Microsoft AZ-801: Windows Server Security and Hardening — Study Guide

By Laurynas Brazys · 7 August 2026 · #microsoft #az-801 #certification #exam-prep #study-guide

Part of the Microsoft Windows Server Hybrid Administrator Associate AZ-801 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Hardening Windows Server is a layered exercise that prioritizes identity isolation, application control, exploit and malware mitigation, and strict network boundaries—enforced consistently with repeatable baselines. The objective is to prevent credential theft, reduce attack surface with default-deny controls, detect and contain malicious behavior, and verify effective configuration through reporting. The capabilities described below are native to modern Windows Server and integrate with management at scale through Group Policy, PowerShell, and Microsoft security services.

Identity and Credential Protection

Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate secrets from the OS so that LSASS cannot be scraped by malware. VBS requirements include UEFI 2.3.1 with Secure Boot, hardware-assisted virtualization (Intel VT-x/AMD-V with SLAT), and TPM 2.0 (strongly recommended for key protection). For VMs, use Generation 2 with Secure Boot and a vTPM; VBS runs using the Windows hypervisor and does not require the Hyper-V role to be installed.

Enable Credential Guard via Group Policy: Computer Configuration > Administrative Templates > System > Device Guard > Turn On Virtualization Based Security. Set Virtualization Based Protection of Code Integrity to Enabled, choose Credential Guard Configuration as Enabled with Secure Boot (or with Secure Boot and DMA Protection where supported). Reboot is required. Verify in msinfo32: Virtualization-based security: Running; Credential Guard: On. Eventing appears under Microsoft-Windows-CodeIntegrity/Operational and DeviceGuard.

Local Security Authority (LSA) protection complements Credential Guard. Configure LSASS to run as a protected process (PPL) to block unsigned code injection even by administrators. Use Group Policy: Computer Configuration > Administrative Templates > System > Local Security Authority > Configure LSASS to run as a protected process. This sets RunAsPPL, forcing signed, trusted drivers only. Credential Guard isolates secrets in a VSM-secured LSAISO process; LSASS PPL hardens the LSASS process boundary. Enable both for defense-in-depth.

Privileged Access Workstations (PAW) operationalize credential isolation. Adopt a tiered administration model:

• Tier 0: AD DS, ADFS, PKI, identity and security roots of trust
• Tier 1: application and infrastructure servers
• Tier 2: user workstations Each tier uses separate admin accounts and dedicated PAWs. PAWs are hardened with Credential Guard, WDAC, HVCI (Memory Integrity), SmartScreen, restricted browsing, and tight firewall egress. Block cross-tier logon paths (no Tier 0 admin signs into Tier 1 or 2 devices). This model materially reduces credential theft blast radius.

Application Control and Attack Surface Management

Windows Defender Application Control (WDAC) enforces a default-deny policy for code. Policy types include a single base policy (SiPolicy) and optional supplemental policies to extend allow rules without changing the base. Modern Windows Server supports multiple policies concurrently. WDAC governs both user-mode binaries/scripts and kernel-mode drivers. Trust can be defined by Microsoft signatures, WHQL, Windows Store, your enterprise code-signing certificate, file hash, publisher/file attributes, or a Managed Installer that stamps deployed code as trusted. Deploy in Audit mode first to collect events, then switch to Enforced to block. Author policies using the ConfigCI PowerShell module: New-CIPolicy -Level Publisher -FilePath .\Base.xml -UserPEs 1; Merge-CIPolicy for consolidation; Set-CIPolicyIdInfo to stamp policy IDs; ConvertFrom-CIPolicy to generate the signed .p7b; deploy to %SystemRoot%\System32\CodeIntegrity\SiPolicy.p7b or via Group Policy. WDAC can also restrict COM class usage and registration to prevent malicious COM abuse.

Exploit protection provides process mitigations globally and per-app. System-level mitigations include DEP, ASLR (force relocation, bottom-up randomization, high-entropy), CFG, SEHOP, and strict handle and image load policies. App-level overrides allow granular tuning, such as enabling/disabling Child Process Creation, Export Address Filtering, or Arbitrary Code Guard for a specific executable. Manage with the Windows Security app (App & browser control > Exploit protection) or PowerShell: Get-ProcessMitigation -System; Set-ProcessMitigation -System -Enable CFG; Set-ProcessMitigation -Name app.exe -Disable ChildProcess. Export/Import XML for scale: Export-ProcessMitigation and Import-ProcessMitigation. When a line-of-business app must spawn child processes, create a per-app override disabling that mitigation for the executable only.

