Competition Checklist · 03 · Windows Server
Windows Server Checklist
Review privileged identities, installed roles, required shares, active sessions, services, RDP, firewall state, persistence, and event evidence without breaking the server mission.
Server hardening is dependency-sensitive. A setting that looks unnecessary on a workstation may be essential on a file server, domain controller, web server, or other role-based system.
Quick Use
Server rule
Preserve the service mission while reducing unnecessary exposure
Do not treat a server like a normal workstation. Roles, service accounts, management paths, shares, and network listeners may exist because the server is supposed to provide them.
Opening pass
Understand the server before deep remediation
Read the server mission before changing roles, services, shares, identities, or remote access.
A server may be intentionally providing file sharing, directory services, DNS, DHCP, web services, or remote administration that must remain available.
Record approved privileged identities before account cleanup.
Local Administrators, Domain Admins, service accounts, and delegated operators may all be legitimate depending on the scenario.
Identify required server roles and features.
Removing an unfamiliar role can break mission-critical services and create more problems than it solves.
Capture current shares, sessions, services, listeners, and firewall state.
A baseline helps distinguish required activity from suspicious or unnecessary exposure.
Confirm how administrators are expected to manage the server.
RDP, PowerShell remoting, console access, and other management paths should match the mission.
Preserve authentication and service-installation evidence before remediation.
Server logs often contain the clearest evidence of privilege changes, remote access, service installation, and failed logons.
Identity & privilege
Confirm who is allowed to administer the server
Local users
Get-LocalUser
net user
Every local identity is approved, expected, and documented before disablement or removal.
Local Administrators
Get-LocalGroupMember Administrators
net localgroup Administrators
Only approved administrators remain in the local Administrators group.
Domain users and privileged groups
Get-ADUser -Filter * | Select-Object SamAccountName,Enabled
Get-ADGroupMember "Domain Admins"
Use these only if Active Directory is present. Privileged membership must match the mission.
Disabled or stale accounts
Search-ADAccount -AccountDisabled -UsersOnly
Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 30.00:00:00
Inactive or disabled accounts are reviewed in context instead of deleted automatically.
Roles & services
Protect required server functionality
Installed roles and features
Get-WindowsFeature | Where-Object Installed
Each installed role is either required, expected, or investigated before removal.
Server services
Get-Service | Where-Object Status -eq Running | Sort-Object Name
Unexpected services are correlated with role dependencies and executable paths.
Automatic services
Get-CimInstance Win32_Service | Where-Object StartMode -eq Auto | Select-Object Name,State,StartName,PathName
Automatic startup is justified by role, dependency, or mission requirement.
Recently installed services
Get-WinEvent -FilterHashtable @{LogName="System"; Id=7045} -MaxEvents 80New service installations are correlated with path, account, timestamp, and mission expectations.
Shares & permissions
Review SMB access before changing it
SMB shares
Get-SmbShare
Required shares remain available and unexpected shares are investigated before removal.
Share permissions
Get-SmbShareAccess -Name <ShareName>
Share permissions follow the least privilege needed by the mission.
NTFS permissions
Get-Acl <Path> | Format-List
NTFS permissions are checked together with share permissions so effective access is understood.
Active SMB sessions
Get-SmbSession
Get-SmbOpenFile
Current sessions and open files are documented before disrupting access.
Remote administration
Restrict management access without locking out approved admins
Remote Desktop service
Get-Service TermService
Get-NetTCPConnection -LocalPort 3389 -ErrorAction SilentlyContinue
RDP is enabled only if the mission requires it and approved administrators are the only intended users.
Remote Desktop Users group
Get-LocalGroupMember "Remote Desktop Users"
Membership matches approved remote-management users.
PowerShell remoting
Get-PSSessionConfiguration
Get-NetTCPConnection -LocalPort 5985,5986 -ErrorAction SilentlyContinue
WinRM exposure is required, restricted, and understood before it is changed.
Other listeners
Get-NetTCPConnection -State Listen | Select-Object LocalAddress,LocalPort,OwningProcess
Every important listener is mapped to a process, service, and mission purpose.
