Security Hardening

User account management is essential for maintaining a secure and organized computing environment, especially in shared systems. It allows multiple users to have their own settings, files, and applications while keeping their data private and secure.

Adding Strong Password Protection

When a user changes or resets their password, the new password is checked for strength and complexity by validating it against the combined list of terms from the global and custom banned password lists. Even if a user’s password contains a banned password, the password may be accepted if the overall password is otherwise strong enough.

Removing Dormant Accounts

Removing a dormant account generally refers to disabling or deleting a user account that has not been used for a while. This is useful for administrative purposes, security, or system management. You can handle dormant accounts in Windows in one of two ways:

• Disabling a dormant account: Temporarily prevents access to the system but does not delete the account or its data. This is a good option if you want to restrict access but might want to reactivate the account later.

• Deleting a dormant account: If you want to permanently remove the account, you can delete it. Be careful with this option, as it removes the user’s profile and data associated with the account.

Limiting Privileges

Limiting privileges is a critical part of maintaining a secure and efficient system. It helps ensure that users have the appropriate level of access to perform their job functions while minimizing the risk of misuse, accidental damage, or malicious activity. Some methods for limiting privileges include:

• Assigning different user roles and permissions: Windows allows you to assign different user roles (administrator, standard/user, and guest) to each account.

  • Administrator accounts: These accounts have the most privileges and can change system settings, install software, and modify user rights. Administrator access should be granted sparingly and only to trusted users.

  • Standard/User accounts: These accounts can use applications and perform most tasks but cannot change system configurations.

  • Guest accounts: These accounts have minimal access and are typically used for temporary or external users who do not need regular access.

• Configuring file and folder permissions: In most operating systems, files and folders can be configured with specific access permissions, including read, write, execute, and delete. For example, a folder could be set to allow a group of users to view files, but not to edit or delete them.

• Setting up access control lists (ACLs): Windows and Linux support ACLs, which are lists that define who can access a resource and what they can do with it (for example, full control or read-only). ACLs allow fine-grained control over who can access what and with which permissions.

• Adjusting network permissions:

  • Firewall rules: You can restrict network access by creating firewall rules that block or allow connections based on IP address, port, or protocol.

  • VPN and remote access: Limit remote access to certain users, and use strong authentication to ensure only authorized users can access systems from external locations.

• Setting up two-factor authentication (2FA): Adding 2FA to user accounts increases security by requiring something you know (password) and something you have (a device or token). This can be especially important for users with administrative privileges.

A group policy enables configuration and settings management of user and computer settings on computers running Windows Server and Windows Client operating systems. In addition to using group policies to define configurations for groups of users and client computers, you can also use group policies to help manage server computers by configuring many server-specific operational and security settings.

Group policies can represent policy settings locally in the file system or in Active Directory Domain Services. When used with Active Directory, group policy settings are contained in a group policy object (GPO). A GPO is a virtual collection of policy settings, security permissions, and scope of management (SOM) that you can apply to users and computers in Active Directory. A GPO has a unique name, such as a GUID. Clients evaluate GPO settings using the hierarchical nature of Active Directory.

To create a group policy, an administrator can use the Local Group Policy Editor (gpedit.msc), which can be a stand-alone tool and the settings stored locally. Penguin Solutions recommends you use the Group Policy Object Editor as an extension to an Active Directory-related MMC snap-in.

You can run gpresult.exe on the local computer to obtain the same data that you can obtain by using the Group Policy Results Wizard in the GPMC. By default, gpresult.exe returns policy settings in effect on the computer on which it runs. gpresult.exe outputs its results in an HTML file that you can open with Microsoft Edge or another web browser.

You can set several group policy types that can affect ztC Endurance systems, including Network, Server, System, and Windows Components policies. Note that the following policies might affect your ztC Endurance system's working and overall stability.

To set Network policies

1. Network connection > Windows Defender Firewall

2. SNMP

3. TCPIP Settings

To set System policies

1. System > App-V > Enable Dynamic Virtualization

2. Device Guard — Turn on VBS

3. Device installation — Restrictions

4. Driver Installation

5. Early Launch AntiMalware

6. Kernel DMA Protection

7. Trusted Platform Module settings

To set Windows Components policies

1. Bitlocker Encryption

2. Microsoft Defender

3. Windows Error Reporting

Overview of Firewall Settings

A firewall is a security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between a trusted network, such as your internal network or computer, and untrusted networks, such as the internet or external networks. The firewall enforces rules designed to protect your system from unauthorized access and potential attacks.

• Firewall settings are the rules or configurations that define how traffic should be allowed or blocked by the firewall.

• These settings are crucial for controlling network access, protecting data, and ensuring that your device or network is secure from external threats.

