d9;margin:6px 0 12px;white-space:pre}\n.m212x .callout{border:1px solid rgba(246,181,68,.4);background:rgba(246,181,68,.08);border-radius:10px;padding:14px 16px;margin:12px 0}\n.m212x .callout b{color:var(--amber)}\n.m212x .pill{display:inline-block;font-size:12px;font-weight:800;letter-spacing:.06em;padding:2px 9px;border-radius:999px;border:1px solid}\n.m212x .p-n{color:#9fb0c0;border-color:#3a4b5b}\n.m212x .p-l{color:var(--green);border-color:rgba(62,230,160,.5);background:rgba(62,230,160,.08)}\n.m212x .p-m{color:var(--amber);border-color:rgba(246,181,68,.5);background:rgba(246,181,68,.08)}\n.m212x .p-h{color:#ff8a5c;border-color:rgba(255,138,92,.5);background:rgba(255,138,92,.08)}\n.m212x .p-c{color:var(--red);border-color:rgba(255,84,104,.5);background:rgba(255,84,104,.08)}\n.m212x .toc{display:flex;flex-wrap:wrap;gap:8px;margin-top:18px}\n.m212x .toc a{font-size:14px;font-weight:700;text-decoration:none;color:var(--ink);background:var(--panel2);border:1px solid var(--line2);border-radius:999px;padding:7px 13px}\n.m212x .toc a:hover{border-color:var(--green);color:var(--green)}\n.m212x input[type=text],.m212x input[type=search],.m212x input[type=url]{width:100%;background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:12px 14px;font-size:16px;font-family:inherit}\n.m212x input:focus{outline:2px solid var(--cyan);outline-offset:1px}\n.m212x button{font-family:inherit;font-size:15px;font-weight:700;cursor:pointer;border-radius:8px;padding:11px 16px;border:1px solid var(--line2);background:var(--panel2);color:var(--ink)}\n.m212x button.pri{background:var(--green);color:#04130c;border-color:var(--green)}\n.m212x .help{display:flex;gap:18px;align-items:center;flex-wrap:wrap;background:linear-gradient(90deg,rgba(60,200,240,.12),rgba(62,230,160,.05));border:1px solid rgba(60,200,240,.35);border-radius:14px;padding:20px 24px}\n.m212x .help div{flex:1;min-width:240px}\n.m212x .help a.cta{display:inline-block;background:var(--cyan);color:#03141b;font-weight:800;text-decoration:none;border-radius:8px;padding:12px 18px}\n.m212x .small{font-size:13.5px;color:var(--mute)}\n<\/style>\n<section class=\"hero\"><div class=\"kick\">MAG212 CYBER \u00b7 Learn \u00b7 Security<\/div>\n<h2>Windows hardening: <span>a practical checklist.<\/span><\/h2>\n<p>The settings below close the gaps we most often see attackers and penetration testers use on Windows 11 and Windows Server networks. Start from a baseline, check each control with the PowerShell commands provided, and roll changes out in audit mode first.<\/p>\n<div class=\"toc\"><a href=\"#supported\">Stay supported<\/a><a href=\"#baseline\">Start from a baseline<\/a><a href=\"#checklist\">Core checklist<\/a><a href=\"#creds\">Protect credentials<\/a><a href=\"#network\">Quiet the network<\/a><a href=\"#logging\">Logging<\/a><a href=\"#rollout\">Roll out safely<\/a><\/div><\/section>\n\n<section class=\"sec\" id=\"supported\"><h3>1. Stay supported and patched<\/h3>\n<ul class=\"l\">\n<li><b>Windows 10 reached end of support on 14 October 2025.<\/b> Microsoft later extended the free consumer Extended Security Updates (ESU) programme to 12 October 2027; businesses can buy commercial ESU for up to three years. Plan the move to Windows 11 rather than relying on ESU.<\/li>\n<li><b>Each Windows 11 version has its own end date.<\/b> Check the Microsoft lifecycle page and keep devices on a supported release.<\/li>\n<li><b>Patch monthly, and urgently for known-exploited bugs.<\/b> Anything on CISA&#8217;s Known Exploited Vulnerabilities (KEV) catalogue jumps the queue. See <a href=\"\/learn\/cve-cvss\/\">CVE &amp; CVSS explained<\/a>.<\/li>\n<li><b>Update everything else too:<\/b> browsers, Office, PDF readers, VPN clients and drivers.<\/li>\n<\/ul><\/section>\n\n<section class=\"sec\" id=\"baseline\"><h3>2. Start from a baseline<\/h3>\n<p>Don&#8217;t invent settings one by one. Apply the <b>Microsoft Security Baselines<\/b> (from the free Security Compliance Toolkit) or the <b>CIS Benchmarks<\/b> through Group Policy or Intune, then document every exception and the reason for it. Re-check after each feature update.<\/p><\/section>\n\n<section class=\"sec\" id=\"checklist\"><h3>3. Core checklist<\/h3>\n<table><tbody><tr><th>Control<\/th><th>Why it matters<\/th><\/tr>\n<tr><td>Microsoft Defender Antivirus on, with tamper protection<\/td><td>Stops attackers and malware from simply switching protection off.<\/td><\/tr>\n<tr><td>Attack surface reduction (ASR) rules<\/td><td>Blocks common tricks such as Office apps launching child processes and credential theft from LSASS. Start in audit mode.