Firewall
Reduce exposure while preserving required traffic
Firewall profiles
Get-NetFirewallProfile
Required profiles are enabled and the server role still functions.
Enabled inbound rules
Get-NetFirewallRule -Direction Inbound -Enabled True
Inbound rules support required services without exposing unnecessary management or application ports.
Port filters
Get-NetFirewallRule -Enabled True | Get-NetFirewallPortFilter
Rules are reviewed by actual ports and protocols rather than display name alone.
Network profiles
Get-NetConnectionProfile
The active network category matches the intended server environment.
Persistence
Review scheduled and automatic execution
Scheduled tasks
Get-ScheduledTask
Get-ScheduledTask | Where-Object State -ne Disabled
Unexpected tasks are reviewed by action, trigger, run-as identity, author, and executable path.
Startup locations
Get-ChildItem "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" -Force
Startup entries are expected or investigated before removal.
Run keys
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Autorun entries point to expected applications and trusted locations.
Service accounts
Get-CimInstance Win32_Service | Select-Object Name,StartName,State,PathName
Services running under privileged or custom accounts are justified and documented.
Event quick reference
Server events worth correlating
4624
Successful logon
Correlate remote or privileged sessions with later administrative activity.
4625
Failed logon
Review repeated failures, unusual usernames, source addresses, and timing.
4672
Special privileges assigned
Identify privileged sessions that deserve closer correlation.
4720
User account created
Investigate newly created accounts against the approved roster.
4728
Member added to global security group
Important for domain-group changes such as privileged group membership.
4732
Member added to local security group
Review additions to local Administrators and other sensitive groups.
5140
Network share accessed
Use when share auditing is available to correlate SMB access.
7045
Service installed
Correlate service installation with executable path, user activity, and timestamps.
High-priority findings
Investigate the finding before changing the server
Unapproved Domain Admin or local Administrator
Preserve group-membership and log evidence, confirm the mission roster, then remove privilege only if the identity is unauthorized.
Unexpected service running as a privileged account
Record service name, path, start account, state, installation evidence, and dependencies before containment.
Unapproved or overly broad SMB share
Capture share path, share permissions, NTFS permissions, open files, and sessions before making changes.
RDP exposed when not required
Verify the approved administration method, review group membership and firewall rules, then restrict or disable RDP if justified.
Required server role stopped or broken
Restore required functionality first, then investigate why the service or role changed.
Suspicious new service or scheduled task
Preserve executable path, account, trigger, timestamps, logs, and related network activity before disabling it.
Do not blindly change
Common Windows Server overreactions
Do not remove server roles just because they are unfamiliar.
Do not disable SMB if the mission requires file sharing.
Do not remove Domain Admins or local Administrators without checking the approved roster.
Do not stop a service before checking role dependencies.
Do not close RDP until you know how the server is supposed to be administered.
Do not delete shares before checking active sessions and required paths.
Do not modify firewall rules in bulk without testing required services afterward.
Do not treat domain-joined and standalone servers as if they have identical identity models.
Verification sweep
Prove the server still performs its required role
Identity
Approved users, administrators, and domain privilege match the mission.
Roles
Required Windows Server roles and features remain installed and functional.
Shares
Required SMB shares are accessible only to intended users and groups.
Services
Required services are running and any disabled service was confirmed unnecessary.
Remote access
RDP, WinRM, and other management paths match the approved design.
Firewall
Firewall profiles are enabled and required server traffic still passes.
Persistence
Scheduled tasks, startup entries, and service-based persistence match the final approved state.
Logs
Important authentication, privilege, share, and service-installation evidence was preserved.
Windows Server final checklist
Finish only when security and required services both verify
The Windows Server mission was reviewed before major changes.
Approved local and domain privileged users match the final state.
Required roles and features remain installed.
Required services remain running.
Required SMB shares remain available.
Share and NTFS permissions were reviewed together.
Active SMB sessions and open files were considered before share changes.
RDP and WinRM state match the scenario.
Firewall profiles are enabled as required.
Listening ports were mapped to required or investigated services.
Scheduled tasks and service-based persistence were reviewed.
Relevant authentication, group-change, share, and service events were checked.
Every major change was verified against required server functionality.
The change log records what changed, why, and the result.