Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have some Windows Server 2012 R2 boxes which will be going into production in the next few weeks. Our security guy is telling us to harden the boxes before we do. I am just wondering what people generally do to harden a 2012 R2 box. Some people in here think there would be very little to actually do on a 2012 R2 box at this stage.

There are 2 boxes, one Web server, one Database. The Web server runs IIS 8.5,. Net 4 and is running the DotNetNuke CMS. The back end runs SQL Server 2008 R2. Both are on separate network segments, with a firewall between them, and the web server can communicate with the DB, but not the other way round. Management is via RDP, but only on a management network interface. So, what would you do?

share|improve this question

closed as too broad by HopelessN00b, Ward, Flup, kce, Zoredache Jul 24 at 23:24

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

What would I do? I'd tell the security guy that either he starts defining what he means by "harden your boxes" or else he will be replaced by a sign that just says "harden your boxes", which will be about as useful for a fraction of the cost. In all seriousness, does he produce a corporate security standard/template to follow? If not, why not? W2012R2 ships with very little enabled by default so as long as you've followed best practice, only enabling what you need, deploying web app svrs and DB svrs securely (and it sounds like you have) then indeed there isn't much left to do. –  RobM Jul 23 at 10:14
@RobM we are the first group here to be deploying Server 2012 R2 into production, and we will be using a third party company to do the hardening, but, without going to said third party, what would these best practices be? is there a definitive guide? –  TiernanO Jul 23 at 10:17
Not really. It depends on the regulatory guideline(s) your business is required to follow, the threat profile (are these machines on the corporate LAN, or a DMZ, or the straight-up public internet), any compensating controls, etc. –  mfinni Jul 23 at 12:39
It's a DMZ, and a government department... We have just gotten a guide for 2008 r2 server... Going through it now... –  TiernanO Jul 23 at 12:41
You can always run the Security Configuration Wizard. That might be a good start. –  joeqwerty Jul 23 at 14:01