We have some Windows Server 2012 R2 boxes which will be going into production in the next few weeks. Our security guy is telling us to harden the boxes before we do. I am just wondering what people generally do to harden a 2012 R2 box. Some people in here think there would be very little to actually do on a 2012 R2 box at this stage.
There are 2 boxes, one Web server, one Database. The Web server runs IIS 8.5,. Net 4 and is running the DotNetNuke CMS. The back end runs SQL Server 2008 R2. Both are on separate network segments, with a firewall between them, and the web server can communicate with the DB, but not the other way round. Management is via RDP, but only on a management network interface. So, what would you do?