> ## Documentation Index > Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt > Use this file to discover all available pages before exploring further. # Windows Server Hardening Checklist (2019, 2022 and 2025) > Windows Server hardening checklist: updates, strong passwords, account lockout, locked-down RDP, firewall, Defender, SMBv1, audit logs and backups. To harden a Windows Server 2019, 2022 or 2025 VPS or dedicated server: install all updates, use long unique passwords, set an account lockout policy, keep Network Level Authentication on and limit Remote Desktop to your own IPs or a VPN, keep Windows Firewall on with only the ports you need, keep Microsoft Defender running, confirm SMBv1 is off, audit failed logons, remove unused roles and accounts, and take backups. Each step below has a one-line PowerShell check. | Difficulty | Time | Works on | Needs | | - | - | - | - | | Intermediate | 1 to 2 hours the first time, 15 minutes a month after | Windows Server 2019 / 2022 / 2025 Standard | Administrator access, the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) as a fallback | ## Before you start * Run the commands in **PowerShell as Administrator** (right-click **Start** > **Terminal (Admin)**). * Take a [backup or snapshot](https://help.freakhosting.com/portals/vps-panel/how-to-schedule-and-restore-backups.md) first. Some steps change Remote Desktop and firewall access. * Know how to sign in with the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md). On a dedicated server, [open a ticket](https://freakhosting.com/clientarea/submitticket.php) if you need KVM/IPMI access. * Just set up the server? Do [first steps on a new Windows Server VPS](https://help.freakhosting.com/portals/other/first-steps-on-a-new-windows-server-vps.md) first. ## The checklist at a glance | # | Item | Why it matters | Guide | | - | - | - | - | | 1 | All Windows updates installed | Patches known security holes | [Install updates](https://help.freakhosting.com/portals/other/how-to-install-windows-updates-on-windows-server.md) | | 2 | Strong, unique passwords; no unused accounts | Stops password guessing | [Change the Administrator password](https://help.freakhosting.com/portals/other/how-to-change-the-administrator-password-on-windows-server.md) | | 3 | Account lockout policy set | Limits guesses per account | [Protect RDP](https://help.freakhosting.com/portals/other/how-to-protect-rdp-from-brute-force-attacks.md) | | 4 | RDP: NLA on, limited by IP or VPN | RDP is the main target of password-guessing bots | [Protect RDP](https://help.freakhosting.com/portals/other/how-to-protect-rdp-from-brute-force-attacks.md) | | 5 | Firewall on, only needed ports open | Hides everything else | [Open a port](https://help.freakhosting.com/portals/other/how-to-open-a-port-in-windows-firewall.md) | | 6 | Microsoft Defender running and updated | Catches malware | [Microsoft Defender](https://help.freakhosting.com/portals/other/how-to-use-microsoft-defender-on-windows-server.md) | | 7 | SMBv1 off, file sharing not exposed | Old protocol, widely exploited | This page | | 8 | Failed logons audited and reviewed | Shows attacks early | [Failed login attempts](https://help.freakhosting.com/portals/other/how-to-see-failed-login-attempts-on-windows-server.md) | | 9 | Only needed roles and software installed | Less to attack | [Roles and features](https://help.freakhosting.com/portals/other/how-to-install-roles-and-features-on-windows-server.md) | | 10 | Backups that you have restored once | Recovery after an incident | [Back up a Windows server](https://help.freakhosting.com/portals/other/how-to-back-up-a-windows-server.md) | ## 1. Install all updates Updates fix security holes that attackers scan for. Run **Settings > Windows Update > Check for updates** (on Windows Server 2019: **Settings > Update & Security > Windows Update**), or SConfig option **6**, until nothing is left. Restart when asked. Check the last installed update: ```powershell theme={null} Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 ``` ## 2. Use strong passwords and remove unused accounts * Give every account that can sign in a long, unique password (16+ characters from a password manager). * Keep a second administrator account with a different name, so you are not locked out if `Administrator` is. * Remove or disable accounts nobody uses. ```powershell theme={null} Get-LocalUser | Format-Table Name, Enabled, LastLogon Get-LocalGroupMember -Group "Administrators" Get-LocalGroupMember -Group "Remote Desktop Users" ``` Disable an unused account with `Disable-LocalUser -Name "olduser"`. ## 3. Set an account lockout policy In `secpol.msc`, open **Security Settings > Account Policies > Account