Ensure that the password policy requires a minimum of 14 characters for all user accounts.

Short passwords are easily compromised through brute force and dictionary attacks. CIS Benchmark and NIST standards recommend 14+ characters as minimum for adequate security. A 14-character password provides trillions of possible combinations, making brute force attacks impractical.

GPO: Password Policy → Minimum password length = 14
PowerShell: net accounts /minpwlen:14

Configure automatic account lockout after 5 consecutive failed login attempts.

Account lockout prevents brute force and password spraying attacks. Without this protection, an attacker can try infinite password combinations through automated tools.

GPO: Account Lockout Policy → Account lockout threshold = 5
PowerShell: net accounts /lockoutthreshold:5

The Guest account must be disabled on all systems.

The Guest account allows anonymous access, representing a significant security risk. Attackers frequently use this account to gain initial access and escalate privileges.

PowerShell: net user guest /active:no

Require passwords to include uppercase, lowercase, numbers, and special characters.

Password complexity significantly increases entropy, making dictionary and brute force attacks much more difficult. A 14-character password with complexity has trillions of combinations.

GPO: Password must meet complexity requirements = Enabled

Windows Firewall must be enabled for all network profiles.

The firewall is the first line of defense against unauthorized access. It blocks unsolicited inbound connections and prevents malware propagation.

PowerShell: Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

SMB version 1 protocol must be completely disabled.

SMBv1 is vulnerable to critical attacks like EternalBlue, WannaCry, and NotPetya. This legacy protocol does not offer encryption or protection against MITM attacks.

PowerShell: Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

Remote Desktop must require Network Level Authentication.

NLA authenticates before establishing the full RDP session, preventing MITM attacks and exploitation of RDP vulnerabilities.

GPO: Require user authentication for remote connections = Enabled

The system must be configured to install security updates automatically.

Updates fix known vulnerabilities. Outdated systems are easy targets for malware and exploits. Automation ensures timely patch application.

GPO: Configure Automatic Updates = Enabled (Option 4)

PowerShell version 2 must be disabled or removed.

PowerShell v2 does not support modern security features like script block logging. Attackers use v2 to evade detection.

PowerShell: Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2

The Wazuh monitoring agent must be installed and communicating.

Centralized monitoring is essential for real-time threat detection, incident response, and compliance. Without monitoring, compromises go unnoticed.

Download agent from wazuh.skyfortcyber.com and configure server IP.

Windows Defender must be enabled with real-time protection.

Windows Defender offers native, free, effective anti-malware protection. Systems without protection are quickly compromised.

PowerShell: Set-MpPreference -DisableRealtimeMonitoring $false