In short
Endpoint hardening is reducing a device's attack surface by applying a secure configuration baseline: removing unused software and services, restricting admin rights, macros, scripts and peripherals, turning on secure boot, encryption and the host firewall, and controlling which applications can run. Start from NCSC platform guidance or CIS Benchmarks and enforce the settings centrally.
Get a quote for endpoint hardening
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What is endpoint hardening?
Out of the box, operating systems and applications are set up to work for as many people as possible. That means features, services and permissions most organisations do not need, each of which an attacker might use. Endpoint hardening switches those off and tightens the rest, so there is less to exploit.
Hardening is not a product. It is a set of configuration decisions, recorded as a baseline and enforced through your device management and security tools. It complements, rather than replaces, endpoint detection and response: hardening makes attacks harder and noisier, and EDR spots the ones that still get through.
In Cyber Essentials, hardening sits mainly under the secure configuration control, with admin rights under user access control. Our sister site explains the Cyber Essentials secure configuration requirements in detail.
Start from a trusted baseline
Writing your own baseline from scratch is slow and easy to get wrong. Two well-maintained starting points are:
- NCSC platform guides: part of the NCSC Device Security Guidance, with guides for the main desktop and mobile platforms, including Windows, macOS and iOS and iPadOS. The NCSC publishes its recommended configurations for these platforms in a GitHub repository linked from the collection.
- CIS Benchmarks: vendor-neutral secure configuration guides from the Center for Internet Security, covering operating systems (including Linux distributions), server software, cloud platforms and desktop applications. Useful where the NCSC has no platform guide, such as Linux servers.
Pick one primary baseline per platform, record any settings you deliberately change and why, and treat that record as part of your endpoint security policy. The NCSC's Windows guide, for example, was last tested on Windows 11 25H2 Enterprise and recommends using the latest version of Windows alongside the latest version of its guidance.
Endpoint hardening checklist
This table covers the main hardening areas for laptops, desktops and servers. Not every item suits every organisation, but each should be a conscious decision.
| Area | What to do | Why it matters |
|---|---|---|
| Provisioning | Build devices from a trusted image or zero-touch enrolment, with non-administrative user accounts from the start | Every device starts compliant, with no leftover admin accounts |
| Admin separation | Remove standing local admin rights; use separate admin accounts or just-in-time elevation | Malware running as the user cannot change system settings |
| Unused software and services | Uninstall software nobody needs; disable unused services, sharing and remote access features | Fewer things to patch and fewer ways in |
| Auto-run | Turn off AutoRun and AutoPlay for removable media | Stops code running automatically when a drive is connected |
| Office macros | Disable macros where possible; where needed, restrict them to defined users or trusted locations | Macros are a long-standing route for malware in documents |
| Scripts | Limit script interpreters for standard users where the business allows, and log script activity | Attackers use built-in scripting tools to avoid detection |
| Application control | Allow approved applications only, and block running programs from user-writable folders | Unknown and malicious programs cannot start |
| Host firewall | Turn the local firewall on, block unsolicited inbound traffic and allow only the services you need | Limits lateral movement between devices |
| Secure boot and firmware | Enable Secure Boot and firmware protections, set a firmware password and keep firmware updated | Protects the boot process from tampering |
| Encryption | Enable full disk encryption, preferably with a hardware-backed key and PIN, and escrow recovery keys | Protects data on lost or stolen devices |
| Peripherals | Restrict or monitor external interfaces and enable DMA protections | Reduces data theft and attacks through ports |
| Updates | Enable automatic updates for the operating system, applications, firmware and drivers | Closes known vulnerabilities quickly |
| Sign-in and lock | Strong sign-in with multi-factor or biometric options, and an automatic screen lock | Protects unattended and stolen devices |
| Logging | Turn on security logging and send it to your EDR or central log store | Gives you evidence when something goes wrong |
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Endpoint hardening techniques by platform
The principles are the same everywhere, but the settings differ. Highlights from the NCSC platform guides:
Windows The NCSC recommends choosing devices that support virtualisation-based security and full disk encryption, provisioning through Windows Autopilot zero-touch enrolment with non-administrative accounts, and deploying antivirus or EDR; if you use a third-party product, it should integrate with the Anti-Malware Scan Interface (AMSI). Its guide calls for BitLocker using a TPM with a PIN, DMA protections, Secure Boot and a firmware password, Windows Defender Firewall with explicit allow rules, Office macros disabled where possible, and application control using Microsoft App Control for Business or AppLocker. See BitLocker management for running encryption at scale.
macOS The NCSC macOS guide recommends Automated Device Enrolment through Apple Business Manager and an MDM, encryption with keys escrowed to the MDM, a screen lock after ten minutes of inactivity, Gatekeeper enforced (moving from soft to hard enforcement), automatic updates and startup security policies. It notes that macOS includes built-in XProtect anti-malware and suggests a third-party EDR product alongside it for deeper protection and visibility.
