Every hardening guide on this site so far has been about servers, because the servers hold the evidence and the servers are where the vendors’ hardening guides point. The workstations are where the people are, and people are where most compromises start. A guard desk machine is on 24 hours a day, logged in, in a lobby, with a USB port facing the public, running a browser someone installed to check the weather. It can see every camera on the site and it can unlock every door. On most sites it has never been hardened at all.
This is the baseline for those machines: the Security Desk, Smart Client, ACC Client, and access control operator workstations, and the shared machines in control rooms and at reception. It assumes domain-joined Windows; the reasoning carries to anything else.
What the workstation is exposed to that the server is not
- Physical access by people who are not staff. A lobby desk faces the public. The USB ports are reachable. The keyboard is reachable when the guard walks a patrol.
- Shared accounts. Three shifts, one login, one password on a sticky note, because logging off means the video wall goes blank and the last shift did not want to be the one who did that.
- General-purpose use. Email, browsing, a spreadsheet for the patrol log, a personal phone charging off the front port. Every one of those is an entry point the server does not have.
- Privilege. An operator account that can unlock doors and export video is a privileged account whether or not it is a Windows administrator, and it sits on the most exposed machine in the building.
The operating system
Use Windows 11 Enterprise LTSC, or IoT Enterprise LTSC, on dedicated operator machines. Long-term servicing gives a fixed feature set with security updates only, no consumer applications, no store, no feature updates that reboot a control room machine into a new Start menu on a Tuesday. The client software vendors qualify against it. General-purpose Windows Pro is what most operator machines run because it is what the hardware shipped with, and it brings the whole consumer surface with it.
Whatever the edition, the machine is a security appliance from that point on. It is not a general-purpose PC that also runs Security Desk. That framing is the whole hardening posture, and everything below follows from it.
Accounts and privilege
No local administrators except the managed one. Remove the account the integrator created at commissioning, the one called install or the company name, and the one called admin that everyone knows the password to. Rename the built-in Administrator and put it under Windows LAPS so its password is unique per machine, rotated, and retrievable only by the people who should have it.
Operators are standard users. The VMS and access control clients run fine as a standard user; where they do not, the vendor has a documented set of permissions to grant, and it is never local administrator. If an integrator says the client needs admin, it needs a particular folder or registry key, and the answer is to grant that.
One account per person. The shared operator login is the hardest thing to remove and the most important. The audit trail in the VMS and the access system says who unlocked the door and who exported the video, and if the answer is “the day shift account,” the audit trail is worthless. Individual domain accounts, individual VMS accounts mapped from them, and a fast-switch workflow at shift change that operators have been shown and that does not blank the wall.
Second factor where the platform allows it. Smart card logon to Windows is the cleanest, and it also solves the shared-account problem, because the card is the account. Where that is not on, the VMS’s own multi-factor on login is the next best and it is in most current releases.
Session lock on a 24-hour desk
The standard baseline says lock after fifteen minutes of inactivity. A video wall that locks after fifteen minutes is a video wall that shows nothing during the quietest and most important hours, and the operators will find a way around it, usually a mouse jiggler, which is worse than no policy at all.
The design that works: the workstation driving the wall runs a dedicated, minimally privileged display account whose session does not lock and whose only application is the client in a monitoring-only configuration, with no ability to unlock doors, export, or change anything. The operator’s own session, on the same machine or on a second one, locks on the normal timer and is where privileged actions happen. The wall stays up; the privilege goes away when the operator does. On platforms with a dedicated wall or kiosk mode, that is what it is for.
Document the exception. A locked-down display account on a machine in a physically controlled control room is a defensible compensating control under any of the frameworks. An unlocked general-purpose session on a lobby desk is not, and the auditor will know the difference.
Application allow-listing
An operator workstation runs a known and short list of applications. That is the ideal case for allow-listing, and it is the control that most reduces what a plugged-in USB stick or a downloaded file can do. AppLocker is available on Enterprise and LTSC editions and is enough here; Windows Defender Application Control is stricter and is the right choice on a machine that can unlock doors.
Allow the client software from its installed path, signed by the vendor, plus the Windows binaries the machine needs, and deny everything else. Run the policy in audit mode for two weeks first; the log shows what the operators actually run, and there is always something nobody mentioned. The event forwarding subscription for workstations should include the AppLocker log, because a block event on an operator machine is worth knowing about.
Removable media
Block removable storage by Group Policy on every operator machine, read and write. Video export goes to a designated network share with its own access controls and its own audit, not to a USB stick handed to whoever asked. Where an export to physical media is genuinely required, one designated machine in the control room, not the lobby, has write access to a specific encrypted device class, and the export is logged in the VMS.
The front USB ports on a lobby desk machine can be disabled in firmware or physically blocked. Both are cheap. The threat is a passer-by with a stick and thirty seconds, and both stop it.
Browser, mail, and everything else
An operator workstation does not have a mail client. It does not have a general-purpose browser. If the operators need either, they need a second machine or a separate, unprivileged session, and the cost of that is small against a phishing email opened on the machine with the door controls.
Where a browser is required for a web-based part of the platform, the Web App in Security Center 5.14 for example, restrict it by policy to the platform’s URLs and nothing else, disable extensions, and disable downloads. Remove every other application that came with the image. Disable the store, the consumer features, and the assistants. The machine’s job is the client, and the fewer other things it can do, the fewer things can go wrong on it.
The platform baseline still applies
The rest of the workstation baseline is the same as the server baseline in the main hardening guide, applied to a client: Windows Firewall on with inbound denied, RDP disabled, SMB signing required, TLS 1.0 and 1.1 off, PowerShell logging on, NTP from the domain, patches monthly with a defined window that the control room knows about, BitLocker with a TPM on every drive. Defender on, with the client cache exclusions the vendor lists and nothing broader.
The CIS Windows workstation benchmark at Level 1 is a good starting point and the exceptions you need for the client software are few and documented by the vendor. Apply it by Group Policy to the operator workstation OU, not by hand.
Decode hardware, because operators route around slow machines
This is a hardening item because a slow workstation is a workstation the operators will “fix.” They will lower the security settings the integrator can be talked into lowering, they will install the driver from the forum post, and they will keep the old unpatched machine that felt faster. The 64-bit media pipeline in Security Center 5.14 and the current Milestone Smart Client both decode on the GPU when one is present, and a control room machine with sixteen H.265 streams on a wall needs one.
Specify the workstation for the decode load, with a supported discrete GPU and the vendor’s current driver, and it stops being a reason to weaken anything else. The architecture article covers the client sizing for Security Center.
The checklist
- LTSC edition, or a documented reason it is not.
- Built-in Administrator renamed and under LAPS; no other local administrators; commissioning accounts gone.
- Operators as standard users, one account per person, with the VMS mapping to match.
- Second factor at Windows or VMS login.
- Wall driven by a monitoring-only display account; operator sessions lock on the normal timer; exception documented.
- AppLocker or WDAC enforced after an audit period; block events forwarded.
- Removable storage blocked; export to a controlled share; front ports disabled or blocked.
- No mail client; browser restricted to platform URLs or absent.
- Server baseline applied as a client: firewall, no RDP, SMB signing, TLS, PowerShell logging, NTP, BitLocker, Defender with narrow exclusions.
- CIS Level 1 workstation benchmark by Group Policy to the operator OU.
- Decode hardware sized for the wall, so nobody has a reason to work around any of the above.
The servers hold the evidence. The workstations hold the people, and the doors. Harden them like the exposed, privileged machines they are.