<\/td><\/tr>\n<tr><td>BitLocker on every laptop and desktop<\/td><td>A lost or stolen device does not become a data breach. Store recovery keys in AD or Entra ID.<\/td><\/tr>\n<tr><td>Windows Firewall on for all profiles<\/td><td>Limits lateral movement between workstations.<\/td><\/tr>\n<tr><td>Internet macros blocked in Office<\/td><td>Microsoft blocks VBA macros in files from the internet by default; don&#8217;t re-enable them by policy.<\/td><\/tr>\n<tr><td>App Control for Business or AppLocker<\/td><td>Only approved software runs, especially in user-writable folders.<\/td><\/tr>\n<tr><td>Users are not local administrators<\/td><td>Most malware and many attacks need admin rights to do real damage.<\/td><\/tr>\n<\/tbody><\/table>\n<p>Check the current state from an elevated PowerShell prompt:<\/p>\n<pre># Defender: real-time protection and tamper protection\nGet-MpComputerStatus | Select-Object RealTimeProtectionEnabled, IsTamperProtected\n\n# ASR rules configured (IDs) and their actions (0 off, 1 block, 2 audit, 6 warn)\nGet-MpPreference | Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions\n\n# BitLocker status for each drive\nGet-BitLockerVolume | Select-Object MountPoint, VolumeStatus, ProtectionStatus\n\n# Firewall enabled on Domain, Private and Public profiles\nGet-NetFirewallProfile | Select-Object Name, Enabled\n\n# Who is a local administrator?\nGet-LocalGroupMember -Group Administrators<\/pre><\/section>\n\n<section class=\"sec\" id=\"creds\"><h3>4. Protect credentials<\/h3>\n<ul class=\"l\">\n<li><b>Windows LAPS<\/b> gives every machine a unique, rotating local administrator password stored in Active Directory or Entra ID. It is built into Windows from the April 2023 updates onwards, so no separate install is needed; the older Microsoft LAPS is deprecated.<\/li>\n<li><b>Credential Guard<\/b> isolates secrets such as NTLM hashes and Kerberos tickets using virtualisation-based security. On Windows 11 22H2 and later it is turned on by default for devices that meet the licensing and hardware requirements; confirm it rather than assume it.<\/li>\n<li><b>LSA protection<\/b> runs LSASS as a protected process, making credential dumping harder.<\/li>\n<li><b>Separate admin accounts:<\/b> admins browse and read email with a normal account and use a dedicated account only for administration, ideally from a dedicated workstation.<\/li>\n<li><b>Turn off NTLMv1<\/b> and audit remaining NTLM use as a step towards Kerberos-only.<\/li>\n<\/ul>\n<pre># Credential Guard running? (1 in the list = Credential Guard)\n(Get-CimInstance -Namespace root\\Microsoft\\Windows\\DeviceGuard -ClassName Win32_DeviceGuard).SecurityServicesRunning\n\n# LSA protection configured? (1 or 2 = enabled)\nGet-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa' -Name RunAsPPL -ErrorAction SilentlyContinue\n\n# Windows LAPS: read a machine's managed password (needs permission)\nGet-LapsADPassword -Identity PC-NAME -AsPlainText<\/pre><\/section>\n\n<section class=\"sec\" id=\"network\"><h3>5. Quiet the network<\/h3>\n<p>These legacy protocols are a favourite first step in internal penetration tests, because they let an attacker on the same network capture or relay password hashes.<\/p>\n<ul class=\"l\">\n<li><b>Disable LLMNR<\/b> (Group Policy: &#8220;Turn off multicast name resolution&#8221;) and <b>NetBIOS over TCP\/IP<\/b> where nothing depends on it.<\/li>\n<li><b>Require SMB signing<\/b> and make sure <b>SMBv1<\/b> is removed.<\/li>\n<li><b>Disable WPAD<\/b> automatic proxy discovery if you don&#8217;t use it.<\/li>\n<li><b>Restrict remote management<\/b> (RDP, WinRM) to admin networks and require MFA for remote access.<\/li>\n<\/ul>\n<pre># Is the SMBv1 feature installed? (should be Disabled)\nGet-WindowsOptionalFeature -Online -FeatureName SMB1Protocol | Select-Object State\n\n# SMB server signing required?\nGet-SmbServerConfiguration | Select-Object RequireSecuritySignature, EnableSMB1Protocol<\/pre><\/section>\n\n<section class=\"sec\" id=\"logging\"><h3>6. Logging you will actually need<\/h3>\n<table><tbody><tr><th>Turn on<\/th><th>Gives you<\/th><\/tr>\n<tr><td>Advanced audit policy for logon events<\/td><td>Event IDs 4624 (logon) and 4625 (failed logon) to spot password spraying and odd logons.<\/td><\/tr>\n<tr><td>Process creation with command line<\/td><td>Event ID 4688 shows what ran and how.