Page 168 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
SMB encryption protects supported SMB data in transit and can be required at several scopes, but unsupported clients are rejected and encryption does not cover storage at rest.
Read the checklist
Protected Users applies nonconfigurable credential protections that can also break NTLM, delegation, offline sign-in, and other dependencies. Prove each account's authentication paths before membership expands.
Read the guide
Windows Event Forwarding can collect selected operational and administrative events through subscriptions, but a running collector does not prove every source enrolled or delivered the required events.
Read the guide
Requiring LDAP signing rejects unsigned SASL binds and cleartext simple binds; Microsoft provides summary and detailed directory events to find dependent clients before enforcement.
Read the playbook
Just Enough Administration can expose a constrained PowerShell endpoint backed by a privileged virtual account or gMSA, but endpoint commands, parameters, run-as identity, and transcripts define the real boundary.
Read the guide
Sysmon records detailed system activity according to its configuration, but it neither analyzes events nor supplies a universally correct configuration; rule changes directly alter evidence and volume.
Read the guide
Delivery Optimization can obtain Windows content from peers, Connected Cache, or the HTTP source; download mode, network identity, proxy behavior, and reporting determine where content actually moves.
Read the guide
Microsoft applies safeguard holds to stop affected devices from being offered a feature update when a known issue may cause serious failure; bypass requires explicit testing and risk acceptance.
Read the briefing
Shielded VMs use Host Guardian Service attestation and key protection to limit host-administrator access, which also makes guardian, owner-key, and disaster-recovery design part of availability.
Read the guide
Key Vault soft delete makes deleted vaults and objects recoverable for a retention period, while purge protection prevents permanent purge during that period and cannot be disabled after enablement.
Read the guide