Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

This question is my inspiration

i have windows server 2008R2 in my network as DC.
also i use this server for hosting our organization website.
I want to make it as secure as possible.
What I need to Do for securing my windows server??

edit

our Website is run locally and we are Use Forms Authentication with Active Directory for our website.so now what how can i Get the web site off of your Domain Controller???

share|improve this question

marked as duplicate by sysadmin1138 Jun 7 '13 at 15:06

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

5  
Step 1: Get the web site off of your Domain Controller. –  joeqwerty Jun 7 '13 at 14:50
    
The "duplicate" question has weak answers. –  longneck Jun 7 '13 at 15:12
    
@joeqwerty:why?? –  Jeson Park Jun 7 '13 at 15:27
    
@longneck: I Read BeStRaFe answer but it is too Summarized and i need more description also picflight server dont have DC –  Jeson Park Jun 7 '13 at 15:58
    
If you need help with moving your web site from one server to another, you should probably ask a new question. –  Michael Hampton Jun 26 '13 at 13:36

1 Answer 1

up vote 1 down vote accepted

Pre-Obligatory

  • Run a current, supported version of Windows. Currently this is Windows 2008R2 and Windows 2012.
  • Never install anything on a domain controller except:
    • DNS, DHCP, WINS, and Certificate Services (and only if needed)
    • Anti-virus, backup agents, monitoring agents

Obligatory

  • Use a core installation if you can
  • Rename the local administrator account
  • Do not disable the firewall
  • Run the Best Practices Analyzer
  • Run the Security Configuration Wizard
  • Use the Microsoft Security Compliance Manager to developy and apply consistent security policies to all your servers
  • Do not disable UAC
  • Do not install and Roles or Features you aren't actively using.
    • Pay particular attention to un-needed sub-features of roles like IIS
  • Keep up to date with OS and application updates

    For the paranoid

  • Change the RDP port

share|improve this answer
    
tnx for answer but why never install DNS, DHCP, WINS, and Certificate Services Together??( i install it Together for paying Lower cost) –  Jeson Park Jun 26 '13 at 8:33
    
That is not what I said. You can install dns, dhcp, wins and certificate services on a DC. Those roles are appropriate for a domain controller and have minimalsecurity impact. everything else, like a website, should not be running on a domain controller. –  longneck Jun 26 '13 at 12:55
    
meh changing the RDP port will just give you a bit less internet background noise. –  Lucas Kauffman Jun 26 '13 at 13:34
2  
Don't forget MS BPA 2012, 2008R2 (other versions available for older versions of Windows, but if you're really concerned about security you probably aren't running ancient software). –  Chris S Jun 26 '13 at 13:40
    
@JesonPark LOL WUT? –  longneck Feb 17 at 13:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.