Security · Topic 9 of 13
Workstation Security and Hardening
Harden a workstation with strong passwords, BIOS and UEFI protection, account limits, screen locks, disabling AutoRun, patching and fewer services.
- 4 min
- Use long, unique passwords and a password manager.
- Set a BIOS or UEFI password and keep Secure Boot on.
- Disable the guest account and rename or disable the default administrator.
What it is
Hardening means reducing the ways a computer can be attacked. A technician turns off what is not needed, tightens account rules, keeps software current and protects the firmware. The aim is a smaller attack surface, which is the total set of places where an attacker could try to get in.
How it works
Password best practices
| Practice | Why it helps |
|---|---|
| Length | Longer passwords are much harder to guess or crack |
| Complexity | Mixing upper case, lower case, numbers and symbols widens the possibilities |
| Uniqueness | A different password per account limits damage from one leak |
| Expiration | Forces periodic change, though long unique passwords matter more than frequent changes |
| Basic Input/Output System (BIOS) or Unified Extensible Firmware Interface (UEFI) password | Stops others changing boot order or settings, and can require a password to start |
A password manager creates and stores long, unique passwords so users do not reuse them. Never write passwords on notes near the computer.
BIOS and UEFI protection
The firmware controls how the computer starts. Setting a firmware password stops someone from booting from a Universal Serial Bus (USB) drive to bypass the operating system (OS).
Secure Boot checks that the boot software is trusted. Disabling unused boot devices and enabling the Trusted Platform Module (TPM) add further protection.
Account management
- Restrict user permissions. Apply least privilege and avoid local administrator rights for daily work.
- Restrict login times. Allow sign in only during work hours for accounts that should not be used at night.
- Disable the guest account. An unused account is an easy target.
- Rename or disable the default administrator account. Attackers know the name Administrator, so changing it or disabling it removes an easy guess. Also change any default password.
- Account lockout. Lock the account after several failed sign in attempts to slow guessing.
- Timeout and screen lock. Lock the screen after a short idle time, and require a password to resume.
Account expiration dates
Temporary and contractor accounts should have an end date so they disable themselves. Set it in Active Directory on the Account tab, or locally with net user jsmith /expires:12/31/2026. The date format follows the regional settings, and /expires:never removes the limit.
End user habits
Users should lock the screen when they leave (Windows key plus L), log off when they finish, secure laptops physically, and protect personally identifiable information (PII) and passwords. A clean desk policy keeps papers with sensitive data out of sight.
Disable AutoRun and AutoPlay
AutoRun can start a program as soon as a drive is inserted, and malware on a USB drive can use that.
AutoPlay shows a prompt for what to do with media. Turning these off, or setting them to take no action, blocks that route.
Local policy and services
The Local Group Policy Editor (gpedit.msc) can enforce rules such as password length, lockout and AutoRun settings. Disable services and ports that the workstation does not need, such as unused remote access features. Fewer running services means fewer places to attack.
Patch and update management
Apply operating system and application updates regularly, and prefer automatic updates on home machines. In a business, test patches first, then deploy them on a schedule. Patching closes flaws that malware targets.
Data at rest
Turn on drive encryption, such as BitLocker, on laptops and other portable devices so a lost device does not mean lost data.
In a hardening scenario, pick the option that removes an unneeded feature or tightens an account. Changing a default administrator account name is a common correct answer.
What to remember for the exam
- Use long, unique passwords and a password manager.
- Set a BIOS or UEFI password and keep Secure Boot on.
- Disable the guest account and rename or disable the default administrator.
- Account lockout slows password guessing.
- Use screen locks and idle timeouts.
- Disable AutoRun and AutoPlay to block malware on removable media.
gpedit.mscenforces local policy on Pro and above.- Patch the OS and applications regularly.
- Encrypt portable devices.
Common mistakes
Believing frequent expiration is always the best control. Long unique passwords with multifactor authentication (MFA) usually help more than forced frequent changes.
Leaving the default administrator unchanged. Attackers try that account name first.
Forgetting firmware. A user can bypass the OS password by booting from other media if the firmware is open.
Disabling updates to avoid interruptions. This leaves known flaws open.
Check yourself
Why disable AutoRun?
It prevents a program on inserted media, such as a USB drive, from starting automatically.
What does account lockout do?
It locks an account after several failed sign in attempts, which slows guessing attacks.
Which setting stops someone booting from a USB drive to bypass the OS?
A BIOS or UEFI password with the boot order restricted.
Topic 9 of 13 in Security
Test yourself on Security
The full CompTIA A+ 220-1202 question bank has 835 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.