Microsoft details the best ways to harden Windows Server against modern cyberattacks

Cyberattacks have become more common these days than they used to be. As technology is booming, cyberattackers are discovering new ways to hack into systems. That’s exactly why Microsoft has outlined a fresh guide explaining how Windows Server administrators can better protect their environments. The company highlights several security measures that reduce attack surfaces, block modern threats, and keep servers compliant without relying on a single defense.

Microsoft recommends a layered approach to Windows Server security

At the top of the list is OSConfig, which applies Microsoft’s role-specific security baselines for Windows Server 2025. It also detects configuration drift and restores approved settings automatically.

Microsoft also recommends running Secured-core hardware with TPM 2.0, Secure Boot, virtualization-based security, and Credential Guard enabled. These features help stop firmware attacks, bootkits, and credential theft.
Another recommendation is deploying Server Core whenever possible. The smaller installation removes unnecessary components and reduces the number of potential attack vectors.

Keeping servers fully patched remains equally important. Microsoft suggests using deployment rings, Azure Update Manager, and continuous vulnerability assessments to address newly discovered flaws quickly.

Defender, App Control, and firewall protection complete the picture

Microsoft also wants organizations to enable Microsoft Defender Antivirus, Defender for Endpoint, and tamper protection while keeping antivirus exclusions to a minimum.

The guide recommends enabling Attack Surface Reduction (ASR) rules and Network Protection in audit mode before switching to enforcement after testing. For stronger application security, Microsoft highlights App Control for Business, which allows only trusted applications and scripts to run, preventing unknown software from executing.

Admins should also keep Windows Defender Firewall enabled with restrictive inbound rules and carefully managed outbound connections.
Finally, Microsoft advises locking down Remote Desktop by using VPNs or Remote Desktop Gateway, enabling multifactor authentication, requiring Network Level Authentication, restricting trusted networks, and using secure TLS certificates.

Microsoft further notes every security feature should be tested before deployment to avoid disrupting production workloads.