CIS Hardening in Practice: A Nine-Check Windows Server Audit

Every server starts life insecure. Not because anyone did anything wrong, but because a fresh Windows install is tuned for compatibility, not for defence. Legacy protocols are available, permissions are broad and logging is minimal. Log into a brand-new Windows Server 2022 machine and everything works: RDP answers, file shares respond, services start on cue. That is exactly the problem.

Hardening is the deliberate process of walking that default build back to a known, defensible baseline, and then being able to prove, on screen, that you did it. This guide shows how to audit a Windows Server against the CIS Benchmark in nine checks, with the exact commands to run, and how the results become evidence for ISO/IEC 27001 and PCI DSS v4.0.1.

What hardening actually means

Hardening reduces a system’s attack surface, so there is less for an attacker to reach and exploit. Strip away the jargon and it comes down to four repeatable moves:

• Remove what you do not need. Uninstall unused roles, disable unused services and switch off legacy protocols such as SMBv1.
• Tighten what remains. Enforce a strong password and lockout policy, require Network Level Authentication on RDP and require SMB signing.
• Watch everything left running. Turn on the audit categories that matter and forward logs somewhere tamper-resistant.
• Prove the state. Capture evidence of the configuration, so an assessor, or you at 2am during an incident, can verify it.

Many breaches never need a zero-day. Weak passwords, internet-facing RDP and legacy SMB remain everyday ways into corporate networks, and none of them requires a sophisticated exploit. They only require a default left in place and nobody checking it.

The CIS Benchmarks: a baseline you do not have to invent

Rather than inventing your own baseline and defending it in every design review, adopt a recognised one and measure against it. The CIS Benchmarks, published by the Center for Internet Security, are the most widely used starting point. They are consensus-built configuration guides written by practitioners, vendors and academics, with hundreds of numbered recommendations per operating system. Each recommendation names a setting, explains why it matters, and tells you how to audit it and how to fix it.

Separate benchmarks exist for Windows Server 2016, 2019, 2022 and 2025, so always match the version in front of you. Every benchmark offers two profiles:

One more decision comes before any command: is this a member server or a domain controller? Domain controllers carry extra recommendations, and their settings are normally driven by domain Group Policy rather than local policy. The first command in the audit section below tells you which.

How to read a CIS recommendation

Every CIS recommendation has the same shape. Once you can see the pattern, the benchmark stops feeling like a wall of text. Take recommendation 1.1.2 from the Windows Server benchmark:

1.1.2 (L1) Ensure 'Maximum password age' is set to '365 or fewer days, but not 0'

Profile    : Level 1 - Domain Controller, Level 1 - Member Server
Audit      : Compare the effective policy value with the target
Remediate  : Computer Configuration\Policies\Windows Settings\Security Settings\
             Account Policies\Password Policy\Maximum password age

Section numbers in this guide follow the CIS Microsoft Windows Server 2022 Benchmark. Sub-numbers can move between benchmark releases, so confirm them against the version you download.

Audit first, remediate second

You cannot claim a server is hardened until you can show the evidence. The most valuable habit in this discipline is to read the current state before you change anything. Reading is non-destructive, it tells you exactly where you stand, and it gives you a before-and-after record that an assessor will trust.

Set the stage first:

# Open PowerShell as Administrator, then confirm the environment
$PSVersionTable.PSVersion
Get-ComputerInfo -Property OsName, OsVersion, WindowsProductName
(Get-CimInstance Win32_ComputerSystem).DomainRole
# 2 = standalone server, 3 = member server, 4 or 5 = domain controller

# Create a folder for the evidence this guide produces
New-Item -Path C:\audit -ItemType Directory -Force | Out-Null

Six command families answer almost every question a CIS audit asks:

The nine-check audit

Nine checks, each mapped to a CIS section, each with the command to run and the result that tells you whether you passed. Run them in order, in an elevated PowerShell prompt, on a test machine first.

# Quick view (works in PowerShell and cmd.exe)
net accounts

# Full policy export, then read the password settings
secedit /export /cfg C:\audit\pol.cfg /quiet
Select-String -Path C:\audit\pol.cfg -Pattern 'Password'

# Read the lockout values from the policy export
Select-String -Path C:\audit\pol.cfg -Pattern 'Lockout'

# Same information without an export
net accounts | findstr /i "lockout"

Get-LocalUser | Select-Object Name, Enabled, PasswordExpires, LastLogon

# Who holds local administrator rights?
Get-LocalGroupMember -Group 'Administrators'

# Guest account state (cmd.exe alternative)
net user guest | findstr /i "active"

# Full picture of what is being logged
auditpol /get /category:*

# Subcategories CIS cares about most
auditpol /get /subcategory:"Logon,Special Logon,Security Group Management"

# Security log maximum size
Get-WinEvent -ListLog Security | Select-Object LogName, MaximumSizeInBytes

# Effective settings, including those applied by Group Policy
Get-NetFirewallProfile -PolicyStore ActiveStore |
    Select-Object Name, Enabled, DefaultInboundAction, LogBlocked

