This document provides an agenda and instructions for a lesson on implementing server hardening. It discusses using tools like IPSec, BitLocker, locating inactive users, NTLM authentication, defining security options, removing storage access, configuring multiple password policies, and Sysinternals tools. It also includes links to videos and documentation on specific tasks like configuring NTLM authentication, defining security options, and removing storage access. It asks how to configure different password policies for groups like Admin and Staff and provides a link to documentation on the Sysinternals troubleshooting suite of tools.

1. Practice - Windows Server Security
Lesson 8
Pasha Mohamed
VDTQT-Hutech

2. Agenda
Exercise: Implement hardening for server applications

3. Server Harden Tool
• IPSec (lession 3)
• Bitlocker
• Locate inactive user
• NTLM authen
• Define security option
• Remove Storage access
• Configuring multi password policy
• Sysinternal tool

4. Video BitLocker (Server)

5. Video Locate inactive user

6. Video NTLM authen
• NTLM is legacy authen protocol (win 2000-2003)
• NTLM is weak form of authen
• Ensure no client require NTLM authen
• Block NTLM using group policy
• https://docs.microsoft.com/en-
us/troubleshoot/windows-server/windows-
security/ntlm-user-authentication

7. Video NTLM authen

8. Video Define security option

9. Video Remove Storage access

10. Video Configuring multi password policy
How to config password policy for each group like Admin, Staff ?

11. Sysinternal tool
• The Sysinternals Troubleshooting Utilities have been rolled up into a single Suite
of tools. This file contains the individual troubleshooting tools and help files. It does
not contain non-troubleshooting tools like the BSOD Screen Saver.
• The Suite is a bundling of the following selected Sysinternals Utilities: AccessChk,
AccessEnum, AdExplorer, AdInsight, AdRestore, Autologon, Autoruns, BgInfo,
BlueScreen, CacheSet, ClockRes, Contig, Coreinfo, Ctrl2Cap, DebugView,
Desktops, Disk2vhd, DiskExt, DiskMon, DiskView, Disk Usage (DU), EFSDump,
FindLinks, Handle, Hex2dec, Junction, LDMDump, ListDLLs, LiveKd, LoadOrder,
LogonSessions, MoveFile, NotMyFault, NTFSInfo, PendMoves, PipeList, PortMon,
ProcDump, Process Explorer, Process Monitor, PsExec, PsFile, PsGetSid, PsInfo,
PsKill, PsList, PsLoggedOn, PsLogList, PsPasswd, PsPing, PsService,
PsShutdown, PsSuspend, PsTools, RAMMap, RDCMan, RegDelNull, RegHide,
RegJump, Registry Usage (RU), SDelete, ShareEnum, ShellRunas, Sigcheck,
Streams, Strings, Sync, Sysmon, TCPView, VMMap, VolumeID, WhoIs, WinObj,
ZoomIt
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-
suite

12. More Exercise
.Config password policy for group Gr1(sep) with easier policy compare
to Staff like no expire password, can log wrong 10 times....
.Block app Paint IE using GPO (mspaint.exe)