# What Is Server Security? How Is Windows and Linux Server Hardening Done?

**URL:** https://securesys.com.tr/en/learning/system-cloud-security/server-security-windows-linux-hardening

![What Is Server Security? How Is Windows and Linux Server Hardening Done?](/images/bilgi-merkezi/covers/cover-sistembulut-02.webp)

An organisation's most critical data and applications usually run on servers.

The Active Directory domain controller.

The ERP system.

The web application.

The database.

The file server.

The API service.

The backup system.

The SIEM or security management servers.

The compromise of just one of these systems can give an attacker far broader access inside the organisation.

And where the server runs usually does not change the basic security principles.

The server may run;

in a physical data centre,

on VMware,

in Microsoft Azure,

on AWS,

in Google Cloud.

The operating system still has to be configured securely.

**Windows Server security**, **Linux server security** and **server hardening** are therefore among the fundamental building blocks of corporate system and cloud security.

Server security is not merely installing antivirus or updating the operating system.

A genuine **server security hardening** approach handles the layers of;

secure configuration,

minimum services,

minimum privilege,

patch management,

network segmentation,

privileged access management,

EDR/XDR,

logging,

SIEM monitoring,

backup and recovery

together.

The basic principle is simple:

**A server must not merely be running; it must run on a secure baseline, and that security level must be continuously verified.**

#### What Is Server Security?

**Server security** is the protection of systems such as Windows Server and Linux Server against unauthorised access, malware, vulnerability exploitation, credential theft and misconfiguration.

The purpose of server security is to preserve three fundamental security principles:

#### Confidentiality

Preventing unauthorised people from accessing data.

#### Integrity

Preventing unauthorised modification of systems and data.

#### Availability

Ensuring critical services keep running.

But modern server security also aims to detect attacker movement as early as possible.

### What Is Server Hardening?

**Server hardening** is the process of restricting unnecessary services, protocols, users, ports and privileges in order to reduce the attack surface on a server.

On a server, for example;

if FTP is not used it can be switched off.

If RDP is not needed the access can be removed.

SSH can be made reachable only from the management network.

Unnecessary local administrator accounts can be removed.

Old TLS protocols can be disabled.

All of these are parts of the hardening approach.

But hardening does not merely mean:

**“Let's switch off the unnecessary services.”**

A secure baseline must be created and the system's drift from that baseline continuously tracked.

### Why Does Server Hardening Matter?

The default operating system configuration is not designed around every organisation's security requirements.

Operating system vendors also have to consider usability and compatibility.

Some;

services,

protocols,

settings,

privileges

are therefore broader than the organisation needs.

From the attacker's perspective every unnecessary feature creates a new attack surface.

The basic approach must therefore be:

**If it is not used, switch it off.**

**If it is not needed, do not grant the privilege.**

**If it does not need to face the internet, do not expose it.**

### What Is the Attack Surface?

The **attack surface** is the total of the reachable components an attacker can use to target a system.

On a server the attack surface consists of elements such as;

open ports,

running services,

user accounts,

web applications,

remote management services,

APIs,

shares.

As the attack surface shrinks, the attacker's options shrink with it.

That is one of hardening's core objectives.

### What Is Windows Server Hardening?

**Windows Server hardening** is the tightening of the Windows Server operating system according to secure configuration standards.

This process assesses many areas such as;

Windows Firewall,

Group Policy,

user rights assignment,

audit policy,

RDP,

PowerShell,

SMB,

NTLM,

TLS,

local accounts,

Windows Defender or EDR.

But applying the same settings to every Windows server is not right.

A domain controller and an application server have different security profiles.

Building role-based security baselines therefore matters.

### What Is Linux Server Hardening?

**Linux server hardening** is the process of stripping the Linux operating system of unnecessary services, weak privileges and risky configurations.

The main areas to assess are;

SSH,

root access,

sudo,

PAM,

filesystem permissions,

services,

kernel parameters,

the firewall,

auditd,

logging.

Configuration details vary by Linux distribution.

Systems such as;

Ubuntu,

Debian,

Red Hat Enterprise Linux,

Rocky Linux,

AlmaLinux,

SUSE

have different management tools.

But the security principles are largely the same.

### How Is Server Hardening Done with CIS Benchmarks?

**CIS benchmarks** are among the widely used security references offering secure configuration recommendations for operating systems and other technologies.

