Endpoints · Operating Systems
Windows
The dominant enterprise client and server operating system, with a deep security stack and a long history of compatibility requirements.
FoundationalMicrosoftUpdated 2026-09-01
Overview
Windows clients are managed either through Group Policy and Configuration Manager on premises, through Intune in the cloud, or a co managed combination. Servicing follows an annual feature update cadence with monthly quality updates.
Its security capabilities are extensive but mostly opt in: BitLocker, Credential Guard, Application Control, attack surface reduction rules, Windows Hello for Business, LAPS and Defender features all require deliberate configuration.
How it works
- 01Configuration is applied by Group Policy (on premises), MDM CSP policies (Intune), or both, with MDM generally taking precedence when configured to do so.
- 02Local security is enforced by the Local Security Authority and by protected process mechanisms; Credential Guard uses virtualisation based security to isolate secrets.
- 03Updates install via Windows Update for Business rings or a management tool, and require reboot to complete.
- 04Windows LAPS randomises and escrows local administrator passwords, removing a shared password across the estate.
Security considerations
- Enable BitLocker with TPM plus PIN where risk warrants, and escrow keys.
- Deploy Windows LAPS; identical local administrator passwords are a textbook lateral movement enabler.
- Turn on Credential Guard and LSA protection, and disable legacy protocols such as SMBv1 and NTLMv1.
- Use Application Control or at least AppLocker in enforced mode for high risk populations.
Common misconfigurations
- Users left as local administrators, undermining every other endpoint control.
- Unsupported Windows versions kept for one legacy application, with no isolation.
- Group Policy and Intune policies conflicting during co management transitions.
- Legacy authentication and unconstrained delegation left enabled on servers.