Latest Windows hardening guidance and key dates


Hardening is a key element of our ongoing security strategy to help keep your estate protected while you focus on your job. Increasingly creative cyberthreats target weaknesses anywhere possible, from the chip to the cloud. Have you seen our publications on hardening on the Windows message center? Some of those recently enforced include DCOM authentication hardening and Netjoin: domain join hardening. Let's review vulnerable areas that are undergoing hardening in the upcoming months.

Hardening changes at a glance​

Review the visual timeline to focus on the specific changes that are of interest to you. Find the details for each phase below.

large

A visual timeline of the hardening changes taking place in 2023

Hardening changes by month​

Consult the details for all upcoming hardening changes by month to help you plan for each phase and final enforcement.

March 2023​

  • DCOM authentication hardening KB5004442 | Phase 3
    Final enforcement: changes enabled by default with no ability to disable them. Assumes prior resolution of all compatibility issues.

April 2023​

  • Netlogon protocol changes KB5021130 | Phase 2
    Initial enforcement; removes the ability to disable RPC sealing by setting value 0 to the RequireSeal registry subkey.
  • Certificate-based authentication KB5014754 | Phase 2
    Removes Disabled mode.

June 2023​

  • Netlogon protocol changes KB5021130 | Phase 3
    Enforcement by default. RequireSeal subkey will be moved to Enforcement mode unless you explicitly configure it to be under Compatibility mode.
  • Kerberos PAC Signatures KB5020805 | Phase 3
    Removes the ability to disable PAC signature addition by setting the KrbtgtFullPacSignature subkey to a value of 0.

July 2023​

  • Secure Boot bypass protections KB5025885 | Phase 2
    Automated deployment of the revocation files and SafeOS dynamic update package for Window Recovery Environment (WinRE). New Event Log events will report on the success of revocation deployment.
  • Netlogon protocol changes KB5021130 | Phase 4
    Final enforcement. RequireSeal subkey will be moved to Enforcement mode unless you explicitly configure it to be under Compatibility mode. Will remove the Compatibility mode (the ability to set value 1 to the RequireSeal registry subkey).
    Editor's note (5.2.2023): The previous post incorrectly described the final enforcement phase for Netlogon protocol. We corrected this in this post to align with the official description documented in the corresponding KB article.
  • Kerberos PAC Signatures KB5020805 | Phase 4
    Enforcement mode as default (KrbtgtFullPacSignature = 3), which you can override with an explicit Audit setting.

October 2023​

  • Kerberos PAC Signatures KB5020805 | Phase 5
    Final, full enforcement.

November 2023​

  • Certificate-based authentication KB5014754 | Phase 3
    Final, full enforcement.

January 2024​

  • Active Directory (AD) permissions issue KB5008383 | Phase 5
    Final enforcement.
large

A visual timeline of the hardening changes taking place in 2024 with Phase 5 and Phase 3

First quarter of 2024​

  • Secure Boot bypass protections KB5025885 | Phase 3
    Full, final enforcement.
Click to expand...

Source:

Latest Windows hardening guidance and key dates - Microsoft Support

techcommunity.microsoft.com techcommunity.microsoft.com
 
Last edited:
Click to expand...
The source article has been updated. Of particular note is this addition, a date for automatic deployment of the revocation files.
:

July 2023​


  • Secure Boot bypass protections KB5025885 | Phase 2
    Automated deployment of the revocation files and SafeOS dynamic update package for Window Recovery Environment (WinRE). New Event Log events will report on the success of revocation deployment.
 

My Computers

System One System Two

  • OS
    Windows 11 Home
    Computer type
    Laptop
    Manufacturer/Model
    Acer Aspire 3 A315-23-R9VY
    CPU
    AMD Athlon Silver 3050U
    Memory
    8GB
    Graphics Card(s)
    Radeon Graphics
    Monitor(s) Displays
    laptop screen
    Screen Resolution
    1366x768 native resolution, up to 2560x1440 with Radeon Virtual Super Resolution
    Hard Drives
    1TB Samsung EVO 870 SSD (from April 2026: 250GB EVO 850)
    Internet Speed
    150 Mbps
    Browser
    Edge, Firefox
    Antivirus
    Defender
    Other Info
    fully 'Windows 11 ready' laptop. Windows 10 C: partition migrated from my old unsupported 'main machine' then upgraded to 11. A test migration ran Insider builds for 2 months. When 11 was released on 5th October 2021 it was re-imaged back to 10 and was offered the upgrade in Windows Update on 20th October. Windows Update offered the 22H2 Feature Update on 20th September 2022. It got the 23H2 Feature Update on 4th November 2023 through Windows Update, 24H2 on 3rd October 2024 through Windows Update by setting the Target Release Version for 24H2, and 25H2 on 30th September 2025 through Windows Update by setting the Target Release Version for 25H2.