For Windows and Linux systems there are recommendations in areas such as;

account policies,

logging,

network configuration,

the filesystem,

services,

security options.

A CIS benchmark is a strong starting point for hardening work.

But there is an important distinction:

**CIS compliance and a secure system are not the same thing.**

A system can conform to most of the benchmark while carrying a serious application-specific security risk.

Benchmarks must therefore be used alongside risk analysis.

### What Are CIS Level 1 and Level 2?

CIS benchmarks offer different security profiles for some technologies.

As a general approach:

#### Level 1

Provides basic security hardening and aims to keep operational impact limited.

#### Level 2

Contains stricter controls for higher security requirements.

The operational impact of level 2 controls is higher.

The strictest profile must therefore not be applied to every server directly.

It must be tested first.

### How Is a Security Baseline Built?

A corporate **security baseline** defines a server's minimum security configuration.

A Windows Server baseline may include the headings:

password policy

account lockout

Windows Firewall

RDP security

audit policy

SMB configuration

PowerShell logging

EDR

TLS configuration

A Linux baseline can cover;

SSH configuration

root access

sudo

PAM

auditd

firewall

filesystem permissions

logging

But producing a baseline document is not enough.

Its application must be verified.

### What Is a Golden Image?

A **golden image** is a standard server image prepared securely.

Rather than configuring from scratch every time a new server is created, the secure image can be used.

A golden image can already contain;

current patches,

hardening,

the EDR agent,

the logging agent,

the monitoring agent.

This approach provides standardisation.

It is particularly valuable in cloud and virtualisation environments.

### Can Golden Image Security Degrade Over Time?

Yes.

A golden image may be secure on the day it is built.

But a few months later;

new vulnerabilities,

new patches,

new security policies

appear.

The golden image must therefore be updated continuously.

Otherwise every newly created server reproduces old security problems.

### How Does Configuration Drift Occur on Servers?

A server may be CIS-compliant when first built.

But over time;

a firewall port is opened,

a test account is created,

RDP access is widened,

a service is added,

the audit policy is changed.

These changes cause drift from the security baseline.

Hardening assessment must therefore be carried out periodically.

### Why Should Unnecessary Services Be Switched Off?

Every running service is a potential attack surface.

If a server;

is used as a web server but also runs an FTP service, unnecessary risk forms.

The same principle applies to services such as;

Telnet,

SNMP,

legacy file sharing,

remote management.

But application dependency must be checked before switching a service off.

### Is Fewer Open Ports Always Better?

Unnecessary ports should generally be closed.

But the aim is not the smallest possible number of ports:

#### The minimum ports the business requires

is the right target.

Port 443 may be necessary for a web server.

A database server's 1433 or 5432 port being reachable from the internet is unnecessary in most architectures.

The **least exposure** principle must be applied here.

### Why Is a Host-Based Firewall Necessary?

Having a network firewall does not remove the need for a firewall on the server.

A **host-based firewall** provides an additional security layer at server level.

Windows Firewall, or nftables/firewalld on Linux, can be used.

Traffic between systems in the same network segment can thereby be restricted too.

It is valuable for defence in depth.

### How Is RDP Security Achieved?

**Remote Desktop Protocol (RDP)** is widely used for Windows Server management.

But exposing RDP directly to the internet creates a significant attack surface.

In a secure approach, access can be assessed through;

VPN,

a jump server,

a bastion host,

MFA,

PAM.

Only authorised users should also be permitted to use RDP.

### Why Should RDP Not Be Exposed Directly to the Internet?

Public RDP services become targets for attacks such as;

brute force,

password spraying,

credential stuffing,

vulnerability exploitation.

Rather than the model:

**Internet → RDP → server**

a more controlled architecture such as:

**Authorised user → MFA/VPN/PAM → bastion → server**

can be preferred.

### What Is Network Level Authentication?

**Network level authentication (NLA)** ensures the user's identity is verified before the RDP session is fully established.

It is one of the controls that improves RDP security.

But using NLA does not automatically make exposing RDP directly to the internet safe.

Several security layers are required.

### How Is SSH Security Achieved?

SSH is the critical management service for Linux servers.

In a secure SSH configuration;

restricting root login,

reducing password authentication,

using SSH keys,

MFA,

source IP restriction,

logging

can all be assessed.

SSH being unnecessarily open to the whole internet must be prevented.

### Is an SSH Key More Secure Than a Password?

Managed correctly it is a strong method.

