Windows Server Hardening Checklist (2019, 2022 and 2025)

To harden a Windows Server 2019, 2022 or 2025 VPS or dedicated server: install all updates, use long unique passwords, set an account lockout policy, keep Network Level Authentication on and limit Remote Desktop to your own IPs or a VPN, keep Windows Firewall on with only the ports you need, keep Microsoft Defender running, confirm SMBv1 is off, audit failed logons, remove unused roles and accounts, and take backups. Each step below has a one-line PowerShell check.

Difficulty	Time	Works on	Needs
Intermediate	1 to 2 hours the first time, 15 minutes a month after	Windows Server 2019 / 2022 / 2025 Standard	Administrator access, the VNC console as a fallback

Before you start

Run the commands in PowerShell as Administrator (right-click Start > Terminal (Admin)).
Take a backup or snapshot first. Some steps change Remote Desktop and firewall access.
Know how to sign in with the VNC console. On a dedicated server, open a ticket if you need KVM/IPMI access.
Just set up the server? Do first steps on a new Windows Server VPS first.

The checklist at a glance

#	Item	Why it matters	Guide
1	All Windows updates installed	Patches known security holes	Install updates
2	Strong, unique passwords; no unused accounts	Stops password guessing	Change the Administrator password
3	Account lockout policy set	Limits guesses per account	Protect RDP
4	RDP: NLA on, limited by IP or VPN	RDP is the main target of password-guessing bots	Protect RDP
5	Firewall on, only needed ports open	Hides everything else	Open a port
6	Microsoft Defender running and updated	Catches malware	Microsoft Defender
7	SMBv1 off, file sharing not exposed	Old protocol, widely exploited	This page
8	Failed logons audited and reviewed	Shows attacks early	Failed login attempts
9	Only needed roles and software installed	Less to attack	Roles and features
10	Backups that you have restored once	Recovery after an incident	Back up a Windows server

1. Install all updates

Updates fix security holes that attackers scan for. Run Settings > Windows Update > Check for updates (on Windows Server 2019: Settings > Update & Security > Windows Update), or SConfig option 6, until nothing is left. Restart when asked. Check the last installed update:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

2. Use strong passwords and remove unused accounts

Give every account that can sign in a long, unique password (16+ characters from a password manager).
Keep a second administrator account with a different name, so you are not locked out if Administrator is.
Remove or disable accounts nobody uses.

Get-LocalUser | Format-Table Name, Enabled, LastLogon
Get-LocalGroupMember -Group "Administrators"
Get-LocalGroupMember -Group "Remote Desktop Users"

Disable an unused account with Disable-LocalUser -Name "olduser".

3. Set an account lockout policy

In secpol.msc, open Security Settings > Account Policies > Account Lockout Policy and set the threshold, duration and reset counter. Microsoft’s baseline recommendation is 10 attempts / 10 minutes / 10 minutes (KB5020282). Full steps and the lock-out risks are in protect RDP from brute-force attacks.

4. Lock down Remote Desktop

Keep Network Level Authentication on: SConfig > 7 > E > 1.
Limit the Remote Desktop rules to your IPs:

Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 203.0.113.25

Better still, reach RDP only through a VPN, or use RD Gateway for teams.
Optionally move RDP off port 3389 to reduce bot noise: change the RDP port.

Test a new Remote Desktop connection before you close your current one after any RDP or firewall change. If you lock yourself out, use the VNC console.

5. Keep Windows Firewall on and tight

Check all three profiles are on and block unrequested inbound traffic:

Get-NetFirewallProfile | Format-Table Name, Enabled, DefaultInboundAction, DefaultOutboundAction

Enabled should be True for Domain, Private and Public. If one is off:

Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

Review what is open and remove rules you don’t need:

Get-NetFirewallRule -Enabled True -Direction Inbound -Action Allow | Sort-Object DisplayName | Format-Table DisplayName, Profile

Limit admin and database ports (for example SQL Server on 1433, MySQL on 3306, and WinRM) to your own IPs with -RemoteAddress. To log dropped connections for troubleshooting:

Set-NetFirewallProfile -Profile Domain,Public,Private -LogBlocked True

The log is written to %windir%\system32\logfiles\firewall\pfirewall.log.

6. Keep Microsoft Defender on and updated

Get-MpComputerStatus | Select-Object AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated
Update-MpSignature

Defender is installed and enabled by default on Windows Server 2016 and later. Run a scan with Start-MpScan -ScanType QuickScan. See use Microsoft Defender.

7. Make sure SMBv1 is off

SMBv1 is the old Windows file-sharing protocol. It isn’t installed by default on Windows Server 2019 and later, but check, especially on servers built from older images:

Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol

If it shows True, turn it off (no restart needed):

Set-SmbServerConfiguration -EnableSMB1Protocol $false

Don’t expose file sharing (TCP 445) to the internet. If you need to share files with the server, use a VPN or SFTP.