Reconfiguring Firewall Settings

When enabling the Microsoft security baseline, some essential settings are overwritten, requiring you to reconfigure them in the firewall settings. Reconfigure the following settings:

• G5 Controller: The default security setting for file-transfer protocol (FTP) communications blocks the FTP client from receiving files. On ztC Endurance systems that are connected to an ftScalable Storage G5 system, you must change the firewall setting to allow incoming FTP communications from the storage system controllers. Otherwise, attempts to FTP log files from the ftScalable Storage G5 system will not complete.

• Remote KVM: Remote KVM uses the TCP/IP ports listed in Table 22. If you use the KVM in a firewall environment, be sure to configure the firewall to allow access between the remote system and the KVM's IP address for the functions that you use.

• SNMP: You may need to modify some firewalls in order to communicate SNMP requests or traps from or to an NMS. When you install the ztC Endurance software, your organization's firewall is automatically configured to open port 161 (Get/Walk) and 162 (Traps) for inbound and outbound traffic to the host . No user action is needed. If there is a firewall between the network that the ztC Endurance system is on and the location of the NMS, you may need to update your organization's firewall. Contact your network administrator about modifying the firewall.

Table 22: Firewall Settings

Module Name	Port
Web browser/Remote KVM/Media Console (SSL)	443
SSH	22
Remote KVM	7578
Remote CD	5120
Remote HDD	5122
SNMP GET/WALK	161
SNMP Trap	162
ASN Connect	443 Default proxy port: 3128 (you can change the default proxy port number)
Telnet service	23

Network Port Blocking

Network port blocking is a security measure used to control access to specific services or applications running on a network by blocking or allowing communication through particular network ports. Blocking certain ports helps with the following:

• Prevent unauthorized access: Some ports are used by services that may not want to be accessible externally (for example, database ports and file-sharing ports).

• Close vulnerable ports: Services may have vulnerabilities that could be exploited by attackers if those ports are open. For example, the Telnet service (port 23) is often targeted by attackers because it sends data in clear text.

• Control network traffic: Limiting the types of traffic that can access your network can help optimize performance and improve security.

• Prevent malware: Some malware uses specific ports to communicate with a command-and-control server. Blocking these ports can help contain the infection.

• Allow for network segmentation: By blocking certain ports between different network segments (for example, between a DMZ and internal network), you can isolate sensitive data or systems from untrusted sources.

Disabling Some Network Services

Disabling network services refers to the practice of turning off or deactivating specific services or protocols that allow devices or systems to communicate over a network. Network services can be essential for certain applications or system functionality, but in many cases, they may also be unnecessary or create security vulnerabilities if not properly managed. Disabling unused or unnecessary services reduces the attack surface of a device or network, improving security and performance.

This section describes methods for improving system security by hardening system applications and services.

Disabling Unnecessary Applications and Services

Disabling unnecessary applications and services is an important aspect of system hardening and network security. It refers to the practice of turning off or uninstalling software, applications, or background services that are not essential to the functioning of a device or network. This process helps reduce the attack surface of a system, improve performance, and maintain better control over what is running.

Implementing Access Control

Access control is the mechanism that determines who is allowed to access or use resources in a computing environment. Types of access control include:

• Discretionary Access Control (DAC): Resource owners decide who can access their resources. For example, you can set file permissions in Windows (for example, Read, Write, and Execute), which determine how users can interact with the file.

• Mandatory Access Control (MAC): Access is based on fixed rules, not at the discretion of users. MAC is common in military or government systems (for example, Top Secret vs. Confidential).

• Role-Based Access Control (RBAC): Access is assigned based on user roles. For example, administrators have more system access than regular users.

• Attribute-Based Access Control (ABAC): Access decisions are based on attributes such as user role, location, time, and so on. ABAC is more dynamic and fine-grained than other access-control methods.

This section describes how patches and updates can be installed to help to fix security vulnerabilities (for example, zero-day exploits), improve system stability and performance, prevent malware and ransomware attacks, and ensure compliance with regulations such as GDPR or HIPAA.

Microsoft Monthly Patches

Microsoft provides monthly security and quality updates, commonly referred to as Patch Tuesday updates or Microsoft Monthly Patches, which are typically released on the second Tuesday of each month. Occasionally, Microsoft also releases Out-of-Band (OOB) patches if a critical issue is found outside the normal cycle. These updates address security vulnerabilities, fix bugs, and improve system performance in Microsoft products such as:

• Windows (10, 11, Server)

• Microsoft Office (Word, Excel, Outlook, and so on)

• Microsoft Edge

• Azure services

• Exchange Server

• Other Microsoft software

Penguin Solutions regularly evaluates these patches and provides recommendations on which patches to install. The latest supported patch details for ztC Endurance systems can be found on Stratus Patch Release Updates. See Installing Windows Updates for more information.

