Securing Windows Server: Hardening the Registry and Services

Windows Server hardening starts with the two things attackers probe first: the registry and the services running in the background. On a Windows VPS you control both directly, and a short list of changes removes a large part of the default attack surface. This guide walks through backing up the registry, applying the settings that matter, and disabling services you do not use — without locking yourself out.

Before you start

• A Windows VPS or Admin RDP plan with Administrator access. Connect as 203.0.113.10:3389 — Remote Desktop uses TCP port 3389 by default.
• An elevated PowerShell session. Right-click PowerShell and choose Run as administrator.
• The browser console in your VPS provider's control panel open in a second tab. If a change breaks Remote Desktop, the console still gets you in.
• A backup or restore point before you start. Registry edits and disabled services are reversible, but a restore is faster. See Back up a Windows VPS.

Back up the registry first

Export the hives you are about to touch. reg export writes a .reg file you can double-click to restore.

mkdir C:\backup
reg export "HKLM\SYSTEM\CurrentControlSet\Control" C:\backup\control.reg /y
reg export "HKLM\SOFTWARE\Policies" C:\backup\policies.reg /y
reg export "HKLM\SYSTEM\CurrentControlSet\Services" C:\backup\services.reg /y

Store the files off the server as well — copy them to your workstation over RDP drive redirection or SFTP. A backup that only lives on the machine you are hardening is not a backup.

Apply the registry hardening settings

Run these in an elevated cmd or PowerShell prompt. Each one sets a single value; nothing here needs a reboot except where noted.

reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" /v UseLogonCredential /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v NoLMHash /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RestrictAnonymous /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RestrictAnonymousSAM /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v EveryoneIncludesAnonymous /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" /v EnableMulticast /t REG_DWORD /d 0 /f

What each one does:

• UseLogonCredential=0 stops Windows keeping plaintext credentials in memory for WDigest. On current Windows builds this is already the default; setting it explicitly keeps it that way.
• NoLMHash=1 stops the server storing LAN Manager password hashes, which are trivial to crack.
• RestrictAnonymous=1, RestrictAnonymousSAM=1 and EveryoneIncludesAnonymous=0 block anonymous enumeration of shares, users and SIDs.
• EnableMulticast=0 turns off LLMNR, the protocol behind many credential-relay attacks on a flat network.

Turn on LSA protection

LSA protection (RunAsPPL) makes the Local Security Authority run as a protected process, so non-Microsoft code cannot read its memory.

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f

Harden SMB

SMBv1 is obsolete and should be off. Requiring SMB signing stops tampering with file traffic.

Set-SmbServerConfiguration -EnableSMB1Protocol $false -RequireSecuritySignature $true -Confirm:$false

If a legacy appliance still needs SMBv1, keep it enabled only on the interface that appliance uses, or replace the appliance. Check the vendor's current guidance, since SMBv1 support has been dropped across most products.

Reduce the service attack surface

List what is running and how it starts:

Get-Service | Where-Object Status -eq 'Running' | Sort-Object DisplayName |
  Select-Object Name, DisplayName, StartType

Now look at services that are commonly unnecessary on a VPS. Check each one before you touch it:

Get-Service RemoteRegistry, Spooler, WSearch, SSDPSRV, upnphost, Fax -ErrorAction SilentlyContinue |
  Select-Object Name, Status, StartType

Disable the ones you do not need. RemoteRegistry in particular lets a remote user read and write your registry — almost no VPS needs it.

$services = 'RemoteRegistry','SSDPSRV','upnphost','Fax'
foreach ($s in $services) {
    if (Get-Service -Name $s -ErrorAction SilentlyContinue) {
        Stop-Service -Name $s -Force -ErrorAction SilentlyContinue
        Set-Service -Name $s -StartupType Disabled
    }
}