Lab: hardening a Windows workstation

Aim and what you need

The aim is to take a default Windows workstation and apply the controls that matter most, using built-in features only. These steps match the spirit of the CIS Benchmarks and the Microsoft Security Baselines, which you should use for the full list at work.

• A Windows 11 virtual machine, for example from Microsoft's evaluation images, in your lab. Give it a virtual TPM if you want to test BitLocker.
• A snapshot taken before you start.
• PowerShell opened as administrator.

Plan

Steps

1. Update: install all Windows updates from Settings, then update apps.
2. Accounts: create a standard (non-admin) user for daily work and keep the admin account for changes only. Check that Guest is disabled.
3. Password and lockout policy: set a long minimum length and lock accounts after repeated failures.
4. Defender: update signatures and turn on blocking of potentially unwanted apps (PUA).
5. Firewall: turn on all three profiles.
6. Legacy protocols: remove SMB version 1.
7. Auditing: record successful and failed logons.
8. Encryption: turn on BitLocker for the system drive (from Settings or with manage-bde), and store the recovery key safely.

winget upgrade --all
New-LocalUser -Name "labuser" -Password (Read-Host -AsSecureString "Password")
Add-LocalGroupMember -Group "Users" -Member "labuser"
Get-LocalUser | Select-Object Name, Enabled
Disable-LocalUser -Name "Guest"
net accounts /minpwlen:14 /lockoutthreshold:5 /lockoutduration:15 /lockoutwindow:15
Update-MpSignature
Set-MpPreference -PUAProtection Enabled
Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
manage-bde -on C: -RecoveryPassword

Tip: standard users cannot install most software or change system settings. That single change stops a large share of malware from doing lasting damage.

Verify

Run these checks after a restart. Success means: real-time protection and the antivirus service are True; all firewall profiles are enabled; SMB1Protocol is Disabled; net accounts shows your length and lockout values; logon auditing shows Success and Failure; BitLocker shows protection on.

Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated
Get-NetFirewallProfile | Select-Object Name, Enabled
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
net accounts
auditpol /get /subcategory:"Logon"
manage-bde -status C:

Then test like a user: sign in as labuser and try to install software (you should get an admin prompt). Enter a wrong password five times on a test account and confirm it locks. Open Event Viewer, Windows Logs, Security, and find event ID 4625 for the failed logons.

Troubleshooting and clean-up

• BitLocker will not start: the VM has no TPM. Add a virtual TPM in the hypervisor settings, or skip this step in the lab.
• An app breaks after removing SMBv1: very old devices such as some printers and NAS boxes need it. Replace or isolate them rather than turning SMBv1 back on.
• Commands are refused: PowerShell is not running as administrator.
• Settings change back: on a domain-joined machine, Group Policy or Intune will override local settings.

Record every change in a simple table (setting, old value, new value, reason). Restore the snapshot if you want to repeat the lab, and delete the recovery key file from any shared location. At work, the same settings are pushed centrally with Group Policy or Intune, and Windows LAPS manages unique local admin passwords.