Windows Server · Lesson 18
Windows Server Final Review Checklist
Finish the Windows Server image with a role-first verification pass that confirms security, availability, evidence, and client functionality before you stop making changes.
The final review is not another blind hardening sweep. It is a controlled check that the server is both safer and still able to perform every required job.
Final Snapshot
Learning objectives
What this final lesson should help you do
Run a complete final review of a Windows Server competition image without repeating every earlier task blindly.
Prioritize required roles, identity, policy, protection, exposure, updates, persistence, evidence, and client verification.
Confirm that hardening changes did not break Active Directory, DNS, DHCP, SMB, remote administration, or required applications.
Use both GUI and PowerShell evidence to verify the final server state.
Separate must-fix findings from investigate-later items during the final review window.
Finish with a concise, evidence-backed handoff showing what changed, what was preserved, and what still needs attention.
Final-review principle
Required function is part of security
A server is not successfully hardened if users, applications, authentication, name resolution, file access, or administration no longer work.
End-of-round warning
Stop speculative changes when verification matters more
Near the end, unresolved low-confidence findings are often safer to document than to "fix" without time to test the result.
Final review order
Ten stages for the final pass
01
Scenario and role check
Re-read the scenario. Confirm what the server must do, which services must remain available, which accounts are authorized, and which remote-management paths are required.
02
Identity and privilege
Review local or domain users, privileged groups, service identities, remote-access groups, and unexpected administrative membership.
03
Policy and authentication
Confirm password, lockout, user-right, security-option, audit, and Group Policy settings align with the intended environment.
04
Protection controls
Verify Microsoft Defender, signatures, exclusions, firewall profiles, and required inbound rules without disabling required applications or roles.
05
Patching and reboot state
Review update state, recent installations, failed updates, and whether a restart is pending. Do not reboot casually at the end.
06
Roles, services, and dependencies
Confirm required server roles are installed and their services, service accounts, dependencies, and startup behavior are healthy.
07
Shares and remote administration
Verify SMB shares, NTFS/share permissions, RDP, WinRM, user rights, and firewall scope.
08
DNS and DHCP
If installed, verify zones, records, forwarders, DHCP scopes, options, reservations, and client-side functionality.
09
Persistence and evidence
Review scheduled tasks, unexpected services, suspicious startup behavior, recent logs, and evidence that still needs preservation.
10
Client-side verification
Test the server from an authorized client. A green GUI on the server is not enough.
Role snapshot
What must still work for each common server role
Domain Controller
Domain authentication, AD users/groups, DNS, Group Policy processing, required SRV records, time consistency, and remote administration.
DNS Server
Required zones, host records, SRV records where applicable, forwarders, recursion design, interfaces, and client resolution.
DHCP Server
Authorization, active scopes, exclusions, reservations, gateway/DNS options, bindings, and client lease renewal.
File Server
Required shares, share permissions, NTFS permissions, service-account dependencies, active sessions, and client access.
Application Server
Required application services, service accounts, firewall rules, data-folder permissions, scheduled jobs, and application availability.
Remote Administration
Authorized RDP/WinRM users, user rights, service state, firewall scope, and tested management access.
Identity & Privilege
Review local users on member servers where local accounts apply.
Review Active Directory users on domain controllers or domain-managed environments.
Review local Administrators or domain privileged groups.
Review Remote Desktop Users or equivalent authorized groups.
Check disabled, expired, stale-looking, and unfamiliar accounts carefully before removal.
Review service accounts and scheduled-task identities before changing passwords or group membership.
Remove only clearly unauthorized privilege.
Verify required administrators can still perform their jobs.
Policy & Authentication
Review effective password policy.
Review account lockout policy.
Review User Rights Assignment.
Review Security Options.
Review advanced audit policy where relevant.
Check whether domain Group Policy overrides local settings.
Avoid casual edits to default domain-wide GPOs.
Use gpresult or Group Policy Results when effective settings are unclear.
Defender
Confirm Defender or the authorized endpoint protection product is present and healthy.
Confirm real-time protection state.
Confirm security intelligence/signatures are current enough for the environment.
Review recent detections.
Review exclusions instead of deleting them blindly.
Investigate suspicious exclusions and preserve their evidence.
Avoid conflicts with approved third-party antivirus/EDR.
Run an appropriate scan only when it will not create unnecessary server impact.
Firewall
Confirm all firewall profiles are in the intended state.
Review required inbound rules for server roles.
Review RDP and WinRM exposure.
