Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to harden my windows 2008 r2 server for PCI. What is the best way to do this? The server are behind a CISCO ASA and in the DB servers are in separate vlans. Now i need to know if there are any unnecessary services that i can disable to improve security. These servers are running IIS and .net applications.

share|improve this question

Here are two great places to start hardening any server:

  1. Download and run the Windows Server 2008 R2 Best Practices Analyzer.
  2. For a very hard server, run through the DoD's STIGs for Windows Server. They look overwhelming at first, but will take you a long way towards compliance with many regulations. You should also note that some of the DoD's security recommendations are so tight that they can sometimes break apps. Be sure to test before you apply these registry or group policy settings to your machines.
share|improve this answer

Microsoft has some details of how TMG hardens Server 2008 (listing services and other configuration information). They also have a Planning Guide specifically for PCI and for PCI:DSS; the Server 2008 Security Baseline, and a variety of other Solution Accelerators including the Security Compliance Manager.

share|improve this answer

Your first stop should be understanding what's already built into SCW, if only to avoid bumping up against it unexpectedly. (Similar question here)

share|improve this answer

You can use this tool provided by The Center for Internet Security.
It's probably not enough to achieve a PCI compliance but it's a good start

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.