Enterprise Infrastructure Security Hardening

Karolis Vitkus

Delivered security remediation and infrastructure hardening across enterprise Windows, Microsoft 365, virtualisation and network environments.

The work addressed security assessment findings while balancing risk reduction against application compatibility, operational impact and service availability.

Challenge

The environment included legacy systems, business-critical applications and security controls introduced at different stages of the organisation’s development.

Remediation therefore required more than applying generic security settings. Each finding needed to be assessed against:

  • Operating system support
  • Application compatibility
  • Authentication dependencies
  • Network communication requirements
  • Existing security controls
  • Business impact
  • Vendor requirements
  • Reboot or service interruption requirements
  • Rollback options

Some settings could be implemented centrally, while others required staged testing or narrowly scoped exceptions.

Responsibilities

My responsibilities included:

  • Reviewing vulnerability assessment and compliance findings
  • Confirming whether findings were applicable to the affected systems
  • Identifying the configuration responsible for each exposure
  • Developing remediation plans and change records
  • Producing PowerShell and configuration-based remediation steps
  • Defining pilot groups and implementation stages
  • Evaluating application and authentication compatibility
  • Preparing rollback procedures
  • Coordinating changes with application owners
  • Validating security controls after implementation
  • Investigating operational issues introduced by security policies
  • Documenting approved exceptions and compensating controls

Technologies

  • Microsoft Defender Antivirus
  • Microsoft Defender Attack Surface Reduction
  • Windows Server
  • Active Directory
  • Group Policy
  • PowerShell
  • Microsoft Entra ID
  • Conditional Access
  • Microsoft 365
  • VMware vSphere
  • VMware ESXi
  • Fortinet FortiGate
  • TLS and PKI
  • SMB
  • NTLM
  • Windows Event Viewer
  • Vulnerability assessment platforms

Areas of remediation

Authentication hardening

Reviewed and remediated legacy authentication settings, including:

  • LAN Manager and NTLM compatibility policies
  • Storage of legacy password hashes
  • NTLMv1 exposure
  • Account lockout controls
  • Administrative access paths
  • Service account dependencies
  • Entra ID authentication and Conditional Access behaviour

Changes affecting authentication were tested carefully because older applications, devices and services may depend on legacy protocols.

SMB security

Reviewed SMB configuration across Windows servers and clients, including:

  • SMB signing requirements
  • Legacy SMB protocol exposure
  • Guest access
  • File-service compatibility
  • Client and server policy alignment

Changes were validated against business applications and file services before wider deployment.

TLS and cryptographic configuration

Reviewed protocol and cipher configuration to remove or reduce reliance on obsolete cryptographic standards.

The remediation process considered:

  • Enabled TLS protocol versions
  • Weak cipher suites
  • Certificate trust and intermediate chains
  • Application compatibility
  • Web server configuration
  • Firewall and VPN requirements
  • External certificate validation results

Where immediate removal was not operationally safe, the risk was documented and a staged remediation path was proposed.

Microsoft Defender controls

Implemented and troubleshot Microsoft Defender security capabilities, including:

  • Attack Surface Reduction rules
  • Antivirus exclusions
  • Controlled application testing
  • Event-log analysis
  • Policy validation
  • Detection of blocked installers and administrative operations

Exceptions were limited to the smallest practical scope. Folder-level exclusions were avoided where a narrower process, file or publisher-based control could meet the requirement.

Publisher and signature validation

Reviewed digitally signed application installers to distinguish authorised software from unsigned or untrusted executables.

Validation included:

  • Authenticode signature status
  • Signing certificate subject
  • Certificate chain validity
  • File publisher information
  • Product and version metadata
  • File hash recording where appropriate

Publisher trust was considered alongside file location, certificate validity and vendor provenance. A valid signature was not treated as proof that all software from the publisher should be trusted without restriction.

Virtualisation and infrastructure remediation

Planned and implemented updates across VMware and supporting infrastructure, including:

  • VMware ESXi security updates
  • VMware vCenter patching
  • VMware Tools updates
  • Host and workload impact assessment
  • Maintenance-mode planning
  • Workload migration
  • Post-change validation

Changes were designed to preserve workload availability wherever the platform allowed rolling maintenance.

Network and firewall hardening

Reviewed firewall and network-device configuration, including:

  • Administrative management exposure
  • WAN-facing services
  • VPN configuration
  • Firewall policy scope
  • TLS certificates
  • Management access restrictions
  • Logging and syslog
  • Firmware currency
  • Unused objects and public mappings

Management services were restricted to approved networks and interfaces wherever operationally possible.

Implementation method

A repeatable implementation method was used for security changes:

  1. Confirm the finding and affected assets
  2. Determine whether the exposure was genuine
  3. Review vendor and application dependencies
  4. Record the current configuration
  5. Define the proposed secure configuration
  6. Identify expected impact and reboot requirements
  7. Prepare validation and rollback procedures
  8. Test on a limited system or pilot group
  9. Review security and operational logs
  10. Deploy in controlled stages
  11. Confirm the effective configuration
  12. Rerun the relevant security assessment where available
  13. Document residual risks and exceptions

Example: Attack Surface Reduction exception

A business application installer was blocked by an Attack Surface Reduction policy. Disabling the rule globally would have reduced protection across the entire server estate.

The investigation included:

  • Identifying the rule responsible for the block
  • Reviewing Microsoft Defender operational events
  • Confirming the installer’s location and purpose
  • Checking its digital signature
  • Confirming the publisher and product metadata
  • Assessing whether a narrow exclusion could be used
  • Testing the application after applying the exception
  • Retaining the main security rule for all other applications

The resulting exception was scoped more narrowly than disabling the security control.

Change safety

Security changes were accompanied by:

  • Documented current and proposed settings
  • Application-owner approval where required
  • Pilot deployment
  • Maintenance windows
  • Configuration backups
  • Registry or policy rollback instructions
  • Service and application validation
  • Event-log monitoring
  • Defined stop conditions

Changes involving authentication, encryption, network access or virtualisation were treated as potentially service-affecting even where no outage was expected.

Outcome

The programme improved the security posture of the environment while maintaining the availability of business-critical systems.

It also established a more consistent remediation process based on technical validation, controlled implementation and documented exceptions, rather than applying assessment recommendations without evaluating operational impact.

Lessons learned

  • A detected setting should be validated before remediation begins
  • Security baselines must account for real application dependencies
  • Exceptions should be narrow, documented and periodically reviewed
  • Authentication changes require coordinated client and server testing
  • Security controls should not be disabled globally to resolve a local application issue
  • Rollback procedures are essential for identity, network and cryptographic changes
  • Successful implementation should be confirmed through configuration checks, logs and reassessment

Security and confidentiality

Customer names, assessment reports, internal systems, IP addresses, policy identifiers and detailed security configurations have been intentionally omitted or generalised.