Review DNS, DHCP, SMB, IIS, or application rules as applicable.
Check profile, protocol, port, application, service, and remote-address scope.
Narrow unnecessary exposure before disabling a required service.
Verify required client connectivity after firewall changes.
Confirm no broad temporary troubleshooting rule was left enabled.
Updates & Reboots
Record OS version and build.
Review update history.
Review failed updates.
Check whether a restart is pending.
Do not install optional drivers or feature upgrades automatically.
Preserve WSUS or other intended enterprise update sources.
Verify role and application health after any installed update.
Do not perform a last-minute reboot without a full post-restart test plan.
Roles & Services
Review installed roles and features.
Review running and stopped services.
Review startup type for important services.
Review service accounts.
Review executable paths for unfamiliar services.
Review required and dependent services before disabling anything.
Check Service Control Manager events for repeated failures.
Confirm required roles are usable from clients.
File Shares
Inventory required SMB shares.
Review share paths.
Review share permissions.
Review NTFS permissions.
Review inheritance and explicit permissions.
Review service-account access.
Check active SMB sessions before disruptive changes.
Verify read/write behavior using the intended user accounts.
Remote Administration
Confirm whether RDP is required.
Review authorized RDP users and groups.
Review Allow log on through Remote Desktop Services.
Review Deny log on through Remote Desktop Services.
Check TermService state.
Review RDP firewall scope.
Check WinRM if PowerShell remoting is required.
Verify remote access from an authorized management client.
DNS
Confirm DNS Server service state.
Review required forward lookup zones.
Review reverse zones where applicable.
Preserve required AD SRV records.
Review forwarders.
Review zone-transfer scope.
Review dynamic-update configuration.
Review listening interfaces.
Test required internal names from a client.
Test approved forwarded/external resolution when required.
DHCP
Confirm DHCP Server service state.
Confirm authorization when part of the AD design.
Review active scopes.
Review exclusions and reservations.
Review Option 003 gateway.
Review Option 006 DNS servers.
Review Option 015 DNS domain name.
Review interface bindings.
Review suspicious or exhausted leases.
Renew a lease from an authorized client.
Tasks & Persistence
Review scheduled tasks and subfolders.
Review task actions, arguments, triggers, and principals.
Review recent task history and TaskScheduler events.
Review newly installed or unusual services.
Investigate privileged execution from writable folders.
Preserve task XML and related evidence before disabling suspicious tasks.
Prefer reversible changes when appropriate.
Verify required automation still runs.
Event Logs
Review recent System errors and warnings.
Review Security log events relevant to accounts and authentication.
Review Application errors for required software.
Review TaskScheduler Operational.
Review Windows Defender Operational.
Review WindowsUpdateClient Operational.
Review DNS/DHCP/Group Policy logs when those roles are installed.
Preserve evidence before cleanup or restart.
Do not clear logs as part of routine final review.
PowerShell final baseline
Fast read-only checks before you stop
Roles
Get-WindowsFeature | Where-Object {$_.Installed -eq $true} | Select-Object DisplayName, Name, InstallStateServices
Get-CimInstance Win32_Service | Select-Object Name, State, StartMode, StartName, PathNameFirewall
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundActionDefender
Get-MpComputerStatusShares
Get-SmbShare | Select-Object Name, Path, Description, SpecialTasks
Get-ScheduledTask | Select-Object TaskPath, TaskName, StateRecent System events
Get-WinEvent -LogName System -MaxEvents 40 | Select-Object TimeCreated, Id, ProviderName, LevelDisplayName, MessageUpdate history
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 20 HotFixID, Description, InstalledOnFix now
High-confidence findings with clear impact
Unauthorized administrator
A clearly unauthorized user or group has administrative privilege and no role dependency requires it.
Protection disabled
Defender or the approved endpoint protection control is unexpectedly disabled without a documented reason.
Firewall broadly exposed
A required service is exposed to unnecessary networks or profiles and can be safely narrowed.
Required service broken
DNS, DHCP, SMB, AD, RDP, application, or another scenario-required function is currently not working.
Suspicious persistence with evidence
A task or service is clearly unauthorized, evidence has been preserved, and disabling it will not break required functionality.
Bad client configuration
DHCP or DNS settings are clearly sending clients to the wrong gateway, DNS server, or namespace.
Investigate before changing
Low-confidence findings with possible dependencies
Unfamiliar but role-linked service
The service belongs to an installed role or application and has no clear evidence of being unnecessary.
