Windows Endpoint Security Benchmark for SMBs

The Windows Firewall blocks unauthorized inbound network connections. A disabled firewall is a direct path for network-based attackers.

Set-NetFirewallProfile -All -Enabled True

Real-time protection detects and blocks malware before it executes. Defenders with real-time protection disabled allow malware to run undetected.

Set-MpPreference -DisableRealtimeMonitoring $false

An enabled guest account provides an unauthenticated local access path that attackers can use for lateral movement.

Disable-LocalUser -Name "Guest"

NLA requires authentication before a remote desktop session is established, preventing credential brute-force attacks against the RDP login screen.

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Value 1

SMBv1 is the protocol exploited by EternalBlue/WannaCry. It has been deprecated since 2014 and should be disabled on all modern systems.

Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

Weak password policies allow credential attacks. Minimum 12-character passwords with complexity requirements prevent the majority of brute-force attempts.

secedit /export /cfg c:\secpol.cfg && [edit MinimumPasswordLength=12, PasswordComplexity=1]

Automatic updates ensure critical security patches are applied without requiring manual IT action. The average time from CVE publication to active exploitation is 7 days.

Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "NoAutoUpdate" -Value 0

RDP connections without high encryption can be intercepted by man-in-the-middle attacks on the network.

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "MinEncryptionLevel" -Value 3