Lockout Policy** and set the threshold, duration and reset counter. Microsoft's baseline recommendation is **10 attempts / 10 minutes / 10 minutes** ([KB5020282](https://support.microsoft.com/en-us/topic/kb5020282-account-lockout-available-for-local-administrators-bce45c4d-f28d-43ad-b6fe-70156cb2dc00)). Full steps and the lock-out risks are in [protect RDP from brute-force attacks](https://help.freakhosting.com/portals/other/how-to-protect-rdp-from-brute-force-attacks.md). ## 4. Lock down Remote Desktop * Keep **Network Level Authentication** on: `SConfig` > **7** > **E** > **1**. * Limit the Remote Desktop rules to your IPs: ```powershell theme={null} Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 203.0.113.25 ``` * Better still, reach RDP only through a [VPN](https://help.freakhosting.com/portals/other/how-to-set-up-a-vpn-on-windows-server.md), or use RD Gateway for teams. * Optionally move RDP off port 3389 to reduce bot noise: [change the RDP port](https://help.freakhosting.com/portals/other/how-to-change-the-rdp-port-on-windows-server.md). > [!WARNING] > > Test a **new** Remote Desktop connection before you close your current one after any RDP or firewall change. If you lock yourself out, use the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md). ## 5. Keep Windows Firewall on and tight Check all three profiles are on and block unrequested inbound traffic: ```powershell theme={null} Get-NetFirewallProfile | Format-Table Name, Enabled, DefaultInboundAction, DefaultOutboundAction ``` `Enabled` should be `True` for `Domain`, `Private` and `Public`. If one is off: ```powershell theme={null} Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True ``` Review what is open and remove rules you don't need: ```powershell theme={null} Get-NetFirewallRule -Enabled True -Direction Inbound -Action Allow | Sort-Object DisplayName | Format-Table DisplayName, Profile ``` Limit admin and database ports (for example SQL Server on 1433, MySQL on 3306, and WinRM) to your own IPs with `-RemoteAddress`. To log dropped connections for troubleshooting: ```powershell theme={null} Set-NetFirewallProfile -Profile Domain,Public,Private -LogBlocked True ``` The log is written to `%windir%\system32\logfiles\firewall\pfirewall.log`. ## 6. Keep Microsoft Defender on and updated ```powershell theme={null} Get-MpComputerStatus | Select-Object AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated Update-MpSignature ``` Defender is installed and enabled by default on Windows Server 2016 and later. Run a scan with `Start-MpScan -ScanType QuickScan`. See [use Microsoft Defender](https://help.freakhosting.com/portals/other/how-to-use-microsoft-defender-on-windows-server.md). ## 7. Make sure SMBv1 is off SMBv1 is the old Windows file-sharing protocol. It isn't installed by default on Windows Server 2019 and later, but check, especially on servers built from older images: ```powershell theme={null} Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol ``` If it shows `True`, turn it off (no restart needed): ```powershell theme={null} Set-SmbServerConfiguration -EnableSMB1Protocol $false ``` Don't expose file sharing (TCP 445) to the internet. If you need to share files with the server, use a VPN or [SFTP](https://help.freakhosting.com/portals/other/how-to-transfer-files-with-sftp-winscp-and-filezilla.md). ## 8. Audit and review failed logons Make sure failed logons are recorded, then check them regularly: ```powershell theme={null} auditpol /get /subcategory:"Logon" Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 ``` Thousands of 4625 events a day mean bots are guessing passwords; tighten step 4. See [see failed login attempts](https://help.freakhosting.com/portals/other/how-to-see-failed-login-attempts-on-windows-server.md). ## 9. Remove roles, features and software you don't use Every installed service is something to patch and secure. List installed roles and features: ```powershell theme={null} Get-WindowsFeature | Where-Object Installed | Format-Table Name, DisplayName ``` Remove what you don't need with `Uninstall-WindowsFeature -Name ` and uninstall unused programs in **Settings > Apps**. See [install roles and features](https://help.freakhosting.com/portals/other/how-to-install-roles-and-features-on-windows-server.md). ## 10. Back up, and test a restore * On a VPS, [schedule panel backups](https://help.freakhosting.com/portals/vps-panel/how-to-schedule-and-restore-backups.md). * Inside Windows, use Windows Server Backup for files and system state: [back up a Windows server](https://help.freakhosting.com/portals/other/how-to-back-up-a-windows-server.md). * Restore one backup to check it works. A backup you have never restored is a