Attack Surface Reduction (ASR) rules block malware techniques at the behavior layer. Configure per rule in Block, Audit, or Warn mode. Common rule IDs include:

• D4F940AB-401B-4EFC-AADC-AD5F3C50688A: Block Office apps from creating child processes
• 3B576869-A4EC-4529-8536-B80A7769E899: Block Office apps from creating executable content
• 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84: Block Office apps from injecting code into other processes
• BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550: Block executable content from email and webmail clients
• D3E037E1-3EB8-44C8-A917-57927947596D: Block JavaScript/VBScript from launching downloaded executables
• 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC: Block execution of potentially obfuscated scripts
• D1E49AAC-8F56-4280-B9BA-993A6D77406C: Block process creations originating from PSExec and WMI commands
• 01443614-CD74-433A-B99E-2ECDC07BFC25: Block executables unless they meet prevalence, age, or trusted list criteria
• 9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2: Block credential stealing from LSASS Manage with PowerShell: Set-MpPreference -AttackSurfaceReductionRules_Ids <comma-separated GUIDs> -AttackSurfaceReductionRules_Actions Enabled|AuditMode|Warn|Disabled. Define process/file exclusions that apply to ASR only with -AttackSurfaceReductionOnlyExclusions. Report events in Event Viewer under Microsoft-Windows-Windows Defender/Operational and, when onboarded to Microsoft Defender for Endpoint, in advanced hunting tables (DeviceEvents, DeviceSecurityEvents) with explicit ASR rule identifiers.

Controlled folder access (CFA) thwarts ransomware by restricting untrusted processes from writing to protected folders. Defaults include user profile Documents, Pictures, Desktop, Favorites, and more; you can add custom paths (including data volumes hosting application shares). Allow specific line-of-business binaries to write via “allowed apps.” Manage using Set-MpPreference -EnableControlledFolderAccess Enabled|AuditMode; -ControlledFolderAccessProtectedFolders; -ControlledFolderAccessAllowedApplications. Monitor blocks in Windows Defender event logs and tune allowed apps based on evidence, not guesswork.

Endpoint Protection and Baselines

Windows Defender Antivirus on servers provides real-time protection and scheduled/on-demand scanning. Scan types include Quick, Full, and Custom; schedule definition, engine, and platform updates through Group Policy or WSUS. Use MpCmdRun.exe -Scan -ScanType 2 for Full, or PowerShell Start-MpScan -ScanType Quick. Configure exclusions (paths, processes, extensions) with Set-MpPreference -ExclusionPath/-ExclusionProcess/-ExclusionExtension, but minimize exclusions and prefer precise process-based entries; pair with ASR and WDAC to avoid compensating risks. Tamper Protection prevents unauthorized changes to Defender settings (registry and WMI) by malware or local admins; manage centrally via Microsoft Defender for Endpoint security settings management for servers. Enable cloud-delivered protection (MAPS) and automatic sample submission for rapid blocking of emerging threats; verify with Get-MpComputerStatus (AMServiceEnabled, AntispywareSignatureLastUpdated, IsTamperProtected, CloudProtectionEnabled).

Security baselines implement proven hardening at scale. Use the Microsoft Security Compliance Toolkit (MSCT) to download Windows Server baselines (GPO backups and documentation). Import baseline GPOs via Group Policy Management (right-click Group Policy Objects > Import Settings) or apply locally with LGPO.exe. Validate in a test OU first. Use Policy Analyzer (part of MSCT) to compare current GPOs and local policy to baseline, identify conflicts, and produce deviation reports. Document any intentional deviations with business justification and change control, and re-run comparisons after patch cycles to maintain drift awareness.

Network and Policy Enforcement

Windows Defender Firewall with Advanced Security is stateful and profile-aware. Enforce least privilege with inbound default-deny and explicit allows for necessary services, scoping by remote addresses, interfaces, and users/service SIDs. Use service-hardening rules where possible to bind traffic to the correct service, not just a port. Outbound rules should be defined for servers that initiate connections to constrained destinations, preventing lateral movement and unauthorized egress. Connection security rules add IPsec (authentication, integrity, and optionally encryption) to traffic; remember they don’t open ports—pair them with firewall rules. For strong, interoperable authentication across domains and workgroups, use computer certificate authentication. Configure IPsec exemptions when diagnostics like tracert must remain clear (WFAS > Properties > IPsec Settings > IPsec exemptions). Apply domain, private, and public profiles appropriately; server interfaces connected to untrusted segments should use the public profile. Enable remote management scenarios with targeted rule groups only (for example, COM+ Network Access (DCOM-In) and Remote Event Log Management for Computer Management over DCOM and event log access).