But an SSH key is a credential too.

If the private key is stolen, the attacker gains access.

For that reason;

private key protection,

a passphrase,

key rotation,

central management

matter.

Former employees' SSH keys being forgotten on servers is a serious security problem.

### Why Should Root Login Be Restricted?

Direct root use on Linux creates problems for;

accountability,

auditability,

privilege control.

Preferably the user signs in with their own account and uses sudo for the necessary operations.

It is thereby far easier to track which user ran which privileged command.

**How Is sudo Security Achieved?**

One of the most common mistakes is giving a user very broad rights such as:

#### ALL=(ALL) ALL

Sudo policies must be designed around the least privilege principle as far as possible.

If an application administrator only needs to restart the relevant service, full root rights may be unnecessary.

### What Is the Windows Local Administrator Risk?

Using the same local administrator password on every server creates serious risk.

If one server's credential is compromised, the attacker will try the same password on other systems.

Local admin credentials being unique and controlled therefore matters.

Central password management approaches can be used for this in Windows environments.

### What Is LAPS?

**Windows Local Administrator Password Solution / Windows LAPS** helps manage local administrator passwords centrally and securely.

A different password can be generated for each device or server.

Passwords can be rotated automatically.

The lateral movement risk created by using the same local admin password across the whole infrastructure is thereby reduced.

### What Is a Service Account?

A **service account** is the account used to run an application or service.

These accounts are usually not human users.

For example;

a backup service,

a database integration,

a scheduled task,

a web application

can use a service account.

Service accounts are valuable to attackers because they sometimes hold high privileges and their passwords are not changed for long periods.

### How Is Service Account Security Achieved?

For service accounts;

disabling interactive login,

minimum privilege,

password rotation,

usage monitoring,

account ownership

can be applied.

In Windows environments, approaches such as **group managed service accounts (gMSA)** can be considered in suitable scenarios.

The aim is to reduce static service passwords that go unchanged for years.

### How Is Least Privilege Applied on Servers?

Every user should be given only the privileges they need.

An application developer may not need to be a local administrator on every production server.

A database administrator may not need to be a Domain Admin.

A backup operator may not need access to the entire network.

This separation limits the attacker's progress through a compromised account.

### What Is Privilege Creep?

A user works on different projects over time.

They receive new privileges with each assignment.

But their old privileges are never removed.

Years later the user has far broader access than they need.

This situation is called **privilege creep**.

These privileges must be reviewed through periodic **access reviews**.

### How Is PAM Used in Server Management?

**Privileged access management (PAM)** can manage administrator access centrally.

An admin can open a session;

without seeing the server password,

after obtaining approval,

for a defined period.

PAM can also provide session recording.

That is particularly valuable for security and audit on critical production systems.

### What Is Just-in-Time Access?

**Just-in-time (JIT) access** is granting administrator rights temporarily when needed rather than leaving them permanently open.

A user can be a server administrator for 30 minutes, for example.

The privilege is removed automatically when the period ends.

This approach reduces standing privilege risk.

### Why Is Patch Management Critical for Server Security?

A hardened server that is out of date is still at risk.

New vulnerabilities appear constantly in operating systems and services.

Patch management must therefore be run regularly.

But on production systems, patching must be managed alongside;

testing,

change management,

rollback,

maintenance windows.

### How Quickly Should a Critical Patch Be Applied?

There is no single universal period.

The risk must be determined by;

the vulnerability's criticality,

internet exposure,

exploit availability,

asset criticality.

Vulnerabilities under active exploitation affecting internet-facing systems in particular must be handled at higher priority.

### What Is Done When There Is No Patch for a Zero-Day?

The absence of a patch does not mean nothing can be done.

**Compensating controls** can be applied.

For example;

the service can be temporarily switched off,

network access can be restricted,

a WAF rule can be added,

an EDR detection can be created,

an IPS signature can be used.

The aim is to reduce exploitation risk until a patch is released.

### Is a Vulnerability Scanner Enough on Its Own?

No.

A scanner is very useful for detecting;

missing patches,

open ports,

known vulnerabilities.

But manual analysis is required for;

the permission architecture,

business requirements,

credential exposure,

attack paths,

certain configuration risks.

**Vulnerability assessment** and **security configuration assessment** therefore complement one another.

### What Is an Authenticated Vulnerability Scan?

During an authenticated scan, the scanner accesses the server with privileged credentials and can also examine the internal configuration.

