Windows Server 2022 Hardening

[u/Snoo_61639]

Do you happen to know a Windows Server 2022 Hardening Guide?

One thats not that complicated and easy to apply from scratch.

I want to prepare a VM before a VA scanning (whenever possible) and atleast the result should not have been massive to remediate.

[u/MagicHair2]

https://techcommunity.microsoft.com/blog/itopstalkblog/some-tools-and-techniques-for-hardening-windows-server/4539840

[u/felix1429 → u/MagicHair2]

Looks like a pretty solid list, thanks for the link.

[u/AssistantGlobal1809 → u/MagicHair2]

microsoft's own hardening kit is a decent start but it's pretty basic, I usually layer on the CIS benchmarks after to catch the gaps

[u/whiteycnbr]

CIS

[u/insightrecon]

Since this is for a VA scan, know that the hardening guides and the scanner don’t overlap as much as you’d think (source: I'm a former pentester).

For hardening, grab Microsoft’s Security Compliance Toolkit. It has the Server 2022 baseline plus LGPO.exe, and the baseline zip includes a script that applies it locally. No domain needed. If whoever’s scanning wants CIS by name, the CIS Level 1 Member Server benchmark is the other common pick. Snapshot the VM first and test whatever apps it runs. Some settings will break stuff.

What will most likely show up on a fresh 2022 box:

• Missing patches.
• TLS 1.0/1.1 and weak ciphers, mostly on RDP.
• The self-signed RDP cert.
• Roles and features you aren’t using.

If this box is going to be a DC, the VA scan won’t tell you much about AD itself. Run an AD assessment too. PingCastle, Purple Knight and Insight Recon all do it (full disclosure, InsightRecon is our tool).

[u/JSexton610 → u/insightrecon]

I appreciate your disclosure and impartiality! That led me to your site, and I'm equally impressed with the honest comparison to competitors. This is what makes me want to become a customer, instead of the usual high pressure sales pitches.

[u/insightrecon → u/JSexton610]

Thank you for the nice words! We try to be as transparent and honest as possible. We’re just a bunch of cybersecurity nerds and don’t have sales people, so we’re not big on pitches. We just hope the product speaks for itself, you know?

If you do try it out (we have a free tier), please feel free to send feedback! We’re always looking for ways to improve.

[u/JSexton610 → u/insightrecon]

Already put a note on my Monday calendar to give it a spin!

[u/Asleep_Spray274]

Security and convenience don't go hand in hand..it's easy to apply hardening policies, but if you don't actually know what you are hardening against then things are going to break. You need to what services your environment needs to support. If you don't care, just apply the windows security base line GPOs from MS or the CIS policies and hope for the best

[u/fezbrah]

DISA STIG and you edit your GPO to allow who can login locally, remotely, from the network. It’s a baseline guide and afterward you run a SCAP scan. It reveals the vulnerabilities and you can google to fix it.

Download STIG for server 2022. Import the gpo for server 2022 domain controller or use member server for non dc servers. Then you adjust access. Run a local scap scan and view the results on any web browser or STIG viewer. AI and YouTube can guide you easily.

[u/Existential_Racoon → u/fezbrah]

Eval stig is also an alternative to SCAP, especially if you're DoD adjacent, they're shifting gears.

[u/mattee27]

CIS Benchmark Level 2 is definitely the baseline to shoot for. It’s vendor-neutral, thorough, and usually the benchmark auditors actually want to see when proving secure configuration.

In my experience, assessing your compliance score isn't the hardest part—there are plenty of scanners out there that can score a system against CIS Benchmarks. The real nightmare is fixing the drift efficiently without breaking production.

Relying strictly on traditional GPOs to enforce Level 2 at scale almost always hits a wall around 30-50% compliance. GPOs fail to apply consistently, don't handle edge-case dependencies well, and pushing heavy hardening policies directly to production usually breaks a legacy service. Then you're stuck in an endless loop of rollback, troubleshooting, and re-targeting specific OU exceptions.

It's an absolute time sink for infra teams: you put in weeks of work, only for configuration drift to push scores back down, and then you have to explain the gap to the risk/audit team again.

Moving away from static GPOs toward automated baseline enforcement and learning/impact-testing tools is really the only way to maintain Level 2 without drowning in tickets.

How is everyone else handling continuous remediation and testing ?

[u/Character-Cheek8311]

CIS benchmarks are good: https://www.cisecurity.org/benchmark/microsoft_windows_server

Also Microsoft have some downloads for prebaked GPOS that have their basic hardening applied;

https://www.microsoft.com/en-us/download/details.aspx?id=55319

Buyer beware running live without testing your applications first! In my org we bake these MS ones into the image template, so every server gets the baseline settings even if it isn't domain joined or drops off. has bit me with some of the defender settings conflicting with GPO settings later though.

[u/DeadOnToilet]

We use CIS server level 2 on all 59k+ windows server nodes here. It’s consistently top notch and you can join the community calls to hear and participate in discussions. 

[u/Open-Adhesiveness-86]

whichever baseline you land on, check the scanner can still authenticate afterwards. CIS L2 and the STIGs disable Remote Registry and leave LocalAccountTokenFilterPolicy at 0, so Nessus quietly falls back to a network scan and the report comes back suspiciously clean. make sure the plugin output actually says credentialed checks yes before you trust a low finding count.

[u/Breachline_Labs]

A fairly painless way to do this is to work in small steps rather than applying a whole guide at once.

1. Start from a clean install and only add the roles and features the server actually needs. Fewer roles means fewer findings straight away.

2. Apply the Microsoft security baseline from the Security Compliance Toolkit with LGPO. It's the least fiddly starting point, and CIS Level 1 is a sensible next step if you need more.

3. Switch off old protocols you don't use, such as SMBv1 and TLS 1.0/1.1, and get the local admin password managed (Windows LAPS is built in now).

4. Patch fully before you scan.

5. Run the scan, fix what it finds, then scan again so you know the fixes actually stuck.

Do it on a snapshot first and jot down each change, so if something breaks you know which setting to roll back. Once you're happy, turn the VM into a template so every new server starts from the same place.

[u/MaskedPotato999]

Hello, Microsoft provides hardening guidance and GPO through Security Compliance Toolkit (download is free). Don't forget first line of defense : server core whenever possible, no in-place upgrade, latest hotfixes. Always test first. You will break things.

[u/watching_reddit_die_]

ask ai

[u/brekfist]

Easy upgrade to Windows Server 2025

[u/Due_Capital_3507]

Viagra