Types of patches include:

• Security Updates: Contains fixes for critical or important security vulnerabilities.

• Quality Updates: Contains fixes for bugs and improves performance or reliability.

• Cumulative Updates: Includes all previous fixes to avoid fragmented installations.

• Driver Updates: Contains updates for hardware drivers (graphics, network, and so on).

• Feature Updates: Contains major updates with new features and is typically released semi-annually.

For more information, see Installing Windows Updates.

To install patches

• Regular Users:

  • Go to: Settings > Windows Update > Check for updates.

  • Enable automatic updates for security.

• IT and Administrators:

  • Use Windows Server Update Services (WSUS), Microsoft Endpoint Manager (Intune), or Microsoft Configuration Manager SCCM to manage patches across networks.

  • Test updates in a lab environment before broad deployment.

Testing with the Latest Patch

Testing the latest Microsoft Monthly Patch is a critical process for system administrators to ensure stability, security, and compatibility before rolling out updates across production systems.

Patch testing is the process of applying Microsoft’s latest patches (usually from Patch Tuesday) in a controlled, non-production environment to:

• Verify patch installation success.

• Check for bugs, errors, or conflicts.

• Identify any breakage or downtime.

• Ensure compatibility with existing software, drivers, and workloads.

To test on bare-metal systems

For bare-metal testing, you need a physical server or PC (not virtualized), and Windows installed directly on ztC Endurance hardware.

1. Prepare the test hardware. Use hardware that mirrors production setup (CPU, RAM, drivers, and so on).

2. Install a clean or cloned version of Windows (Server 2022/2025).

3. Capture a disk image or snapshot to create a system backup for easy rollback.

4. Install the latest patch: Download the patch via Windows Update or Microsoft Update Catalog.

5. Use command-line tools if needed (such as wusa) to perform functional testing.

6. Check boot time, login, and device drivers by opening core applications such as Microsoft Office, browsers, and in-house tools.

7. Look in Event Viewer for errors or warnings related to patch installation.

8. Optionally, perform rollback testing by uninstalling the patch or restoring backup.

Best practices for patch testing:

• Prioritize security patches and critical systems

• Automate testing with scripts (for example, Windows PowerShell)

• Use WSUS or Intune to manage and stage deployments

• Always document what was tested, what issues were found, and which fix was applied

To check and install the latest Windows updates

Windows Update is disabled on ztC Endurance, so it needs to be updated manually.

1. On the Windows desktop, press the Start button.

2. In the Search field, typeWindows Update settings.

3. Under System Settings, open Windows Update.

4. Click Check for updates. Depending on your company’s policy, this button might be grayed out. If so, contact your IT department.

5. The latest updates download, along with security updates from Microsoft.

Logging is the process of recording events that occur within a computer system or network. These events can include user logins, file accesses, system errors, API calls, and more. Some common log types include:

• System logs (such as Windows Event Viewer logs)

• Application logs

• Security logs

• Access logs

Auditing refers to the review, analysis, and sometimes formal assessment of logs or system activity to ensure compliance with policies, standards, or regulations. Consistent logging and frequent audits are recommended to maintain the security of your ztC Endurance system.

New Technology File System (NTFS) is the standard file system for Windows operating systems. It supports large volumes, data security, file compression, disk quotas, and more. One of its most important features is file and folder level permissions, which control access to resources on the system. NTFS permissions determine who can access or modify files and folders on an NTFS-formatted volume. These permissions are different from share permissions, which apply only to files or folders shared over a network. NTFS permissions are stored in the file system itself, so they are not dependent on network shares. The permissions can be applied to users and groups, and they are controlled through access control lists (ACLs).

An NTFS volume is a section of a physical or virtual disk that has been formatted using the NTFS file system. This volume can host files, folders, system data and application data.

Encryption is the process of converting data (plaintext) into a coded format (ciphertext) using a mathematical algorithm and a key. Only those with the correct key can decrypt and read the original data. In the context of file systems and storage, encryption protects data at rest, meaning data that is stored on physical media such as the following:

• Hard disk drives (HDDs)

• Solid-state drives (SSDs)

• External drives

• Cloud storage

Backup software is essential for protecting data by creating copies that can be used to restore the original data in case of loss, corruption, hardware failure, or cyberattacks. However, creating backups is not enough—you also need to validate them to ensure they are usable when needed. Backup software automates the process of copying and storing data from systems (for example, servers, PCs, and databases) to secure backup storage (such as external drives, cloud storage, or network-attached storage (NAS).

ASN by BeyondTrust is a third-party remote access solution that allows Penguin Solutions Customer Service to remotely connect to various components of a ztC Endurance system for assistance with diagnostics, troubleshooting, service, and support activities.

See Enabling ASNConnect for more information.