This allows;

installed patches,

software versions,

local settings

to be assessed far more accurately.

An unauthenticated scan focuses more on the attack surface visible from outside.

The two approaches provide different visibility.

### Why Should EDR Be Used on Servers?

**Endpoint detection and response (EDR)** is not only for employee computers.

On server workloads it can help detect activity such as;

malware,

ransomware,

web shells,

credential theft,

suspicious PowerShell,

persistence.

Critical Windows and Linux servers in particular must be brought into SOC visibility.

### What Is the Difference Between EDR and Antivirus?

Classic antivirus focuses largely on detecting malicious files.

EDR provides far broader behavioural telemetry.

It can monitor events such as;

process execution,

network connections,

file activity,

registry changes,

script execution.

EDR therefore provides far wider visibility for detecting modern attacks.

### Why Does PowerShell Logging Matter?

PowerShell is a powerful tool for Windows management.

It is also abused by attackers.

In suitable environments, controls such as;

PowerShell script block logging,

module logging,

transcription

can therefore be assessed.

When these records are sent to the SIEM they provide important visibility for threat hunting and incident response.

### How Should Windows Event Logging Be Planned?

Default log policies are not sufficient for every organisation.

Events such as;

logon/logoff,

account management,

privilege use,

process creation,

policy change,

PowerShell

can be assessed in particular.

But logging everything without limit is also wrong.

Storage and SOC capacity must be taken into account.

### What Is Sysmon?

**Sysmon – System Monitor** is one of the tools able to provide detailed security telemetry on Windows systems.

It can record events such as;

process creation,

network connections,

file creation,

registry activity.

Configured correctly it provides strong data for SIEM and threat hunting processes.

But a faulty configuration produces very high log volumes.

### What Is Linux auditd?

**auditd** allows security-relevant activity on Linux systems to be audited.

It can monitor;

critical file changes,

privileged commands,

authentication,

configuration changes.

These records can be forwarded to a central SIEM for analysis.

### Is Keeping Logs on the Server Itself Enough?

No.

If the attacker obtains administrator/root privileges they can delete or modify local logs.

Forwarding critical logs to a central system therefore matters.

For example the architecture:

**Server → log collector → SIEM**

can be used.

Even if the attacker compromises the server, the historical telemetry remains in the central system.

### How Is a SIEM Used in Server Security?

A SIEM can correlate events from different servers.

For example:

A user made an RDP login at 03:00.

↓

They ran PowerShell.

↓

They created a new local administrator.

↓

The EDR raised an alert.

Looked at individually these events appear unrelated.

The SIEM can relate them as an attack chain.

### Why Should Failed Login Counts Be Monitored?

Large numbers of failed logins can indicate;

brute force,

password spraying,

credential stuffing.

But looking at failed login counts alone is not enough.

A successful authentication following the failures is far more critical.

### Can a Successful Login Also Be a Security Event?

Absolutely.

The attacker's aim is not to keep generating failed logins.

Once they find the right credential they sign in successfully.

The SOC must therefore also analyse context such as;

a new location,

a new device,

an unexpected hour,

a privileged account,

a new source IP.

### What Is File Integrity Monitoring?

**File integrity monitoring (FIM)** monitors unexpected changes to critical system files.

An alert can be raised when;

a web application file,

a system configuration,

a startup script

changes.

It is useful for detecting web shells or persistence.

### What Is Application Allowlisting?

**Application allowlisting** is the approach of permitting only approved applications to run.

This method makes it harder to run malware and unauthorised tools.

But it must be designed carefully in operational terms.

Otherwise legitimate applications get blocked.

### Why Does SMB Security Matter?

**Server Message Block (SMB)** is used for file sharing and other services in Windows environments.

Old or weak SMB configurations create an attack surface.

Legacy SMB versions, unnecessary shares and broad access permissions must be assessed in particular.

It also matters that SMB traffic is not unnecessarily open between network segments.

### What Is a Legacy Protocol?

Old protocols or authentication methods no longer recommended from a security perspective can be considered legacy.

For example;

Telnet,

FTP,

old TLS versions

can be removed where modern alternatives exist.

Legacy protocol use lets an attacker take advantage of downgrade or weak encryption.

### What Is TLS Hardening?

Servers must be made to use only current, secure TLS protocols and cipher suites.

Old configurations for;

SSL,

TLS versions,

weak ciphers

can be removed.

But compatibility with older applications must be checked.

