Windows Server 2022 First Install Security Options
Windows Server 2022 does not have a "one-click" automatic hardening button during the initial installation wizard. However, it is designed with a "Secure by Default" philosophy, and Microsoft provides tools to automate the bulk of the hardening process immediately after installation.
Here is how the hardening process breaks down between what's automatic, what's semi-automated, and what's manual.
1. What is Automatic (Out of the Box)
Windows Server 2022 introduced several features that are active the moment the OS finished installing, assuming your hardware supports them:
- Secured-core Server: If you bought certified hardware, the OS automatically coordinates with the hardware (TPM 2.0) and firmware to enable Secure Boot and Hardware Root-of-Trust.1
- TLS 1.3 Enabled by Default:2 Unlike previous versions, the most secure encryption protocol for web and network traffic is on from the start.
- Virtualization-Based Security (VBS): The OS uses the processor's virtualization features to create a "black box" in memory that protects credentials from being scraped (Credential Guard).3
2. The Semi-Automated Path (The "Best Practice")
While the installer won't do it for you, Microsoft provides the Microsoft Security Compliance Toolkit.4 This is the closest thing to an "automatic" hardening process.
- Security Baselines: You download a pre-configured set of Group Policy Objects (GPOs) designed by Microsoft engineers.5
- LGPO.exe: This is a command-line tool included in the toolkit.6 It allows you to "inject" these security baselines into a fresh server in seconds, instantly changing hundreds of registry keys and policy settings to meet high-security standards.
- Result: This automates about 80–90% of the standard hardening (password policies, disabling old protocols like SMBv1, and locking down user rights).
3. What Remains Manual (The "Hard" Part)
Automation can’t know what your specific server is supposed to do, so these steps must always be manual:
- Role Minimization: You must manually choose only the "Roles and Features" you need. If the server isn't a Web Server, you must ensure IIS isn't installed.
- Attack Surface Reduction (ASR): Manually disabling services that your specific applications don't need (e.g., Print Spooler on a Database server).
- Network Partitioning: Assigning static IPs and placing the server in the correct VLAN/DMZ.7
Summary Checklist for a New Install
If you want to harden a 2022 server efficiently, follow this workflow:
| Step | Method | Task |
|---|---|---|
| 1. Install | Manual | Choose "Server Core" instead of "Desktop Experience" (cuts 70% of attack surface). |
| 2. Update | Automatic | Run Windows Update immediately to patch "Day 0" vulnerabilities. |
| 3. Baseline | Automated | Use LGPO.exe to apply the Microsoft Security Baseline. |
| 4. Roles | Manual | Install only the specific Roles required for the job. |
| 5. Audit | Manual | Use a tool like Policy Analyzer (from the toolkit) to verify the settings stuck. |
Would you like me to provide the specific PowerShell commands to apply a Security Baseline using the LGPO tool?