- New in Windows Server 2025 Security
- Apply the Microsoft Security Baseline 2602
- Verify Credential Guard
- LAPS Deployment
- Windows Defender Application Control (WDAC)
- Privileged Access Management
- Network Segmentation
- Encryption and TLS
- Advanced Audit Policy
- FAQs
- Key Takeaways
- Conclusion
- Sources
- Active Directory Tiering Model
- Key Takeaways
Windows Server 2025 is one of the highest-value targets in enterprise environments. It introduced Credential Guard by default, Enhanced LAPS, and the Security Baseline v2602 (February 2026). Yet hardening still requires deliberate configuration beyond defaults. The Verizon 2025 DBIR shows vulnerability exploitation grew to 20% of breaches as an initial access method.
New in Windows Server 2025 Security
- Credential Guard by default: Virtualization-based security protects domain credentials in isolated memory, blocking Pass-the-Hash and Kerberos ticket theft
- Enhanced LAPS: Auto-rotates local admin passwords stored encrypted in AD
- Sudo restricted: 2602 baseline disables sudo on member servers and DCs
- NTLM auditing: Stronger controls to detect legacy auth abuse
- SMB hardening: Updated signing and encryption requirements
Apply the Microsoft Security Baseline 2602
Download the Security Compliance Toolkit. Version 2602 provides pre-configured GPOs for Windows Server 2025. Apply in test environment first, validate operations, then deploy. This step alone closes dozens of default gaps.
Verify Credential Guard
Run: Get-ComputerInfo | Select-Object DeviceGuardSecurityServicesRunning. Must show running on all UEFI + Secure Boot + VBS-capable hardware. Enable via Group Policy: Computer Configuration > Device Guard > Turn On Virtualization Based Security.
LAPS Deployment
Without LAPS identical local admin passwords across all servers mean one credential theft enables lateral movement everywhere. Deploy Enhanced LAPS: Update-LapsADSchema, Set-LapsADComputerSelfPermission, configure via Group Policy. Verify: Get-LapsADPassword -Identity SERVERNAME.
Windows Defender Application Control (WDAC)
WDAC provides kernel-level application allowlisting. Only permitted applications execute, blocking ransomware regardless of delivery method. Deploy in audit mode first: review Microsoft-Windows-CodeIntegrity/Operational event logs for two weeks. Build policy from audit data using WDAC Policy Wizard. Enforce on high-value targets first (DCs, jump servers), then expand.
Privileged Access Management
- Dedicated Privileged Access Workstations (PAWs) for all domain admin tasks
- Separate admin accounts from daily-use accounts
- Just-in-Time access for domain admin via Microsoft Entra PIM
- Disable NTLM and LM authentication via Group Policy
- Never use domain admin for email or web browsing
Network Segmentation
Domain controllers must never have direct internet access. Place DCs, PKI servers, and backup infrastructure in dedicated VLANs with explicit firewall rules. No direct peering between sensitive segments. Force cross-segment traffic through inspection points.
Encryption and TLS
- TLS 1.2 minimum everywhere, TLS 1.3 preferred. Disable TLS 1.0 and 1.1.
- SMB signing required:
Set-SmbServerConfiguration -RequireSecuritySignature $true - BitLocker on all server volumes
- Disable SMB v1:
Set-SmbServerConfiguration -EnableSMB1Protocol $false
Advanced Audit Policy
Enable via Group Policy: Account Logon (all), Account Management (all), Object Access (file/registry), Process Creation with command line (Event 4688), PowerShell Script Block Logging, Scheduled Task Creation. Forward all events to centralized SIEM immediately.
🔗 Further Reading
FAQs
Is Credential Guard on by default in Windows Server 2025?
Yes, on eligible hardware with UEFI, Secure Boot, and VBS-capable CPUs. Verify with Get-ComputerInfo. Enable via Group Policy on any system not running it automatically.
WDAC vs AppLocker for Windows Server 2025?
WDAC is Microsoft recommended. It operates at kernel level, is more tamper-resistant, and receives continued investment. Deploy in audit mode first to avoid breaking legitimate applications.
What does LAPS protect against?
LAPS prevents lateral movement by ensuring every server has a unique, auto-rotating local admin password. Without it, one stolen credential enables access to every server sharing that password.
Key Takeaways
- Apply Microsoft Security Baseline 2602 as your starting configuration
- Verify Credential Guard is running on all eligible servers
- Deploy LAPS to every server to eliminate shared-credential lateral movement
- Implement WDAC in audit mode before enforcement
- Disable legacy protocols: NTLM, LM, TLS 1.0/1.1, SMB v1
Conclusion
Windows Server 2025 ships with the best default security of any version, but effective protection requires deliberate configuration. Apply Baseline 2602, verify Credential Guard, deploy LAPS, implement WDAC, disable legacy protocols. Validate quarterly. Related: Identity and Access Management Guide.
Sources
- Windows Server 2025 Security Hardening – windowsforum.com, windowsreport.com
- Microsoft Security Baseline 2602 – redmondmag.com
- CIS Benchmark for Windows Server 2025 – calcomsoftware.com
- Verizon 2025 DBIR – verizon.com
Active Directory Tiering Model
Implement the Microsoft Tier Model: Tier 0 (domain controllers, PKI), Tier 1 (servers), Tier 2 (workstations). Admin accounts must be tier-specific: a Tier 0 admin account is never used to log into Tier 1 or Tier 2 systems. This limits lateral movement when credentials are compromised. Enforce with Authentication Policy Silos in Active Directory.
Key Takeaways
- Deploy LAPS immediately to eliminate shared local admin passwords
- WDAC in audit mode for 2 weeks, then switch to enforcement
- Credential Guard prevents NTLM hash theft from LSASS memory
- Implement AD tiering to limit blast radius of any single compromised credential
