Updates and security

1. Updates #

Patch fast, without breaking.

Strategy and tools #

Microsoft releases security fixes on the second Tuesday of each month (Patch Tuesday), as cumulative updates. A good strategy deploys in rings: a pilot group first, then the rest, with planned reboot windows.

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5      # derniers correctifs
Install-Module PSWindowsUpdate -Scope AllUsers
Get-WindowsUpdate                                       # correctifs disponibles
Install-WindowsUpdate -AcceptAll -AutoReboot:$false
Get-WURebootStatus ; Get-WUHistory -Last 10

Common mistake: Leaving servers “too critical to reboot” unpatched for months. They are exactly the favorite targets. Plan redundancy (cluster, two DCs, load balancer) so each node can be restarted in turn.

2. Protecting PCs and servers #

Antivirus, encryption, local passwords.

Microsoft Defender Antivirus #

Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated, QuickScanAge
Update-MpSignature ; Start-MpScan -ScanType QuickScan
Get-MpThreatDetection | Select-Object -First 5
Add-MpPreference -ExclusionPath 'D:\SQLData'            # exclusion documentée et limitée (recommandations de l'éditeur)
Set-MpPreference -AttackSurfaceReductionRules_Ids 'd4f940ab-401b-4efc-aadc-ad5f3c50688a' -AttackSurfaceReductionRules_Actions Enabled   # règle ASR : bloquer les processus enfants d'Office

Good to know: Defender is built in and sufficient as an antivirus; Microsoft Defender for Endpoint (paid) adds detection and response (EDR), essential to investigate an intrusion.

BitLocker #

Enable-BitLocker -MountPoint 'C:' -EncryptionMethod XtsAes256 -TpmProtector -UsedSpaceOnly
Add-BitLockerKeyProtector -MountPoint 'C:' -RecoveryPasswordProtector
$kp = (Get-BitLockerVolume -MountPoint C:).KeyProtector | Where-Object KeyProtectorType -eq 'RecoveryPassword'
Backup-BitLockerKeyProtector -MountPoint 'C:' -KeyProtectorId $kp.KeyProtectorId   # sauvegarde de la clé dans AD
manage-bde -status

Common mistake: Enabling BitLocker without backing up the recovery key in AD or Entra ID: one firmware update or motherboard change, and the data is lost. Enforce key backup by GPO before encryption.

Windows LAPS #

Windows LAPS, built into Windows since 2023, gives each machine a unique local administrator password, rotated automatically and stored in AD (or Entra ID), readable only by authorized people.

Update-LapsADSchema                                                # une fois par forêt
Set-LapsADComputerSelfPermission -Identity 'OU=Serveurs,DC=corp,DC=exemple,DC=fr'
# GPO : Système > LAPS > Configurer la sauvegarde du mot de passe = Active Directory
Get-LapsADPassword -Identity SRV-FS01 -AsPlainText
Reset-LapsPassword                                                 # sur la machine, après usage du compte

3. Hardening #

Reducing the attack surface.

Key measures #

Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol      # doit être Disabled
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol, RequireSecuritySignature, EncryptData
Get-CimInstance -Namespace root\Microsoft\Windows\DeviceGuard -ClassName Win32_DeviceGuard | Select-Object SecurityServicesRunning
auditpol /get /category:*                                         # stratégie d'audit effective

Good practice: Measure your level with a free tool such as PingCastle (Active Directory) or HardeningKitty (servers), fix red items first, and measure again every quarter.

Commands to know #