01
Read the scenario
Identify the server's required role before touching accounts, services, firewall rules, roles, or policies.
CyberPatriot Training Hub · Windows Server
Windows Server
Learn to secure Windows Server without breaking the roles, services, authentication, networking, and remote management the scenario requires.
Windows Server requires a different mindset from a workstation. Before hardening, identify what the server is responsible for, what depends on it, and how you will verify that those functions still work after each change.
Pathway Snapshot
Lessons18
Core workflow5 stages
EnvironmentWindows Server
ApproachRole-aware defense
Main question
How do you harden a server without breaking what the network depends on?
Server security is dependency-aware. A domain controller, DNS server, DHCP server, file server, or application server may be essential to many other systems. Before disabling an account, service, port, role, or feature, understand the function and the consequences.
Safety boundary
Train the skill, not the live answer
These lessons teach defensive Windows Server administration in fictional or authorized practice environments. Always follow the scenario and preserve required services instead of applying a generic hardening checklist blindly.
Overall server workflow
Five stages for safe server hardening
02
Inventory the server
Record installed roles, features, services, domain status, local/domain accounts, network functions, shares, and remote-management requirements.
03
Protect dependencies
Map what DNS, DHCP, AD DS, file services, applications, and remote management depend on before making high-impact changes.
04
Harden deliberately
Fix confirmed weaknesses using the narrowest change that satisfies the scenario and preserves required functionality.
05
Verify continuously
Re-test roles, clients, authentication, shares, remote management, logs, and security controls after meaningful changes.
Priority zones
What you are protecting
Identity & Directory
Local accounts, domain users, groups, privileged membership, service identities, password policy, and Group Policy.
Server Roles
AD DS, DNS, DHCP, file services, installed features, dependent services, and role-specific configuration.
Protection
Defender, firewall, updates, remote administration, least privilege, and unnecessary exposure.
Evidence & Verification
Event logs, scheduled tasks, Defender history, PowerShell inventory, change tracking, and end-to-end service testing.
Complete pathway
Windows Server Lessons
Lessons move from server workflow, identity, and policy into protection, roles, network services, evidence, administration, and final review.
Lesson 01Windows Server
Windows Server Competition Workflow
Focus
Build a safe server-first competition workflow that protects required roles, services, users, and network functions.
Defensive lab
Review a fictional server scenario, identify required roles, define a baseline, and build a prioritized action plan.
Open Lesson →
Lesson 02Windows Server
Server Manager & Role Inventory
Focus
Use Server Manager and administrative tools to understand installed roles, features, services, and server responsibilities.
Defensive lab
Inventory a fictional server and classify each role as required, unnecessary, or investigate.
Open Lesson →
Lesson 03Windows Server
Local Users, Groups & Privilege
Focus
Review local accounts, administrators, service identities, and privilege without disrupting required server functions.
Defensive lab
Compare a fictional local account list with scenario authorization and preserve service-account dependencies.
Open Lesson →
Lesson 04Windows Server
Active Directory Users & Computers
Focus
Review domain users, groups, computers, administrative membership, disabled accounts, and account properties when AD DS is present.
Defensive lab
Audit a fictional domain and identify unnecessary privilege while preserving required identities.
Open Lesson →
Lesson 05Windows Server
Group Policy Management
Focus
Understand local versus domain policy, GPO scope, inheritance, precedence, and safe security-policy review.
Defensive lab
Trace a fictional security setting through Group Policy before deciding where it should be changed.
Open Lesson →
Lesson 06Windows Server
Password, Lockout & Account Policies
Focus
Review local and domain password requirements, account lockout behavior, and authentication policy without using one-size-fits-all values.
Defensive lab
Compare fictional scenario requirements with the effective account-policy configuration.
Open Lesson →
Lesson 07Windows Server
Microsoft Defender Antivirus
Focus
Review Defender health, protection settings, exclusions, detections, and security intelligence on Windows Server.
Defensive lab
Investigate a fictional Defender exclusion and detection while preserving evidence.