8. Audit and review failed logons

Make sure failed logons are recorded, then check them regularly:

auditpol /get /subcategory:"Logon"
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20

Thousands of 4625 events a day mean bots are guessing passwords; tighten step 4. See see failed login attempts.

9. Remove roles, features and software you don’t use

Every installed service is something to patch and secure. List installed roles and features:

Get-WindowsFeature | Where-Object Installed | Format-Table Name, DisplayName

Remove what you don’t need with Uninstall-WindowsFeature -Name <Name> and uninstall unused programs in Settings > Apps. See install roles and features.

10. Back up, and test a restore

On a VPS, schedule panel backups.
Inside Windows, use Windows Server Backup for files and system state: back up a Windows server.
Restore one backup to check it works. A backup you have never restored is a guess.

Going further: Microsoft security baselines

For a stricter, documented configuration, Microsoft publishes security baselines for each Windows Server release as part of the Security Compliance Toolkit. They are Group Policy settings you can review and apply. Test them on a copy of your server first, because some settings can block Remote Desktop or applications.

How to check it worked: a monthly 2-minute audit

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1
Get-NetFirewallProfile | Format-Table Name, Enabled
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Get-NetFirewallAddressFilter | Format-Table RemoteAddress
Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusSignatureLastUpdated
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol
Get-LocalGroupMember -Group "Administrators"
(Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue).Count

You want a recent update, all profiles True, RDP limited to your addresses (not Any), real-time protection True, SMB1 False, only expected administrators, and a low failed-logon count.

Frequently asked questions

What are the most important steps if I only have 10 minutes?

Install updates, set a strong Administrator password, and limit Remote Desktop to your own IP. Those three deal with the most common automated attacks on a new Windows server.

Should I rename the Administrator account?

It makes guessing harder, because bots try Administrator first. Rename it only after a second admin account works, and update your saved RDP connections.

Do I need third-party antivirus on Windows Server?

Microsoft Defender Antivirus is built in and enabled by default on Windows Server 2016 and later. Keep it updated. If you choose another product, check how it works alongside Defender.

Should I allow ping?

It is optional. Answering ping helps monitoring and troubleshooting and has little security impact; you can limit it to trusted IPs. See allow ping through Windows Firewall.

Is the Windows Server checklist different for 2019, 2022 and 2025?

The steps are the same. Menu names differ a little (Settings layout on 2019), and newer releases have newer defaults, which is why each step includes a check command.

VPS and dedicated server guides

Every guide in this section.

First steps on Windows Server

Set up a new server.

Protect RDP from brute force

Lockout, NLA, IP limits and VPN.

Open a port in Windows Firewall

Inbound rules done right.

Use Microsoft Defender

Scans and updates.

Linux server security checklist

The same for Linux servers.

Checked against Microsoft Learn and Microsoft Support: Configure firewall rules with PowerShell, Set-NetFirewallProfile, SMBv1 detection, Defender Antivirus on Windows Server, KB5020282 and SConfig on 4 November 2026. Commands were not tested on a live Windows server for this page; menu names can differ slightly between Windows Server 2019, 2022 and 2025.

Need Extra Help?

If you encounter any issues, our support team is ready to assist:

Live Chat: Quick assistance via our website.
Support Ticket: Open a Ticket
Discord: Join our Community
Email: support@freakhosting.com

Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!

Last Updated: November 2026

​Before you start

​The checklist at a glance

​1. Install all updates

​2. Use strong passwords and remove unused accounts

​3. Set an account lockout policy

​4. Lock down Remote Desktop

​5. Keep Windows Firewall on and tight

​6. Keep Microsoft Defender on and updated

​7. Make sure SMBv1 is off

​8. Audit and review failed logons

​9. Remove roles, features and software you don’t use

​10. Back up, and test a restore

​Going further: Microsoft security baselines

​How to check it worked: a monthly 2-minute audit

​Frequently asked questions

​What are the most important steps if I only have 10 minutes?

​Should I rename the Administrator account?

​Do I need third-party antivirus on Windows Server?

​Should I allow ping?

​Is the Windows Server checklist different for 2019, 2022 and 2025?

​Related guides

VPS and dedicated server guides

First steps on Windows Server

Protect RDP from brute force

Open a port in Windows Firewall

Use Microsoft Defender

Linux server security checklist

​Need Extra Help?

​Save on Your Hosting

Before you start

The checklist at a glance

1. Install all updates

2. Use strong passwords and remove unused accounts

3. Set an account lockout policy

4. Lock down Remote Desktop

5. Keep Windows Firewall on and tight

6. Keep Microsoft Defender on and updated

7. Make sure SMBv1 is off

8. Audit and review failed logons

9. Remove roles, features and software you don’t use

10. Back up, and test a restore

Going further: Microsoft security baselines

How to check it worked: a monthly 2-minute audit

Frequently asked questions

What are the most important steps if I only have 10 minutes?

Should I rename the Administrator account?

Do I need third-party antivirus on Windows Server?

Should I allow ping?

Is the Windows Server checklist different for 2019, 2022 and 2025?

Related guides

Need Extra Help?

Save on Your Hosting