Understand how Local Security Policy and Group Policy interact. Local Security Policy (secpol.msc) is the starting layer, but domain GPOs override it following LSDOU processing: Local, Site, Domain, then OU (last-writer wins per setting), with some security settings merging (for example, user rights assignments aggregate “deny” and “allow” entries with precedence rules). Use Resultant Set of Policy (RSoP) via gpresult /r (or gpresult /h report.html) and the Group Policy Results Wizard to see the effective configuration, including which GPO and WMI filter applied. When troubleshooting security settings (Defender, firewall, WDAC staging, LSA protection), always confirm the applied GPO and its precedence chain, then gpupdate /force after changes.

Practical Problem Scenario

Contoso Ltd. is rolling out a new HR application on Windows Server 2022 that writes to a data share and spawns helper processes for reporting. Security leadership mandates ransomware resilience, prevention of credential theft, and default-deny execution on Tier 1 servers without disrupting the HR app.

1. Establish the identity boundary with Credential Guard and LSA protection

• Action: Configure Turn On Virtualization Based Security (Credential Guard with Secure Boot) and Configure LSASS to run as a protected process via a hardened “Tier 1 – Server Security” GPO applied to the HR servers OU.
• Why: Secrets cannot be harvested from LSASS, and PPL prevents code injection, reducing the impact of a server compromise.

2. Enforce application allow-listing with WDAC in audit, then enforce

• Action: Generate a base WDAC policy using New-CIPolicy with Publisher and FilePublisher levels from a gold build hosting the HR app; add Managed Installer to trust the enterprise software distribution; sign and deploy the policy in Audit mode, then move to Enforced after reviewing events.
• Why: WDAC provides default-deny for unauthorized binaries, scripts, and drivers while safely allowing the HR app and managed deployments.

3. Tune exploit mitigations per app

• Action: Apply system CFG/ASLR globally; for the HR reporting executable, set a per-app override to allow Child Process Creation using Set-ProcessMitigation -Name hrreport.exe -Disable ChildProcess, leaving other mitigations enabled.
• Why: Keeps exploit hardening broadly active while accommodating a legitimate app behavior referenced by operations.

4. Block common attack techniques with ASR rules and targeted exclusions

• Action: Enable key ASR rules in Block mode (for example, D4F940AB… for Office child-process blocking, 9E6C4E1F… to block LSASS credential theft, 01443614… for prevalence/age trust) and set any initial high-friction rules to Audit; add a specific -AttackSurfaceReductionOnlyExclusions for the HR app’s signed binary if needed.
• Why: ASR reduces macro, script, and living-off-the-land abuse without broadly weakening defenses; exclusions are precise and ASR-only.

5. Protect data paths with Controlled folder access

• Action: Enable CFA in Block mode; add the HR data share path and application data folders to protected folders; add the HR app binaries as allowed apps based on signed path.
• Why: Prevents unauthorized encryption or tampering of business-critical data by untrusted processes, delivering ransomware resistance.

6. Confirm antivirus posture and cloud protection

• Action: Ensure real-time protection, cloud-delivered protection, and sample submission are enabled; schedule Full scans off-hours; review Get-MpComputerStatus; restrict exclusions to the HR app’s process only if strictly necessary.
• Why: Maintains up-to-date detection with minimal attack surface increase.

7. Lock down the network plane

• Action: Configure inbound-only rules required by the HR service with service-SID scoping; define minimal outbound rules to databases and update endpoints; if encrypting server-to-server traffic, add connection security rules with certificate authentication; add IPsec exemptions for diagnostic needs like tracert.
• Why: Precise allow-only networking and IPsec prevent lateral movement and eavesdropping while preserving necessary operations.

8. Baseline and verify

• Action: Import the Windows Server security baseline from the Microsoft Security Compliance Toolkit to the Tier 1 GPO, review with Policy Analyzer against existing GPOs, and document approved deviations for the HR workload.
• Why: Ensures comprehensive hardening beyond point controls and provides measurable, reportable compliance.

This combination was chosen to isolate credentials (Credential Guard, LSA PPL), default-deny code execution (WDAC), block common attacker tradecraft (ASR, exploit protection), prevent data tampering (CFA), enforce malware detection (Defender AV with cloud), and close network gaps (firewall and IPsec), with baselines and reporting ensuring consistency and auditability.

All domains · Microsoft Defender for Cloud and Endpoint Security →

Practice these questions → · Timed practice on ExamRoll.io →

Browse Microsoft →