How to configure MikroTik for a small business: a secure baseline step by step
Update RouterOS, replace the admin user, close management services, set up the firewall and a guest network — with ready-to-use commands.
Read articleMany Windows incidents use old protocols and services that are still enabled “just in case”. These five steps remove the most abused ones. They work on Windows Server 2016 and newer.
Before you start: run PowerShell as administrator, test on one server first and schedule a reboot window. In a domain, it is better to apply these settings with Group Policy so new servers get them automatically.
Step 1. Disable SMBv1
SMBv1 was the path used by WannaCry and NotPetya. Modern Windows does not need it; very old devices (old scanners, NAS) that still require it should be updated or replaced.
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestartStep 2. Stop the Print Spooler where nobody prints
After PrintNightmare, Microsoft recommends disabling the Print Spooler on domain controllers and other servers that do not need printing.
# on domain controllers and servers that never print:
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType DisabledStep 3. Make sure the Windows Firewall is on
All three profiles should be enabled. Open only the ports the server really needs, and only for the networks that use them.
Get-NetFirewallProfile | Select-Object Name, Enabled
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled TrueStep 4. Secure Remote Desktop
Require Network Level Authentication, never expose RDP (3389) directly to the internet — use VPN or a Remote Desktop Gateway with MFA.
# require Network Level Authentication for Remote Desktop
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1Step 5. Review administrators and running services
Remove accounts that do not need admin rights and stop services nobody uses. Repeat this review every few months.
Get-LocalGroupMember -Group Administrators
Get-Service | Where-Object {$_.Status -eq 'Running'} | Sort-Object DisplayNameThe fastest way to reduce risk is to switch off what you do not use.
Need help with this? Contact CySec for a free consultation.