Old-looking account with unclear dependency
The account may belong to a service, task, application, or legacy process that still matters.
Optional update
The update is not required for immediate security and introduces restart or compatibility risk.
Unfamiliar DNS record
The record may support Active Directory, a required service, or another infrastructure dependency.
Unknown reservation or exclusion
The DHCP entry may protect required static infrastructure.
Vendor scheduled task
The task maps to installed required software but its exact purpose is not yet fully documented.
Client-side verification
Prove the server works from the outside
Domain authentication
Sign in or authenticate with an authorized domain account when AD is required.
DNS
Resolve the required domain and hostnames from an authorized client.
DHCP
Renew a lease on an authorized test client and confirm IP, gateway, DNS, and suffix.
SMB
Open required shares using the intended reader/editor accounts.
RDP
Connect from the authorized management source using an approved account.
WinRM
Use Test-WSMan or the approved remoting workflow when WinRM is required.
Application
Open or query the required server application from a client.
Web service
Load the required site or endpoint from a client if IIS or another web service is required.
Final evidence packet
What your team should be able to explain
Server role and scenario summary
Authorized administrator list
Major policy findings
Defender status and important detections
Firewall profile and exposure notes
Patch/restart state
Required role/service health
Share and permission findings
Remote-administration state
DNS/DHCP findings when applicable
Suspicious task/service evidence
Important Event Viewer timeline notes
Final client-side verification results
Items intentionally deferred and why
Stop conditions
When to stop hardening and protect stability
Required role breaks
Stop adding more changes and restore or troubleshoot the last known change before continuing.
Remote access is lost
Use the preserved recovery path and fix the access issue before any additional hardening.
Multiple systems fail at once
Suspect a shared dependency such as DNS, firewall, identity, policy, or networking before changing several unrelated components.
Evidence becomes unclear
Preserve logs and configuration state before additional changes make the timeline harder to reconstruct.
Time is nearly over
Stop risky experimentation. Focus on required-role health, obvious security problems, evidence, and final verification.
A reboot is pending
Do not reboot automatically. Decide whether there is enough time to complete the full post-restart verification plan.
Fictional final-review lab
Finish DC-PRACTICE
Step 01
Identify the server
Fictional DC-PRACTICE is a domain controller and DNS server. Morgan administers it through RDP. Domain authentication and DNS are mandatory.
Step 02
Run the final identity and policy pass
Confirm privileged groups, required service identities, password/lockout policy, user rights, and effective Group Policy.
Step 03
Run the protection pass
Confirm Defender health, review exclusions, check firewall profiles, and ensure RDP/DNS exposure is limited to what the scenario requires.
Step 04
Run the role pass
Verify AD-related services, DNS zones and SRV records, required remote administration, and recent update/restart state.
Step 05
Run the evidence pass
Review recent System, Security, Defender, Task Scheduler, and DNS events. Preserve evidence for any suspicious finding before remediation.
Step 06
Verify from a client
Confirm domain logon, DNS resolution, Group Policy availability, and Morgan's authorized RDP access.
Step 07
Document and stop
Record the final state, list deferred investigations, and avoid making new speculative changes once the server is secure and required functions are verified.
Common final-review mistakes
Avoid creating a new problem at the finish line
Repeating the entire checklist mechanically
The final pass should focus on verification, unresolved findings, and dependencies rather than redoing every earlier step from zero.
Making risky changes near the end
Late changes leave less time for rollback, reboot, and client verification.
Trusting the server console only
DNS, DHCP, SMB, RDP, web services, and applications should be verified from clients when possible.
Clearing evidence after remediation
Logs and task/service evidence may be needed to prove what happened and confirm the fix.
Fixing unfamiliar items without ownership checks
Server roles and enterprise tools often contain services, tasks, records, and accounts that look unfamiliar but are required.
Rebooting automatically
A reboot can expose hidden dependency failures at the worst possible time.
Reflection
Final reasoning check
Question 1
Why should the final review start with the scenario and server role?
Question 2
Why is client-side verification necessary after server hardening?
Question 3
What kinds of findings should be fixed immediately versus investigated later?
Question 4
Why can a late reboot be riskier than a pending update?
Question 5
What evidence should be preserved before disabling suspicious persistence?
Question 6
What should determine when you stop making changes and move to documentation?
Windows Server pathway complete
All 18 Windows Server lessons are now covered
The next step is to connect the Windows Server hub and all lesson navigation, verify every route in the browser, then run the production build before committing the section.