Secure Windows Server on-premises and hybrid infrastructures

This module covers how to implement network security for Windows Server IaaS virtual machines in Azure. You learn how to configure network security groups (NSGs) with inbound and outbound security rules, priority-based processing, and default rules, deploy and configure Azure Firewall for centralized network traffic filtering, configure Windows Defender Firewall with Advanced Security for host-level protection, choose the appropriate filtering solution from NSGs, Azure Firewall, and Windows Defender Firewall, and use Azure Network Watcher to capture network traffic and log network flows for diagnostics.

Learn about Microsoft Defender for Cloud and how to onboard Windows Server computers to Defender for Servers by using Azure Arc. Also learn about Microsoft Sentinel, security information and event management (SIEM), and security orchestration, automation, and response (SOAR).

Manage operating system updates for Azure virtual machines and Azure Arc-enabled servers by using Azure Update Manager.

You're able to configure Azure Disk Encryption for Windows IaaS VMs and back up and recover encrypted data.

In this module, learn how to monitor Windows Server Azure IaaS VMs for changes in files and the registry, and other monitor modifications made to application software.

This module covers how to secure Windows Server DNS to protect your name resolution infrastructure. You learn how to implement split-horizon DNS to separate internal Active Directory-integrated DNS from internet-facing DNS servers, create DNS policies for scenarios including traffic management, geo-location-based routing, application load balancing, and split-brain DNS, implement and manage DNS policies using PowerShell cmdlets for granular query and zone transfer control, apply DNS security features including cache locking, DNS socket pool, and response rate limiting, and implement DNSSEC to cryptographically sign DNS zones and protect against spoofing and cache tampering.

This module covers how to secure user accounts in an Active Directory environment. You learn how to configure user account rights following least privilege, use the Protected Users group and authentication policy silos to limit authentication scope for privileged accounts, configure Windows Defender Credential Guard hardware prerequisites and deployment, implement NTLM blocking by auditing NTLM traffic and then configuring deny policies, and locate and remediate problematic accounts such as inactive users and accounts with permanent passwords.

This module covers how to harden the security configuration of your Windows Server environment. You learn how to deploy Windows LAPS to centrally manage local administrator passwords, configure Privileged Access Workstations (PAWs) for secure administration, harden domain controllers using Server Core, TPM, BitLocker, and Device Guard with RDP restrictions, apply and analyze security baselines using the Microsoft Security Compliance Toolkit with Policy Analyzer and LGPO, and secure file-sharing traffic with SMB 3.1.1 encryption and preauthentication integrity.

This module covers how to manage updates for Windows Server using WSUS and Azure Automation Update Management. You learn how to deploy WSUS in various topologies including single server, server hierarchies, and disconnected environments, follow the four-phase update management process (assess, identify, evaluate and plan, deploy), configure computer groups and approval rules for staged update deployments, and extend update management to cloud and hybrid environments using Azure Automation Update Management with the Log Analytics agent.