Application testing must follow the hardening.

### Why Does NTP Security Matter?

Servers' clocks being correct and synchronised matters for;

authentication,

certificate validation,

log correlation,

incident response.

If system clocks differ, relating events becomes difficult when the SOC builds an attack timeline.

Trusted NTP sources must therefore be used.

### Do DNS Settings Affect Server Security?

Yes.

Servers using a trusted DNS resolver matters.

DNS manipulation can direct the attacker's target to malicious services.

DNS telemetry can also be important in detecting;

malware,

C2,

data exfiltration.

Server DNS traffic can therefore be brought into security monitoring too.

### Should Internet Access Be Restricted on Servers?

Not every server needs unlimited internet access.

A database server does not need to connect to every address on the internet.

Through egress filtering the server can be limited to the services it actually needs.

That also makes the attacker's command & control connections harder.

### What Is Egress Filtering?

**Egress filtering** is the control of network traffic leaving the organisation.

Security teams usually focus on inbound traffic.

But a compromised server needs an outbound connection for;

C2,

malware download,

data exfiltration.

Outbound policy therefore matters too.

### How Does Network Segmentation Protect Servers?

Critical servers must be separated from the user network.

Controlled access can be designed as;

user VLAN

↓

application server

↓

database server

in that order.

If a user computer does not need direct access to the database server, that route must be closed.

This approach reduces lateral movement risk.

### What Is a Management Network?

Servers' management ports can be made reachable through a network separate from production application traffic.

For example;

SSH,

RDP,

hypervisor management

can be reachable only from the management network.

That network is then reached through VPN, PAM or a bastion.

This architecture reduces the attack surface significantly.

### What Is a Bastion Host?

A **bastion host / jump server** is the controlled intermediate system administrators use to reach critical systems.

Rather than:

laptop → production server

the model:

laptop → MFA/PAM → bastion → production server

can be applied.

Privileged access is thereby better controlled and monitored.

### Why Must the Backup Server Be Protected Separately?

The backup server is usually one of the organisation's most critical systems.

Because a ransomware attacker will try to destroy the backups after encrypting the production systems.

The backup server must therefore be protected with;

separate credentials,

network segmentation,

MFA/PAM,

immutable storage,

restricted access.

### Should the Domain Admin Also Be the Backup Administrator?

Separation of duties must be applied as far as possible.

The same credential holding full privileges over;

the domain,

backup,

virtualisation,

cloud

gives the attacker enormous control from a single point.

**Separation of duties** therefore matters.

### Is Taking Server Backups Enough?

No.

What matters is not the existence of the backup but:

#### Being able to restore it

reliably.

Regular restore tests must therefore be carried out.

A critical server backup can be restored in a controlled environment and checked for;

boot,

the application,

data integrity.

### How Does Immutable Backup Strengthen Server Security?

Immutable backup makes it harder to modify or delete backup data for a defined period.

That matters for recovery after ransomware.

But if the attacker compromises the backup management account, other risks form.

Immutability and identity security must therefore be applied together.

### Do Windows and Linux Servers Need Hardening if They Run in the Cloud?

Absolutely.

Using Windows Server on AWS EC2 does not make it secure automatically.

Nor does running Linux on an Azure VM.

The cloud provider protects the physical infrastructure.

But;

the operating system,

users,

services,

patching,

EDR,

configuration

are in most cases the customer's responsibility.

This is one of the important examples of the shared responsibility model.

### How Is Ephemeral Server Security Achieved?

In cloud-native environments some servers are short-lived.

A VM may be deleted a few hours later.

Manual hardening is not sustainable in that case.

Security must be applied through;

golden images,

infrastructure as code,

configuration management,

automated compliance.

This approach moves towards **immutable infrastructure** models.

### Can Infrastructure as Code Be Used for Server Hardening?

Yes.

Secure configurations can be standardised through Terraform, Ansible or similar automation approaches.

Administrators then do not have to configure every server manually.

But if the automation code is wrong, the same security fault spreads to hundreds of servers.

IaC must therefore also pass through security review.

### What Is a Server Security Assessment?

A **server security assessment** is the systematic evaluation of the security level of Windows and Linux servers.

This work can cover the controls for;

hardening,

vulnerabilities,

accounts,

services,

the network,

logging,

EDR,

backup.

The aim is not merely to list shortcomings.

It is to understand the risky combinations.

