1. Start with the threat model
Before changing a single setting, write down what you are defending against. For most users in 2026 the top three are ransomware, credential theft, and supply-chain script execution. Map every hardening decision back to one of these.
2. Patch cadence that actually works
Enable Windows Update for Business with quality updates set to zero days deferral and feature updates to 30 days. Pair it with a weekly reboot window. Missing patches cause more incidents than any single misconfiguration.
3. Credential hygiene
Enforce 16-character minimums, disable NTLMv1, turn on Credential Guard where hardware permits, and require Windows Hello for sign-in. Back it with breach monitoring so stolen credentials trigger rotation automatically.
4. Application control
Use Windows Application Control (WDAC) or AppLocker to block execution from %TEMP%, %APPDATA%, and Downloads. This single change stops most commodity malware in its tracks.
5. Script engines
Set PowerShell to Constrained Language Mode outside administrative workflows, disable Windows Script Host, and block Office macros from internet-originated documents. Fileless malware depends on these engines.
6. Network posture
Disable SMBv1, enforce SMB signing, turn LLMNR and NetBIOS over TCP/IP off, and put a DNS firewall in front of the resolver. DNS-layer filtering stops exfiltration before the TLS handshake.
7. Ransomware-specific layers
Enable Controlled Folder Access, deploy honeypot files in user document roots, set shadow-copy retention to 14 days, and protect critical folders with an allow-list of processes.
8. Telemetry and response
Forward Security, Sysmon, and PowerShell logs to a central collector. Write five detection rules before buying any tool: suspicious child of winword.exe, lsass.exe dump access, scheduled task creation by non-admin, new service install from user profile, and wmic process call create.
9. Automate it
Hand-tuning one laptop is fine. Fleet hardening needs GPO, Intune, or a purpose-built tool like Citadel Frame's Hardening Advisor that applies CIS-aligned profiles and tracks drift over time.