Phones and tablets Enrol company devices in mobile device management, enforce a passcode and current operating system, and install work apps from an app store or enterprise catalogue. Add mobile threat defence for phishing and malicious app detection; products we supply, such as Lookout Mobile AI Security, cover iOS and Android. For personal phones, see BYOD security.
Linux and servers With no NCSC Linux guide, CIS Benchmarks are the usual baseline. Keep servers to the minimum services they need, restrict who can sign in and elevate, and run a server-capable EDR agent.
Hardening without breaking things
Hardening goes wrong when settings are switched on everywhere at once. A safer approach:
- Document the baseline and the reason for each deviation, so changes are deliberate.
- Use audit or report-only modes first for application control, macro rules and device control, and review what would have been blocked.
- Pilot with a small group that includes IT staff and a few typical users, then roll out in waves.
- Run an exceptions process so people can ask for an application, a USB device or a macro to be allowed, with an owner who decides.
- Measure drift. Use console compliance reports to find devices that have fallen out of line, and fix the cause rather than just the device.
- Review after every major update, because new operating system versions add settings and sometimes change defaults.
Is endpoint hardening the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Tools that help enforce hardening
Most hardening is enforced through device management, with security platforms adding specific controls:
- Device management: Microsoft Intune or IBM MaaS360 push configuration profiles, encryption and update policies. Forever Group covers mobile device management and Intune.
- Application control: WatchGuard's Zero-Trust Application Service in Endpoint Security 360 and Elite, and ThreatDown Application Block. See application whitelisting.
- Privilege management: Keeper Endpoint Privilege Manager removes standing local admin rights on Windows, macOS and Linux. See endpoint privilege management.
- Device control: USB and peripheral rules in the CrowdStrike Falcon, SentinelOne, ThreatDown and Bitdefender GravityZone platforms. See USB device control.
- Patching and vulnerability assessment: ThreatDown Vulnerability and Patch Management, Bitdefender GravityZone Patch Management and WatchGuard Patch Management. See the patch management process.
- Encryption: Bitdefender GravityZone Full Disk Encryption (BitLocker and FileVault) and WatchGuard Full Encryption (BitLocker) manage native encryption and recovery keys centrally. See full disk encryption.
Hardening is one part of the endpoint security best practices checklist; patching, EDR and response planning are the others.
How we help
We can compare your current device settings with an NCSC or CIS baseline, agree which changes make sense for how your people work, and help you roll them out in stages through the tools you already have. Where a gap needs a product, such as application control or privilege management, we supply several options and recommend the one that fits, with pricing confirmed at quote.
Contact us to talk about hardening your endpoints.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What is endpoint hardening?
Endpoint hardening is configuring laptops, desktops, servers and phones to reduce their attack surface: removing unused software and services, restricting admin rights, macros, scripts and peripherals, and turning on protections such as secure boot, disk encryption, the host firewall and application control.
What should an endpoint hardening checklist include?
Provisioning, admin separation, unused software and services, auto-run, macros, scripts, application control, host firewall, secure boot and firmware, encryption, peripherals, updates, sign-in and screen lock, and logging. The table on this page covers each with what to do and why.
Which hardening baseline should we use in the UK?
The NCSC's platform guides and recommended configurations are a sound UK starting point for Windows, macOS and mobile devices. CIS Benchmarks are a widely used alternative and cover platforms the NCSC does not, such as Linux. Choose one per platform and record any changes you make.
Is hardening the same as patching?
No. Patching fixes vulnerabilities in software by installing updates. Hardening changes settings to reduce what can be attacked in the first place. You need both, along with endpoint detection and response for the attacks that still get through.
Does endpoint hardening help with Cyber Essentials?
Yes. Secure configuration is one of the five Cyber Essentials controls, and hardening work such as removing unnecessary software, changing default passwords, disabling auto-run and controlling admin rights supports it and the user access control requirement.
Will hardening break our applications?
It can if settings are applied everywhere at once. Use audit modes, pilot groups and an exceptions process, and roll out in waves. That way you see what would be blocked before anything is enforced.
Still have a question about endpoint hardening?
Ask us and a member of our team will reply by email.