// STUDY TRAINING · TR-03 · 3 DAYS · HARDENING
Network and Windows Hardening
Three days hardening the two layers an attacker reaches first on a physical security system: the switches and the Windows servers running the VMS and access control. Vendor-neutral switch hardening on day 1, Windows for Genetec, Milestone, and Avigilon on day 2, and a full build from default to defensible on day 3. Hands-on throughout.
What you will be able to do
- Lock the management plane: SSH only, local fallback accounts, AAA, NTP, syslog over TLS, and SNMPv3.
- Apply data-plane protections that stop the common attacks: port security, BPDU guard, DHCP snooping, dynamic ARP inspection, and storm control.
- Build a Windows baseline for a VMS server: LAPS, service accounts, attack surface reduction, Defender and tamper protection, audit policy with process creation logging.
- Write a camera-to-VMS firewall policy from the vendor port lists instead of any-any.
- Keep the hardening alive after handover: patch cadence, configuration backups, and the compatibility matrix the VMS vendor publishes.
- Produce an as-built hardening record the customer’s auditor can read.
Day by day
Switch hardening
- Morning Threat model and management plane
What an attacker sees on a default switch, demonstrated. Then SSH, HTTPS, AAA, NTP, syslog, SNMPv3, and the services to turn off.
- Afternoon Data plane lab
Port security with sticky MAC, BPDU guard and root guard, DHCP snooping, dynamic ARP inspection, storm control, and the verification commands for each.
Windows hardening for the VMS
- Morning Accounts and attack surface
Local, domain, and service accounts, LAPS, the tier model, Print Spooler and the other services to disable, SMBv1, and the firewall profile.
- Afternoon Protection and visibility lab
Defender, tamper protection, attack surface reduction rules, Advanced Audit Policy, event forwarding, and testing that the VMS still records afterward.
Default to defensible
- Morning Topology and firewall policy
The 4 topology models, camera-to-VMS firewall rules from Genetec, Milestone, and Avigilon port lists, and certificate handling for cameras and clients.
- Afternoon Full build
Each participant takes a factory-default switch and a fresh Windows server to a documented, verified baseline, then trades with a neighbour to audit it.
Dates
Network and Windows Hardening runs once a month, Monday to Wednesday, 9:00 to 16:30 Eastern. Pick a date and send the booking with it.
Who this is for
Security integrators who deploy switches and servers, IT staff who inherited a security network, and MSPs supporting integrators.
Prerequisites. Comfortable with VLANs, IP addressing, and a Windows server console. Network Fundamentals for Security Integrators, or the free Network Primer, covers it.
What is included
- Lab access during the course, one switch and one Windows server per participant
- The hardening checklists, baseline configurations, and the audit worksheet as files
- A copy of the free Network Hardening and Windows Hardening courses for review afterward
- Certificate of completion with contact hours
What this is not
Not a SIEM course and not VMS administration. Camera firmware, access control panels, and cloud VMS are covered where they touch the switch and the server, and otherwise left to the platform health checks.
Free courses that pair with it
Book a seat for 23 to 25 November 2026
Send a message with the number of seats and who is attending. Your seat is confirmed by reply and the invoice follows. Groups of 6 or more can ask for private delivery on their own site instead.