Microsoft Windows Hardening

Baseline hardening for a Windows workstation or server: understanding the core subsystems attackers and defenders both rely on, tightening identity and access controls, restricting network exposure, controlling what software can run, and protecting data at rest.

Topic	Description
General Concepts	Services, the Windows Registry, Event Viewer, and Telemetry — the subsystems everything else builds on.
Identity & Access Management	User Account Control (UAC), password policies, and account lockout policy.
Network Management	Windows Defender Firewall, disabling unused NICs, disabling SMB1, protecting local DNS, ARP attack mitigation, and disabling remote access.
Application Management	Trusted app sources, Windows Defender Antivirus, AppLocker, and Microsoft SmartScreen.
Storage Management	BitLocker encryption, Windows Sandbox, and file backups.
Updating Windows	Keeping the OS itself patched.