# cmd.exe equivalent
netsh advfirewall show allprofiles

# SMBv1 should be disabled or absent
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol |
    Select-Object FeatureName, State
Get-SmbServerConfiguration |
    Select-Object EnableSMB1Protocol, RequireSecuritySignature

# LAN Manager authentication level
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name LmCompatibilityLevel

# Is RDP enabled? 1 means connections are denied
Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections

# Policy settings for Network Level Authentication and encryption
$rdp = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
Get-ItemProperty $rdp -Name UserAuthentication, MinEncryptionLevel

# Services running and set to start automatically
Get-Service | Where-Object { $_.Status -eq 'Running' -and $_.StartType -eq 'Automatic' } |
    Select-Object Name, DisplayName

# Installed roles and features (Windows Server only)
Get-WindowsFeature | Where-Object Installed

# Ten most recent updates and their install dates
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

# Antivirus and real-time protection status
Get-MpComputerStatus |
    Select-Object AMServiceEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated

Put it together: a five-minute evidence pack

On their own, the nine checks are simple. Run together, they become an audit trail: a dated folder of files an assessor can open, and that you can compare with last quarter’s run.

$out = "C:\audit\$env:COMPUTERNAME-$(Get-Date -Format yyyyMMdd)"
New-Item -Path $out -ItemType Directory -Force | Out-Null

secedit /export /cfg "$out\policy.cfg" /quiet
auditpol /get /category:*                     | Out-File "$out\auditpol.txt"
Get-NetFirewallProfile -PolicyStore ActiveStore | Out-File "$out\firewall.txt"
Get-LocalUser                                 | Out-File "$out\users.txt"
Get-SmbServerConfiguration                    | Out-File "$out\smb.txt"
Get-HotFix                                    | Out-File "$out\patches.txt"
Get-MpComputerStatus                          | Out-File "$out\defender.txt"

# Then compare each file with the CIS target values

Mapping the checks to ISO/IEC 27001

ISO/IEC 27001:2022 does not require the CIS Benchmarks. It does require you to define, apply and maintain secure configurations (control A.8.9), and a recognised benchmark is one of the most defensible ways to do that. The same nine checks then provide evidence for several Annex A controls at once. Annex A groups its 93 controls into four themes, and hardening sits almost entirely in the Technological theme.

Mapping the checks to PCI DSS v4.0.1

If the server stores, processes or transmits cardholder data, or can affect the security of systems that do, these checks become assessment evidence. Requirement 2.2.1 requires configuration standards that are consistent with industry-accepted system hardening standards or vendor hardening recommendations, and the CIS Benchmarks are among the most widely used of those standards.

A hardening checklist that holds up

Whatever the platform, the same categories come back. Treat this as a standing checklist, not a one-off project plan.

1. Accounts and authentication

• Minimum password length of 14 or more, complexity on, history of 24 and a maximum age of 365 days or fewer (never 0).
• Lock accounts after 5 or fewer failed attempts, with a lockout and reset window of at least 15 minutes, and at least 30 minutes on PCI DSS in-scope systems.
• Disable the Guest account, rename the built-in Administrator and review who holds local administrator rights.

2. Services, protocols and roles

• Remove or disable SMBv1, require SMB signing and restrict LAN Manager authentication to NTLMv2.
• Disable every service and role the server’s documented purpose does not require.
• Where remote access is needed, keep it behind NLA and high encryption, ideally through a VPN or bastion host rather than open RDP.

3. Logging and monitoring

• Enable the audit subcategories CIS recommends, such as Logon, Special Logon and account management events.
• Size the Security log appropriately and forward logs to a central, tamper-resistant platform such as a SIEM.
• Log dropped firewall connections so you can investigate later.

4. Patching and endpoint protection

• Apply updates on a defined schedule, with critical patches inside an agreed window.
• Run endpoint protection with real-time protection and current signatures.
• Encrypt disks, and in cloud environments use hardened images and least-privilege security groups.

Hardening is a state you maintain

Configuration drifts. New software relaxes a setting, an engineer opens a port for troubleshooting and forgets to close it, a policy is overridden somewhere upstream. A server hardened last quarter is only still hardened if you keep checking.

Build re-auditing into a schedule and automate the comparison where you can. Tools such as CIS-CAT score a system against the benchmark and produce a report. Most importantly, track every finding through to remediation, not just into a spreadsheet nobody reopens.

The takeaway

Hardening is rarely glamorous, and it is rarely about exotic threats. It is the disciplined work of turning off what you do not need, tightening what you keep, watching what remains and proving the result. Start from a recognised baseline, audit before you change anything, fix the basics first and re-check on a schedule.

Do that consistently and a default install, which is a liability, becomes a server you can defend, both on the network and on paper when the auditor arrives.

Further reading: the CIS Benchmarks are free to download after registration; always match the benchmark to your exact operating system version. For how these controls are examined in practice, see our ISO/IEC 27001 certification audits and PCI DSS assessments.