Secure Windows Server infrastructure

This module covers how to harden the security configuration of your Windows Server environment. You learn how to deploy Windows LAPS to centrally manage local administrator passwords, configure Privileged Access Workstations (PAWs) for secure administration, harden domain controllers using Server Core, TPM, BitLocker, and Device Guard with RDP restrictions, apply and analyze security baselines using the Microsoft Security Compliance Toolkit with Policy Analyzer and LGPO, and secure file-sharing traffic with SMB 3.1.1 encryption and preauthentication integrity.

This module explores using Microsoft Defender for Endpoint to provide additional protection and monitor devices against threats.

This module explains the built-in security features of Windows clients and how to implement them using policies.

Learn what each Group Policy security policy does, where it solves a real-world problem, and how to configure, audit, and manage security settings at scale in Active Directory environments.

This module covers how to manage security in an Active Directory Domain Services (AD DS) environment. You learn how to configure user account rights following the principle of least privilege, restrict privileged accounts from dangerous sign-in methods, delegate AD permissions to non-administrative users for tasks like password resets, add accounts to the Protected Users group to prevent credential caching and enforce Kerberos-only authentication, deploy Windows Defender Credential Guard to isolate credentials against Pass-the-Hash and Pass-the-Ticket attacks, block legacy NTLM authentication in favor of Kerberos, and find and remediate problematic accounts including inactive users and accounts with non-expiring passwords.

Service accounts provide the security context that Windows services, scheduled tasks, and applications use to reach local and network resources. Learn what service accounts are, the problems they cause, and how to choose and configure the correct local or managed account type on Windows Server 2025.

This module covers how to secure user accounts in an Active Directory environment. You learn how to configure user account rights following least privilege, use the Protected Users group and authentication policy silos to limit authentication scope for privileged accounts, configure Windows Defender Credential Guard hardware prerequisites and deployment, implement NTLM blocking by auditing NTLM traffic and then configuring deny policies, and locate and remediate problematic accounts such as inactive users and accounts with permanent passwords.

This module focuses on effectively managing security controls in Microsoft Entra ID by securing identities, authentication, and authorization to protect users, groups, and external identities against threats while ensuring secure and seamless access to resources.

This module explores comprehensive security monitoring and governance for Azure DevOps environments. Learn to implement pipeline security, configure Microsoft Defender for Cloud for threat protection and compliance, manage Azure Policy for governance enforcement, secure resources with locks, use Microsoft Defender for Identity threat detection, and integrate GitHub Advanced Security with Microsoft Defender for unified security visibility across your development lifecycle.