Open Lesson →
Lesson 08Windows Server
Windows Defender Firewall
Focus
Protect server network exposure without breaking required roles such as DNS, DHCP, file sharing, or remote administration.
Defensive lab
Review fictional inbound rules and narrow exposure around required server services.
Open Lesson →
Lesson 09Windows Server
Windows Update & Patch Management
Focus
Evaluate update state, restart requirements, servicing risk, and verification for systems that may host critical roles.
Defensive lab
Plan safe update sequencing for a fictional server with required services.
Open Lesson →
Lesson 10Windows Server
Roles, Features & Required Services
Focus
Understand how Windows Server roles, features, and dependent services fit together before disabling or removing anything.
Defensive lab
Map dependencies for fictional DNS, DHCP, AD DS, and file-service requirements.
Open Lesson →
Lesson 11Windows Server
File Shares, NTFS & SMB Permissions
Focus
Review shared folders, NTFS permissions, share permissions, ownership, inheritance, SMB exposure, and least privilege.
Defensive lab
Secure a fictional department share while keeping required users and service accounts functional.
Open Lesson →
Lesson 12Windows Server
RDP, WinRM & Remote Administration
Focus
Review remote administrative access, authorized users, firewall scope, Remote Desktop Services, WinRM, and management exposure.
Defensive lab
Reduce unnecessary remote access while preserving the scenario-required administration path.
Open Lesson →
Lesson 13Windows Server
DNS Server Security Review
Focus
Review DNS zones, forwarders, recursion, dynamic updates, records, permissions, and service health when DNS is required.
Defensive lab
Investigate a fictional DNS server while protecting name resolution for required clients.
Open Lesson →
Lesson 14Windows Server
DHCP Server Security Review
Focus
Review DHCP scopes, exclusions, reservations, options, authorization, leases, and service availability when DHCP is required.
Defensive lab
Audit a fictional DHCP configuration and protect required address assignment.
Open Lesson →
Lesson 15Windows Server
Scheduled Tasks & Persistence Review
Focus
Inspect server scheduled tasks, triggers, actions, service accounts, unusual paths, and other persistence clues.
Defensive lab
Preserve and classify a fictional high-privilege scheduled task before remediation.
Open Lesson →
Lesson 16Windows Server
Event Viewer & Server Logs
Focus
Use Security, System, Application, role-specific, and operational logs to troubleshoot services and build evidence-based timelines.
Defensive lab
Correlate fictional domain, service, remote-access, and system events around a known incident window.
Open Lesson →
Lesson 17Windows Server
PowerShell for Server Administration
Focus
Use inspection-first PowerShell for role inventory, AD review, services, firewall, logs, shares, and verification.
Defensive lab
Build a repeatable read-only server inventory and verify one controlled change.
Open Lesson →
Lesson 18Windows Server
Windows Server Final Review Checklist
Focus
Bring identity, roles, policy, protection, networking, evidence, and required services into one final verified server state.
Defensive lab
Complete a fictional end-of-round server review and document unresolved investigate items.
Open Lesson →
Server evidence preview
Fictional practice environment
01
Server name: DC-PRACTICE
02
Role: Domain controller with DNS
03
Required function: domain authentication and name resolution
04
Required remote access: RDP for Morgan only
05
Required share: \DC-PRACTICETeamDocs
06
Forensic clue: unknown scheduled task ran under a privileged account
07
Important boundary: preserve evidence before changing the task
Server principles
Six rules to carry through the pathway
Server role comes first
A domain controller, DNS server, DHCP server, and file server cannot be hardened as if they were ordinary workstations.
Scenario before checklist
Required services and users must survive every security change.
Dependencies before disable
A service that looks unnecessary may support a critical role or application.
Inspect before automate
Use read-only tools and commands before applying scripts or bulk changes.
Evidence before remediation
Preserve logs, task details, account state, Defender findings, and other forensic clues before cleanup.
Verify from the client perspective
A role is not truly verified until the users or systems that depend on it can still use it.
Start here
Lesson 01 — Windows Server Competition Workflow
Begin by learning how to identify the server's job, preserve required roles, establish a baseline, prioritize risk, and verify every meaningful change.