Furkan İkkan Türkçe
Back to posts

12 Dangerous Windows Default Settings to Disable After Install

Fresh Windows installs carry risky defaults. Here are 12 settings I disable on every server and workstation to reduce the attack surface.

WindowsWindows SecurityHardeningWindows ServerPowerShellSysadminSecurity Defaults

A fresh Windows install is not secure by default. In my environment, the first thing I do after deployment is go through a hardening checklist, because Windows default settings leave doors open that shouldn't be. Here are 12 dangerous Windows default settings I disable on every server and workstation to cut down the attack surface before the machine ever touches production.

Why Fresh Windows Installs Are Not Secure

Microsoft ships Windows with usability in mind, not security. That makes sense for consumer laptops, but in a server environment or a corporate domain, those defaults become liabilities. I learned this the hard way years ago, and now I have a post-install script that flips these settings automatically.

As I mentioned before when talking about detecting rogue devices on your network (https://furkanikkan.com/urun/aginizdaki-izinsiz-cihazlari-10-dakikada-tespit-edin-28), visibility matters. But prevention matters more. Let's walk through the settings I change every single time.

Network and Sharing Defaults

1. Network Discovery and File Sharing

On a fresh install, Windows enables Network Discovery and File and Printer Sharing for the current network profile. If a machine lands on a flat network segment, every other host can see it and potentially enumerate shares.

I disable this immediately on servers. On workstations, I only enable it for the Private profile, never Public.

# Disable network discovery and file sharing on all profiles
Set-NetFirewallRule -DisplayGroup "Network Discovery" -Enabled False -Profile Any
Set-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Enabled False -Profile Any

2. PowerShell Remoting Left Enabled via WinRM

WinRM is not always on by default, but some deployment tools enable it and leave it running with default auth settings. I make sure to either disable WinRM entirely or restrict it to HTTPS with specific trusted hosts.

3. LMHOSTS Lookup Enabled

This one is old but still present. LMHOSTS lookup can enable name resolution attacks on legacy networks. I disable it through the TCP/IP advanced settings or via registry:

# Disable LMHOSTS lookup
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" -Name EnableLMHOSTS -Value 0

User Account and Authentication Risks

4. Local Administrator Account Enabled

The built-in Administrator account is disabled by default on client Windows, but on Server Core or during some deployments, it stays active. I disable it and use a renamed, individually tracked admin account instead.

Disable-LocalUser -Name "Administrator"

5. Password Complexity Left at Defaults

The default password policy requires 7 characters and three of four character types. That was fine ten years ago. I bump minimum length to 12 and enable smart lockout policies through Group Policy. On domain controllers, this is non-negotiable.

6. Store Passwords Using Reversible Encryption

This policy is disabled by default, but I have seen deployments where someone enabled it for a legacy app and forgot. Check it:

Get-ADDefaultDomainPasswordPolicy | Select ReversibleEncryptionEnabled

If that returns True, fix it immediately.

Remote Access and Execution Defaults

7. Remote Desktop Open to Everyone

RDP itself is not enabled by default on client Windows, but on Server it is. The problem is the default configuration allows connections from any authenticated user. I restrict RDP access to a specific security group and enforce Network Level Authentication.

I also change the default port. It is security through obscurity, sure, but it cuts down on brute-force noise in my logs significantly.

8. SMBv1 Still Available

SMBv1 should be dead. Microsoft disabled it by default in recent builds, but I still encounter it on upgraded systems. Check and remove it:

# Check SMBv1 status
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

# Disable it
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart

9. Unrestricted PowerShell Execution Policy

On servers, I set the execution policy to RemoteSigned at minimum. AllSigned is better for high-security environments. I have seen fresh deployments where someone set it to Unrestricted to make a script work and never changed it back.

Telemetry and Privacy Settings

**10. Diagnostic and Usage Data Sent to Microsoft

On servers, telemetry should be minimal. I set the diagnostic data level to Security (0) on Server editions and Basic (1) on workstations where policy allows.

# Set telemetry to Security level on Server
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name AllowTelemetry -Value 0

11. Windows Error Reporting Enabled

WER sends crash data to Microsoft. On production servers, I disable it. Not because of the data itself, but because the crash dumps can contain memory contents that you do not want leaving your environment.

Browser and App Defaults

12. Internet Explorer / Edge Legacy Mode Enabled

On Server 2016 and 2019, Internet Explorer is still installed by default. I remove it or at least disable Enhanced Security Configuration tweaks that make admins bypass warnings blindly. The ESC prompts are so annoying that people whitelist everything, which is worse than just removing IE.

# Remove Internet Explorer
Disable-WindowsOptionalFeature -FeatureName Internet-Explorer-Optional-amd64 -Online -NoRestart

My Post-Install Hardening Workflow

Here is the order I follow on every new Windows machine:

  1. Run Windows Update fully, reboot, repeat until clean
  2. Disable the 12 settings above
  3. Rename the default Administrator account
  4. Install only required roles and features
  5. Configure firewall rules for specific ports and sources
  6. Enable auditing for failed logons and privileged use
  7. Join to domain only after local hardening is complete
  8. Take a baseline backup (and as I mentioned in my backup failure post (https://furkanikkan.com/urun/geri-yuklemede-basarisiz-olan-yedekler-sessiz-veri-kaybi-senaryosu-27), actually test a restore)

Warning: Do not run these changes blindly on a production server without testing first. Some applications depend on specific settings, especially SMBv1 for legacy gear and WinRM for management tools. Break it in staging, not in production.

The goal is not to make Windows unbreakable. Nothing is. The goal is to remove the easy wins an attacker looks for in the first few minutes after gaining access. These 12 settings are the low-hanging fruit. Fix them before someone else finds them.

Cover image: Negative Space · CC0 (Openverse / kamu malı) · https://stocksnap.io/photo/macbook-laptop-X0CYLUO8E0