### How Is a Server Hardening Assessment Carried Out?

These stages can generally be applied:

#### \1. Asset Discovery

The servers are identified.

#### \2. Role Classification

Roles such as DC, database, web and application are separated.

#### \3. Baseline Selection

CIS or the corporate standard is chosen.

#### \4. Configuration Review

Current settings are analysed.

#### \5. Vulnerability Assessment

Missing patches and vulnerabilities are examined.

#### \6. Privilege Review

Admin and service accounts are checked.

#### \7. Logging Review

Audit visibility is assessed.

#### \8. Network Exposure

Ports and access routes are analysed.

#### \9. Remediation

Risks are prioritised.

#### \10. Retest

The fixes are verified.

### Is a Hardening Compliance Percentage Enough on Its Own?

No.

For example:

#### CIS compliance: 94%

looks very good.

But the remaining 6% can contain critical problems such as;

RDP being exposed to the internet,

a very high number of Domain Admins,

audit logging being switched off.

The compliance rate must therefore be assessed alongside the risk level.

### How Can a Server Security Score Be Built?

Organisations can score different categories:

#### Hardening

#### Patch

#### Identity

#### Network Exposure

#### EDR Coverage

#### Logging

#### Backup

The total can be shown as:

#### Server security posture: 82/100

for instance.

But the critical findings behind the score must always be visible.

A single number cannot describe the whole of security.

### What Should a Server Security Report Contain?

A professional report can contain these areas:

#### Executive Summary

The management summary.

#### Server Inventory

The systems assessed.

#### Security Baseline

The standard used.

#### Critical Misconfigurations

Critical configuration faults.

#### Vulnerability Findings

Missing patches and vulnerabilities.

#### Privileged Access Risks

Administrator and root risks.

#### Network Exposure

RDP, SSH and other services.

#### Logging & Monitoring

SIEM visibility.

#### EDR Coverage

Endpoint security.

#### Backup Security

Recovery risks.

#### Remediation Roadmap

A prioritised improvement plan.

### What Is the Biggest Mistake in Server Security?

One of the biggest mistakes is treating a server as secure once it has been built.

The server may be secure today.

Tomorrow a new CVE appears.

A week later a temporary firewall rule is opened.

A month later a new administrator is added.

Six months later the service account's privileges are widened.

Server security is therefore not a build task:

**It is a continuous security lifecycle.**

### What Should the Server Security Lifecycle Look Like?

A strong approach can be thought of as:

#### Build

A secure golden image.

↓

#### Harden

CIS and the corporate baseline.

↓

#### Protect

EDR, firewall and PAM.

↓

#### Monitor

SIEM and the SOC.

↓

#### Patch

Vulnerability management.

↓

#### Validate

Security assessment.

↓

#### Improve

Remediation.

↓

#### Retest

Verification of the controls.

This cycle must run continuously.

### What Is the Fundamental Difference Between Windows and Linux Hardening?

The technical tools differ.

On the Windows side;

Group Policy,

Windows Firewall,

PowerShell,

event logs,

LAPS

come to the fore.

On the Linux side;

SSH,

sudo,

PAM,

auditd,

filesystem permissions,

kernel settings

matter more.

But the security philosophy is the same:

#### Minimum Service

#### Minimum Privilege

#### Minimum Exposure

#### Maximum Visibility

These four principles form the foundation of a strong server security approach.

### Conclusion: A Secure Server Is More Than a Secure Build

Building a Windows or Linux server is easy.

Keeping it secure for years is far harder.

Because the system changes constantly.

A new user arrives.

A new application is installed.

A new port is opened.

A new vulnerability appears.

A new service account is created.

A new cloud integration is made.

Every change creates a new attack surface.

A strong **Windows Server security and Linux server hardening** approach must therefore not be applied only during the initial build.

Security must be managed continuously through the layers of;

**CIS benchmark + security baseline + patch management + least privilege + PAM + network segmentation + EDR/XDR + SIEM + backup security**

working together.

But server security is not limited to their own configuration.

In many corporate Windows infrastructures there is a far more critical system managing the servers' identity and privilege structure centrally:

**Active Directory.**

When an attacker compromises a single Windows Server, their objective is usually not to stay on that server.

They will try to collect credentials,

perform lateral movement,

carry out privilege escalation

and ultimately reach highly privileged domain accounts.

The next critical question is therefore:

#### If Active Directory is compromised, how safe can the rest of the organisation remain?