What are the common mistakes in configuring Windows Server security settings?

- Contrase?as débiles o no cambiadas. - No aplicar actualizaciones de seguridad. - Permisos incorrectos. - Firewall mal configurado. - Auditoría insuficiente. - No desactivar servicios innecesarios. - No utilizar roles de servidor dedicados. - No implementar una política de bloqueo de cuentas. - No cifrar la comunicación. - No realizar copias de seguridad regulares

Test the permissions with a real user in a real-world environment. For instance: - Can your Accounting people still use their outdated software with their role? - Will your local admins manage to install a security solution that needs to also install a service?

Misconfiguring permissions is a common error when configuring Windows Server security settings. Granting excessive permissions or overlooking access rights often leads to vulnerabilities. Incorrectly assigning privileges can allow unauthorized users to access sensitive data or modify critical system settings. To mitigate this risk, administrators should regularly audit permissions, adhere to the principle of least privilege, and ensure proper access controls are in place to maintain a secure server environment.

Common mistakes in configuring Windows Server security settings include:Weak Passwords: Using easily guessable or default passwords can compromise server security. Ensure strong, unique passwords for all accounts.Outdated Software: Failing to apply updates and patches can leave vulnerabilities open. Regularly update the operating system and installed applications.Improper User Permissions: Granting excessive permissions to users can lead to unauthorised access. Follow the principle of least privilege, giving users only the permissions they need to perform their tasks.Unnecessary Services: Running unnecessary services or features increases the attack surface. Disable or remove any services that are not essential for server functionality.

En mi experiencia una combinación de permisologia mal asignada a uno o varios usuarios permite no solo que ocurran fallas a nivel de procesos si no también un riesgo muy real de fuga de información, también agregaría contrase?as débiles y el no seguimiento de los ingresos y egresos de la compa?ía porque al dejar los accesos de un ex empleado activo puede llevar a una debilidad enorme en la seguridad

Weak passwords pose a significant security risk in Windows Server configurations. Using easily guessable or commonly used passwords makes systems vulnerable to brute force attacks or unauthorized access. Administrators should enforce password policies that mandate strong, complex passwords, coupled with regular password updates. Educating users about password best practices and implementing multi-factor authentication further bolsters server security against potential breaches.

Weak passwords is more a security threat consideration. Though the more permissions and or the higher level of permissions a user has the the more critical password security becomes. In many of the organisations that I worked for we enforced the need for users with elevated rights to have separate accounts to their normal user account. The elevated rights account had a more significantly stronger set of password related settings, e.g. longer password, shorter password lifespan and failed attempt lockout count, etc. It is recommended that such accounts have passwords that are over 15 character long. Do not forget to manage and maintain generic/ built in accounts with elevated rights. The will also need stronger password security.

A good password hygiene is key for administration accounts. So keep in mind to have a large charset (characters which could be potentially in the password) and don’t keep your password to the minimum length. Those passwords should not be forgotten when it comes to changing the passwords in regular time frames (I suggest one year) and in special cases, line team members leaving the team. The best thing to do in my opinion is to use a PAM (Privilege Access Management), which manages the administrative accounts and only grants access after approval on a task to task basis.

Educating your users about passphrases vs passwords is a good idea, Iseeabirdsnestoutmywindow! is a lot easier to remember than crXo8%7!@%gjf and will result in less post its under keyboards.

D'après mon expérience , une autre erreur dans la configuration des paramètres de sécurité de Windows Server à utiliser des mots de passe faibles pour les comptes, en particulier pour les comptes administrateurs. Les mots de passe faibles sont facile à deviner , à déchiffrer ou à voler par les personnes extérieurs qui peuvent ensuite accéder au serveur et à ses ressources. Pour éviter cette erreur vous devriez appliquer des stratégies de mot de passe fort et complexe.

Adding unnecessary services to a server poses resource and security risks to mention a few. First of all, critical resources that could be used by other resources get used by these unnecessary services. Leading to resource constraints and inefficiencies. Lastly, a service that is not used frequently may get overlooked This can become an attack vector that can be leveraged to compromise the server and network.

Print Spooler The print spooler is a service that queues up print jobs whenever you print anything from your computer. However, if you never actually print anything from your computer, you do not need to run the print spooler service. Certificate Propagation Service The certificate propagation service is used whenever you insert a smart card into the smart card reader slot on your laptop. This could also be an external smart card reader. The service will read the smart card and add the certificate to your computer. This service is typically used in an enterprise or corporate environment and controlled via Group Policy through IT.

One prevalent mistake in Windows Server security configuration is leaving unnecessary services running. Unused services can become potential entry points for attackers, increasing the system's attack surface. Administrators should regularly review and disable or remove unnecessary services and features. This reduces the exposure to vulnerabilities, minimizes resource consumption, and enhances the server's overall security posture by focusing on essential, actively utilized services.

