Baseline and harden these machines
We take admin rights off daily accounts, give every laptop its own rotating local admin password, turn on BitLocker with the recovery keys stored where you control them, limit installs and browser extensions to an approved list, and block USB storage and personal cloud sync. Score your laptops below to see which of those you already have.
About two minutes. No email to see the result.
Fresh start, or adding protection to employee machines?
It sets the price. A machine nobody uses yet has nothing to work around, so it costs less to lock down. Got both kinds? Pick already in use.
No email until step 5.
The kit behind the fixes, written up for whoever has to run it.
Microsoft's official toolkit for downloading, analyzing, testing, editing, and storing the security configuration baselines that ship with Windows. It...
Read the write-up →App Control for Business is the current name for Windows Defender Application Control (WDAC), Microsoft's policy-driven allowlisting engine. It decide...
Read the write-up →HardeningKitty is an open-source PowerShell tool from scip AG that audits and hardens Windows against a long list of benchmarks, then writes the resul...
Read the write-up →Practical guidance for protecting Windows workstations against supply chain attacks. Covers Authenticode verification, App Control for Business (WDAC)...
Read the write-up →Windows LAPS is built into Windows and gives every laptop its own local admin password, rotated on a schedule and backed up to Microsoft Entra ID or A...
Read the write-up →BitLocker is built into Windows Pro, Enterprise and Education and encrypts the whole drive, so a drive pulled from a laptop left in a taxi reads as no...
Read the write-up →The questions map to these benchmark topics. Section numbers move between releases, so we check them against the current benchmark at each audit instead of quoting them here.