Published on August 25, 2026 · 8 min read
Most Windows users don't think about system hardening. Install the OS, set up an account, install a few apps, and that's it. As long as the default config works, why mess with the registry, disable services, or tweak policies?
Default config does work — but it's designed for compatibility, not security. Those two goals often conflict. Microsoft keeps most switches open so Windows runs on hundreds of hardware combinations. They're on because some legacy devices still need them. Not because they're secure.
SMBv1 is the original file-sharing protocol for Windows. Microsoft deprecated it around 2014 and has been recommending removal ever since. But it's often still enabled, because a handful of old NAS devices, printers, and industrial equipment only speak SMBv1. A single old printer on the network can keep the protocol alive for everyone.
The protocol itself doesn't authenticate messages properly. A man-in-the-middle attacker sitting on the same network can inject commands into an existing SMB session. That's exactly what WannaCry used in 2017 — and the vulnerability it exploited is still out there. A scan of the public internet today still finds plenty of machines with port 445 open and SMBv1 running.
To check if SMBv1 is enabled:
Get-SmbServerConfiguration | Select EnableSMB1Protocol
If it returns True, you can turn it off with:
Set-SmbServerConfiguration -EnableSMB1Protocol $false
Before you do that, check what still uses it:
Get-SmbConnection | Where-Object {$_.Dialect -match "1.0"}
If nothing shows up, you're safe to disable it. If something does, that's the device you need to replace or isolate first.
LLMNR (Link-Local Multicast Name Resolution) is a fallback name resolution protocol. When DNS fails, Windows broadcasts the hostname on the local network and waits for someone to answer. The problem: anyone can answer. An attacker on the same network can respond to these broadcasts and trick the machine into authenticating against a fake server, then capture the NTLM hash.
This is the basis of tools like Responder. On a typical corporate network, it takes minutes to collect a dozen credentials. LLMNR has been on by default since Windows Vista, mostly for backward compatibility with small networks that don't have DNS.
You can disable it via Group Policy under Computer Configuration > Administrative Templates > Network > DNS Client, or via registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient EnableMulticast = 0
RDP isn't enabled by default, but it's common enough that scanners find millions of open 3389 ports on the public internet. Once exposed, attackers brute-force it with tools that try thousands of passwords per minute. If the account has a weak password or no account lockout policy, they're in.
The fix is either to not expose RDP directly to the internet (put it behind a VPN), or to enforce two-factor authentication on it. Limiting source IPs in the firewall also helps.
The hard part isn't "how to turn it off." It's "what breaks if I do."
A friend of mine runs IT for a mid-size company. He disabled LLMNR and SMBv1 on a batch of workstations one Friday afternoon. Monday morning, the office printer stopped working. Took him three hours to figure out which machine was acting as the print spooler and using SMBv1 to communicate with the printer. He had to roll back on that machine, test it in isolation, then push the change out to the rest.
Stories like this are why hardening stays on the "someday" list. The change is correct in principle. The risk of breaking something in production is real. Without a quick way to undo, most admins avoid the topic entirely.
WinSystemHarden packages 29 hardening measures from CIS Benchmarks and NSA guidance into profiles. Not all of them are equally important. Five cover the highest-impact surfaces — SMBv1, LLMNR, RDP, PowerShell execution policy, and Windows Defender tuning. The other 24 are more granular.
Three profiles:
Every change is logged. Every change is reversible with one click. You can push a change to one machine, watch it for a week, then decide.
It's like saving your work before shutting down. You want to know what you're changing, and have a way back if it breaks.
Download WinSystemHarden free.
⬇️ Download Free