To effectively manage an infrastructure you need to have affective management of services and associated service accounts. For example, sharing the same service account between multiple applications/ services puts all those applications/ service at risk if the service account is compromised. Your infrastructure need to have effective management of its services. Including password and permissions management. You also need to understand the service account inter-dependencies between applications/ services. Particularly if they relate to legacy systems.

Unnecessary services tend to be forgotten when it comes to implementing regular updates. In the best case try to get rid of those services completely. If this is not possible due to operating system rules, be sure that those services are always up to date to minimize security risk from this direction.

Bugs are the most common entry points for viruses and hackers. Often an underscored area in managing Server security. Critical to ensure subscriptions to regular updates on patches and versions and configure automatic updates with regular monitoring as enabling automatic updates without good Internet connectivity still presents security risk. Blocking users who access the server with outdated client software is one way of enforcing systems updates across the enterprise.

Microsoft Defender for Endpoint (MDE) is part of Microsoft 365 Defender and can be deployed via multiple configurations. During my experience with the product, I deployed/ reviewed and evaluated many Defender for Endpoint instances and configured new instances for many customers around the world; from small companies to larger enterprises. This blog will explain the common mistakes/ configuration mistakes around Defender for Endpoint deployments.

Demand from your vendors to work with latest security patches. Too many times there's some bizarre plugin that works only with specific old versions, or a legacy software solution that requires to keep the system open to attacks. Don't compromise.

Outdated software is not a good term. As you may have legacy systems that are out of support, but which you need for some reason. If you have any 'redundant' system(s), then they should be removed as soon as possible. Though their inter-dependency with other applications/ services will need to be taken into account. To ensure save removal. Remember when removing a 'redundant application/ service, you need to: - Validate that the application/ service removal has not adversely impacted operations. - Remove the application/ service safely. - Remove redundant service accounts. - Update your backup processes and associated disaster recovery plans, etc. - Update your software licence, etc., log(s). - Update your service catalogue, etc.

Most common security tools these days are able to spot eol (end of life) software. You should make sure that there are tickets created for such events and that the removal of said software is taken care of. It is a good idea to implement a policy for the whole company that end of life software should never be used, except after written management approval and risk acceptance. In this case be sure that the risk acceptance is not valid for life but is reevaluated regularly.

Deciding which backup system works for you needs you to consider a few factors. A full backup is a mirror copy of all your data, while a differential backup only saves the files that have been altered since your last full backup. An incremental backup does a reduplication of the strings that have been altered since your last backup, whichever backup it was. The Bacula backup system is flexible, and its myriad benefits make it a perfect companion for any business serious about keeping its data safe. Losing data is a company's worst nightmare, and Bacula has proven time and again to be a superior backup strategy. Bacula is a good backup soft.

It is important to remember that for legal reasons you may need to keep hold of legacy applications/ services. This is so that you can read, etc., the data saves by that application/ services, if required. So, you may need to consider how the legacy application/ service will be stored, e.g. in a disabled state, how its data will be stored (securely) for the required time defined in the legislation. As well as, how these factors may impact your backup and potentially disaster recovery and related processes gong forward.

Disaster Recovery: Coming from a disaster recovery background I can tell you that this is one of the MOST important strategies you can implement. Having on site backup with proper rotation is critical, even more critical is incorporating a replication to an offsite location that may allow for a longer retention period and ability to archive data to a secure location. Disaster recovery is not as simple as creating a backup rotation policy but incorporating true replication of critical data to a completely separate location. With the advent of ransomware this makes offsite data replication even more essential.

Make sure your monitoring is tuned as well, if your constantly getting notifications from a noisy monitoring solution odds are you're going to create a rule sending them straight to a folder to sit unread.

Insufficient monitoring represents a critical oversight in Windows Server security. Neglecting to implement robust monitoring solutions leaves systems vulnerable to undetected threats or suspicious activities. Establishing comprehensive monitoring mechanisms, including event logs, intrusion detection systems, and regular security audits, is essential. Proactive monitoring aids in identifying and addressing security breaches or anomalies promptly, ensuring a timely response to potential threats, and fortifying the server's overall security resilience.

Implement Windows Servers with a specific service requirement in mind. One service,One server. if it's a Domain controller, don't add a file/print. Once you follow this methodology you can then utilise the in built BPA (best practice analyser) which will provide you output of how your implementation matches up to MS's way of doing things. Altering ACL of an existing folder structure? DO NOT use the GUI, (security tab under the folder properties and glibbly click propogate to all folders, sub and files.) This operation will overwrite ALL of the folders ACLs that are marked with the inherit function. A better method would be to use the command line tool ICACLS. To view existing permissions, there's no better tool than sysinternal's AccessChk