<\/td><\/tr>\n<tr><td>PowerShell script block logging<\/td><td>Event ID 4104 records the PowerShell code that was executed, including decoded scripts.<\/td><\/tr>\n<tr><td>Sysmon (free, from Microsoft Sysinternals)<\/td><td>Detailed process, network and file activity for investigations.<\/td><\/tr>\n<\/tbody><\/table>\n<p>Forward logs to a central server or SIEM and keep them long enough to investigate: an attacker may have been inside for weeks before anyone notices.<\/p><\/section>\n\n<section class=\"sec\" id=\"rollout\"><h3>7. Roll out safely<\/h3>\n<ol class=\"l\">\n<li>Test each change on a pilot group that includes IT, finance and anyone with unusual software.<\/li>\n<li>Use audit mode for ASR rules and application control, and review the events for a week or two.<\/li>\n<li>Switch to enforcement in rings, with a documented rollback.<\/li>\n<li>Re-verify after every Windows feature update, and keep an up-to-date asset inventory so no machine is forgotten.<\/li>\n<\/ol>\n<div class=\"callout\"><b>Tip:<\/b> a penetration test is the quickest way to prove your hardening works. See <a href=\"\/learn\/pentest-what-to-expect\/\">penetration testing: what to expect<\/a>.<\/div>\n<p class=\"small\">Sources: Microsoft Learn (Windows LAPS overview; Credential Guard overview; attack surface reduction rules reference; Microsoft Security Baselines; Windows 10 consumer ESU); CISA Known Exploited Vulnerabilities catalogue; CIS Benchmarks. Reviewed November 2026.<\/p><\/section>\n<div class=\"help\"><div><div class=\"kick\" style=\"margin-bottom:4px\">Need expert help?<\/div>\n<p style=\"font-size:17px;margin:0\"><b>MAG212 CYBER<\/b> offers network and cybersecurity consultation, penetration testing with MAG212 Atlas, and security seminars for organisations around the world.<\/p><\/div>\n<a class=\"cta\" href=\"\/services\/\">Explore our services \u2192<\/a><\/div>\n<\/div>\n<style>.m212toc,.m212more{font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif;color:#e6edf3;box-sizing:border-box}.m212toc{background:#0f1720;border:1px solid #1f2d3a;border-radius:12px;padding:14px 18px;margin:0 0 22px}.m212toc summary{cursor:pointer;font-weight:800;font-size:15px;list-style:none;display:flex;justify-content:space-between;align-items:center;gap:10px}.m212toc summary::-webkit-details-marker{display:none}.m212toc summary span{font-size:12px;font-weight:700;color:#9fb0c0}.m212toc summary::after{content:\"\u25be\";color:#3cc8f0;margin-left:auto}.m212toc details:not([open]) summary::after{content:\"\u25b8\"}.m212toc ol{margin:12px 0 0;padding:0 0 0 20px;columns:2 260px;column-gap:28px}.m212toc li{margin:0 0 6px;break-inside:avoid;font-size:14px;color:#9fb0c0}.m212toc a{color:#3cc8f0;text-decoration:none}.m212toc a:hover{text-decoration:underline}h2[id^=\"m212s-\"]{scroll-margin-top:110px}.m212more{display:flex;flex-wrap:wrap;gap:10px;margin:28px 0 8px;padding:16px;background:#0f1720;border:1px solid #1f2d3a;border-radius:12px}.m212more a{flex:1 1 200px;display:block;text-decoration:none;color:#e6edf3;background:#121c27;border:1px solid #2a3b4b;border-radius:10px;padding:10px 14px;font-size:14px;font-weight:700}.m212more a small{display:block;font-size:11px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;color:#3ee6a0;margin-bottom:2px}.m212more a:hover{border-color:#3cc8f0}<\/style><nav class=\"m212more\" aria-label=\"Keep learning\"><a href=\"\/learn\/\"><small>Back to<\/small>All learning guides<\/a><a href=\"\/learn\/passwords-mfa\/\"><small>\u2190 Previous<\/small>Passwords, passkeys &amp; MFA<\/a><a href=\"\/learn\/pentest-what-to-expect\/\"><small>Next \u2192<\/small>Penetration testing: what to expect<\/a><\/nav>\n","protected":false},"excerpt":{"rendered":"<p>MAG212 CYBER \u00b7 Learn \u00b7 Security Windows hardening: a practical checklist. The settings below close the gaps we most often see attackers and penetration testers use on Windows 11 and Windows Server networks. Start from a baseline, check each control with the PowerShell commands provided, and roll changes out in audit mode first. Stay supportedStart [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":3385,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-3814","page","type-page","status-publish","hentry"],"_hostinger_reach_plugin_has_subscription_block":false,"_hostinger_reach_plugin_is_elementor":false,"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3814"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3814\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3385"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}