guess. ## Going further: Microsoft security baselines For a stricter, documented configuration, Microsoft publishes security baselines for each Windows Server release as part of the [Security Compliance Toolkit](https://learn.microsoft.com/en-us/windows/device-security/security-compliance-toolkit-10). They are Group Policy settings you can review and apply. Test them on a copy of your server first, because some settings can block Remote Desktop or applications. ## How to check it worked: a monthly 2-minute audit ```powershell theme={null} Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 Get-NetFirewallProfile | Format-Table Name, Enabled Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Get-NetFirewallAddressFilter | Format-Table RemoteAddress Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusSignatureLastUpdated Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol Get-LocalGroupMember -Group "Administrators" (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue).Count ``` You want a recent update, all profiles `True`, RDP limited to your addresses (not `Any`), real-time protection `True`, SMB1 `False`, only expected administrators, and a low failed-logon count. ## Frequently asked questions ### What are the most important steps if I only have 10 minutes? Install updates, set a strong Administrator password, and limit Remote Desktop to your own IP. Those three deal with the most common automated attacks on a new Windows server. ### Should I rename the Administrator account? It makes guessing harder, because bots try `Administrator` first. Rename it only after a second admin account works, and update your saved RDP connections. ### Do I need third-party antivirus on Windows Server? Microsoft Defender Antivirus is built in and enabled by default on Windows Server 2016 and later. Keep it updated. If you choose another product, check how it works alongside Defender. ### Should I allow ping? It is optional. Answering ping helps monitoring and troubleshooting and has little security impact; you can limit it to trusted IPs. See [allow ping through Windows Firewall](https://help.freakhosting.com/portals/other/how-to-enable-icmp-on-windows.md). ### Is the Windows Server checklist different for 2019, 2022 and 2025? The steps are the same. Menu names differ a little (Settings layout on 2019), and newer releases have newer defaults, which is why each step includes a check command. ## Related guides > [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md) > > Every guide in this section. > [card] [First steps on Windows Server](https://help.freakhosting.com/portals/other/first-steps-on-a-new-windows-server-vps.md) > > Set up a new server. > [card] [Protect RDP from brute force](https://help.freakhosting.com/portals/other/how-to-protect-rdp-from-brute-force-attacks.md) > > Lockout, NLA, IP limits and VPN. > [card] [Open a port in Windows Firewall](https://help.freakhosting.com/portals/other/how-to-open-a-port-in-windows-firewall.md) > > Inbound rules done right. > [card] [Use Microsoft Defender](https://help.freakhosting.com/portals/other/how-to-use-microsoft-defender-on-windows-server.md) > > Scans and updates. > [card] [Linux server security checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md) > > The same for Linux servers. *** > [!NOTE] > > **Checked against Microsoft Learn and Microsoft Support: [Configure firewall rules with PowerShell](https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line), [Set-NetFirewallProfile](https://learn.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile), [SMBv1 detection](https://learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3), [Defender Antivirus on Windows Server](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-on-windows-server), [KB5020282](https://support.microsoft.com/en-us/topic/kb5020282-account-lockout-available-for-local-administrators-bce45c4d-f28d-43ad-b6fe-70156cb2dc00) and [SConfig](https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig)** on 4 November 2026. Commands were not tested on a live Windows server for this page; menu names can differ slightly between Windows Server 2019, 2022 and 2025. > [!NOTE] > > ### Need Extra Help? > > If you encounter any issues, our support team is ready to assist: > > * **Live Chat:** Quick assistance via our website. > * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php) > * **Discord:** [Join our Community](https://discord.gg/freakhosting) > * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com) > [!TIP] > > ### Save on Your Hosting > > Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order! *** **Last Updated:** November 2026 This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.