Endpoint Protection · Topic 3 of 9
Windows Hardening, Active Directory and Network Services
Harden Windows by removing services and legacy protocols, follow Active Directory best practices and secure SMB, RDP, DNS, LDAP, Kerberos and WinRM.
- 4 min
- Hardening = disable what you do not need, patch, restrict, audit.
- SMB 445, RDP 3389, LDAP 389, LDAPS 636, Kerberos 88, WinRM 5985/5986.
- Do not expose RDP directly to the internet.
What it is
Hardening means shrinking the attack surface of a system by removing or restricting everything it does not need. Active Directory (AD) is the central identity store of a Windows network, so its compromise is a compromise of everything. Windows network services such as SMB and RDP are the doors attackers try first.
How it works
Windows OS hardening techniques
- Patch the OS and applications.
- Disable unused services, features and roles, and uninstall unneeded software.
- Disable legacy protocols: SMBv1, LLMNR and NetBIOS over TCP/IP where possible, and restrict NTLM.
- Enable the host firewall with default deny inbound.
- Run antimalware and keep it updated.
- Encrypt drives with BitLocker.
- Enable Secure Boot and protect firmware settings with a password.
- Remove local administrator rights from daily users and rename or disable the built in Administrator.
- Turn on auditing and forward logs to a central system.
- Restrict removable media and disable AutoRun.
- Application control with AppLocker or App Control for Business.
- Apply a baseline (CIS, STIG or Microsoft) with Group Policy.
Active Directory security best practices
| Practice | Why |
|---|---|
| Few members in Domain Admins, Enterprise Admins and Schema Admins | Limits the highest privileges |
| Separate admin accounts and tiered administration | Domain admin credentials should not touch workstations |
| Protected Users group for sensitive accounts | Blocks weaker authentication methods for them |
| Strong, long passwords and MFA for admins | Protects privileged identities |
| Windows LAPS for local administrators | Stops lateral movement with a shared password |
| Secure domain controllers | Physically protected, minimal software, patched first |
| Disable NTLM and SMBv1 where possible | Removes old weaknesses |
| Require LDAP signing and use LDAPS | Protects directory traffic |
| Reset the krbtgt account password periodically | Invalidates forged tickets |
| Backups and Active Directory Recycle Bin | Recovery from deletion or ransomware |
| Audit changes to privileged groups and Group Policy | Early detection of abuse |
Regular AD security assessments with tools such as BloodHound (for defenders, to find risky attack paths) or Microsoft Defender for Identity help find weak settings.
Windows network services and protocol security
| Service | Port | Security notes |
|---|---|---|
| SMB / file sharing | TCP 445 | Disable SMBv1, require SMB signing, block at the perimeter |
| RDP | TCP 3389 | Do not expose directly to the internet. Use VPN or gateway, MFA and Network Level Authentication. |
| NetBIOS | UDP 137, 138, TCP 139 | Legacy, disable where possible |
| RPC endpoint mapper | TCP 135 | Restrict between segments |
| LDAP / LDAPS | 389 / 636 | Prefer LDAPS or signing. Global catalog uses 3268 / 3269. |
| Kerberos | 88 | Default domain authentication |
| DNS | 53 | Secure dynamic updates, restrict zone transfers |
| DHCP | UDP 67, 68 | Protect with DHCP snooping on switches |
| WinRM | TCP 5985 (HTTP), 5986 (HTTPS) | Prefer HTTPS, limit to admin hosts |
| NTP | UDP 123 | Needed for Kerberos, which depends on close clock agreement |
General rules: expose only the ports required, segment servers from workstations, use the host firewall to limit who can connect, and prefer encrypted variants of every protocol.
A worked example
A scan of the network finds RDP open to the internet on a file server and SMBv1 enabled. The defender closes the port at the perimeter, publishes RDP only behind a VPN with MFA, disables SMBv1 by policy and turns on SMB signing. Failed logons (event 4625) from the internet cease.
How the exam asks about this
- "Which TCP port does RDP use?" → 3389.
- "Which AD group should have very few members because it has the highest privileges?" → Domain Admins (and Enterprise Admins).
- "Which obsolete file sharing protocol version should be disabled?" → SMBv1.
What to remember for the exam
- Hardening = disable what you do not need, patch, restrict, audit.
- SMB 445, RDP 3389, LDAP 389, LDAPS 636, Kerberos 88, WinRM 5985/5986.
- Do not expose RDP directly to the internet.
- Keep privileged accounts few, separate and protected, and secure domain controllers first.
- Kerberos needs synchronized clocks, so NTP matters.
Disabling a service can break a dependency. Test hardening changes on a pilot system before rolling them out.
Common mistakes
Using admin accounts for email and browsing. Privileged credentials then live on exposed workstations.
Thinking a firewall at the edge is enough. Internal segmentation and host firewalls stop lateral movement.
Leaving legacy protocols for compatibility. Each one is a known weakness. Remove it or document the exception.
Check yourself
Why are Domain Admins kept to a minimum?
Membership gives control of the entire domain, so a stolen account is catastrophic.
Which ports secure WinRM sessions?
TCP 5986 for WinRM over HTTPS (5985 is the unencrypted HTTP listener).
How should RDP be exposed safely?
Not directly to the internet, but behind a VPN or gateway with MFA and Network Level Authentication.
Topic 3 of 9 in Endpoint Protection
Test yourself on Endpoint Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.