Group Policy Security Hardening for Windows Environments

Overview

Group Policy is the primary mechanism for enforcing security baselines across Windows environments. A well-designed GPO structure can prevent credential theft, block lateral movement, restrict unauthorized software, and ensure compliance with frameworks like CIS Benchmarks, NIST 800-53, and PCI DSS.

Who Should Use This Guide:

• Systems administrators hardening Windows domains
• Security engineers implementing CIS benchmarks
• Compliance teams preparing for audits
• MSP technicians standardizing client security

What You Will Learn:

Requirements

Warning: Test all GPO changes in a dedicated test OU before deploying to production. Aggressive security policies can lock out users or break applications.

GPO Naming Convention

Use a consistent naming standard:

[Category] - [Purpose] - [Scope]

Examples:
  Security - Password Policy - Domain
  Security - Workstation Hardening - Workstations OU
  Security - Server Baseline - Servers OU
  Security - AppLocker - IT Department
  Compliance - Audit Policy - Domain

Part 1: Password and Account Lockout Policies

These apply at the domain level via Default Domain Policy or a dedicated GPO linked to the domain root.

Path: Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies

Password Policy

Account Lockout Policy

# Verify current domain password policy
Get-ADDefaultDomainPasswordPolicy
 
# Check fine-grained password policies
Get-ADFineGrainedPasswordPolicy -Filter *

Part 2: Advanced Audit Policies

Path: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration

Recommended Audit Settings

# Force audit policy to use advanced settings
# Computer Configuration > Security Settings > Local Policies > Security Options
# "Audit: Force audit policy subcategory settings" = Enabled
 
# Verify audit policy on a computer
auditpol /get /category:*

Configure Event Log Size

Path: Computer Configuration > Policies > Administrative Templates > Windows Components > Event Log Service

Part 3: Security Options (LSA Hardening)

Path: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options

Critical Settings

LSA Protection

# Enable LSA protection (prevents credential dumping)
# Computer Configuration > Administrative Templates > System > Local Security Authority
# "Configure LSASS to run as a protected process" = Enabled (with UEFI Lock)

Credential Guard

# Enable Credential Guard on supported hardware
# Computer Configuration > Administrative Templates > System > Device Guard
# "Turn On Virtualization Based Security" = Enabled
# "Credential Guard Configuration" = Enabled with UEFI lock

Part 4: AppLocker (Application Whitelisting)

Path: Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker

Default Rules (Start Here)

# Create default rules first (allows Windows and Program Files)
# In GPMC > AppLocker > right-click each rule type > Create Default Rules
 
# Executable Rules:
# - Allow Everyone to run from %PROGRAMFILES%\*
# - Allow Everyone to run from %WINDIR%\*
# - Allow BUILTIN\Administrators to run all files
 
# Script Rules:
# - Allow Everyone to run from %PROGRAMFILES%\*
# - Allow Everyone to run from %WINDIR%\*
 
# MSI Rules:
# - Allow Everyone to run from %WINDIR%\Installer\*
# - Allow BUILTIN\Administrators to run all MSI files

Block High-Risk Locations

# Block executables from user-writable locations
# Add Deny rules for:
# - %USERPROFILE%\AppData\*
# - %USERPROFILE%\Desktop\*
# - %USERPROFILE%\Downloads\*
# - %TEMP%\*
# - %TMP%\*
 
# Exception: Allow specific approved applications from these paths

Enable AppLocker Service

# Ensure AppIdentity service starts automatically
# Computer Configuration > Windows Settings > Security Settings > System Services
# Application Identity = Automatic

Part 5: Windows Firewall

Path: Computer Configuration > Policies > Windows Settings > Security Settings > Windows Defender Firewall

Profile Configuration

Recommended Inbound Rules

Part 6: Attack Surface Reduction (ASR) Rules

Configure ASR rules for advanced endpoint hardening (requires Defender AV):

Path: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction

Recommended ASR Rules

# Check ASR rule status on a machine
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

GPO Deployment Strategy

Recommended Deployment Order

1. Password Policy — Link to domain root (test in lab first)
2. Audit Policy — Link to domain root
3. Workstation Hardening — Link to Workstations OU (test OU first)
4. Server Baseline — Link to Servers OU (test OU first)
5. AppLocker — Start in Audit mode for 2 weeks, then enforce
6. ASR Rules — Start in Audit mode, review events, then enforce

Testing Methodology

# 1. Create a Test OU
New-ADOrganizationalUnit -Name "GPO-Testing" -Path "DC=domain,DC=local"
 
# 2. Move test computers to Test OU
Move-ADObject -Identity "CN=TESTPC01,OU=Workstations,DC=domain,DC=local" `
    -TargetPath "OU=GPO-Testing,DC=domain,DC=local"
 
# 3. Link GPO to Test OU
New-GPLink -Name "Security - Workstation Hardening" `
    -Target "OU=GPO-Testing,DC=domain,DC=local"
 
# 4. Force GPO update on test machine
Invoke-GPUpdate -Computer "TESTPC01" -Force
 
# 5. Verify GPO application
gpresult /r /scope computer

Verification Checklist

• Password policy meets CIS benchmark requirements
• Account lockout configured to prevent brute force
• Advanced audit policies generating expected events
• Security event log sized for 30+ days retention
• NTLMv2 only authentication enforced
• SMB signing required on all machines
• LSA protection enabled (no credential dumping)
• AppLocker blocking unsigned executables from user paths
• Windows Firewall enabled on all profiles
• ASR rules active (at least in audit mode)
• All changes tested in test OU before production deployment

References

• CIS Benchmarks for Windows
• Microsoft Security Baselines
• NIST 800-53 Security Controls
• ASR Rules Reference