    UPDATE - 11 April 2026: due to mechanical deterioration this PC has been retired from active duty. The OS with all software and files has been migrated to my System Seven below to carry on as my general purpose 'main machine'.

    My SYSTEM THREE is a Dell Latitude 5410, i7-10610U, 32GB RAM, 512GB NVMe ssd, supported device running Windows 11 Pro.

    My SYSTEM FOUR is a 2-in-1 convertible Lenovo Yoga 11e 20DA, Celeron N2930, 8GB RAM, 256GB ssd. Unsupported device: currently running Win10 Pro, plus Win11 Pro RTM and Insider Dev, Beta, and RP 24H2 as native boot vhdx.

    My SYSTEM FIVE is a Dell Latitude 3190 2-in-1, Pentium Silver N5030, 8GB RAM, 1TB NVMe ssd, supported device running Windows 11 Pro, plus Insider Beta, Dev, and Canary builds (and a few others) as a native boot .vhdx.

    My SYSTEM SIX is a Dell Latitude 5550, Core Ultra 7 165H, 64GB RAM, 1TB NVMe SSD, supported device, Windows 11 Pro 24H2, Hyper-V host machine. Updated to 25H2 on 30th September 2025.

    My SYSTEM SEVEN is a Lenovo Thinkpad T580, Intel Core i7-8650U, 16GB RAM, 512GB NVMe SSD + 2nd 512GB NVMe SSD, a supported device for Windows 11. This is my current general purpose 'main machine'. The installed Windows 11 Home from my System One has been migrated to this machine.
  • Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Dell Latitude E4310
    CPU
    Intel® Core™ i5-520M
    Motherboard
    0T6M8G
    Memory
    8GB
    Graphics card(s)
    (integrated graphics) Intel HD Graphics
    Screen Resolution
    1366x768
    Hard Drives
    500GB Crucial MX500 SSD
    Browser
    Firefox, Edge
    Antivirus
    Defender
    Other Info
    unsupported machine: Legacy bios, MBR, TPM 1.2, upgraded from W10 to W11 using W10/W11 hybrid install media workaround. In-place upgrade to 22H2 using ISO and a workaround. Feature Update to 23H2 by manually installing the Enablement Package. In-place upgrade to 24H2 using hybrid 23H2/24H2 install media. Upgraded to 25H2 by Enablement Package. Also running Insider Dev, and Canary builds and Windows 10 as native boot .vhdx.

    My SYSTEM THREE is a Dell Latitude 5410, i7-10610U, 32GB RAM, 512GB NVMe ssd, supported device running Windows 11 Pro.

    My SYSTEM FOUR is a 2-in-1 convertible Lenovo Yoga 11e 20DA, Celeron N2930, 8GB RAM, 256GB ssd. Unsupported device: currently running Win10 Pro, plus Win11 Pro RTM and Insider Dev, Beta, and RP 24H2 as native boot vhdx.

    My SYSTEM FIVE is a Dell Latitude 3190 2-in-1, Pentium Silver N5030, 8GB RAM, 1TB NVMe ssd, supported device running Windows 11 Pro, plus Insider Beta, Dev, and Canary builds (and a few others) as a native boot .vhdx.

    My SYSTEM SIX is a Dell Latitude 5550, Core Ultra 7 165H, 64GB RAM, 1TB NVMe SSD, supported device, Windows 11 Pro 24H2, Hyper-V host machine. Updated to 25H2 on 30th September 2025.

    My SYSTEM SEVEN is a Lenovo Thinkpad T580, Intel Core i7-8650U, 16GB RAM, 512GB NVMe SSD + 2nd 512GB NVMe SSD, a supported device for Windows 11. This is my current general purpose 'main machine'. The installed Windows 11 Home from my System One has been migrated to this machine.
This will be included in the July Patch Tuesday next week?
As I don't use secure boot will I need to do anything?
 

My Computer

System One

  • OS
    Windows 11 Pro 25H2 (RP channel)
    Computer type
    PC/Desktop
    Manufacturer/Model
    MSI
    CPU
    AMD Ryzen 7 9800X3D 8-core
    Motherboard
    MEG X870E Godlike
    Memory
    64GB Corsair Titanium 6000/CL30
    Graphics Card(s)
    MSI Suprim 5080 SOC
    Sound Card
    Soundblaster AE-9
    Monitor(s) Displays
    ASUS TUF Gaming VG289Q
    Screen Resolution
    3840x2160
    Hard Drives
    Samsung 9100 Pro 4TB (gen 5 x4, system drive/games)
    Samsung 990 Pro 2TB
    Samsung 980 Pro 2TB
    Samsung 870 Evo 4TB
    Samsung 870 Evo 2TB
    Samsung T9 4TB
    PSU
    Seasonic PX-2200
    Case
    Bequiet! Dark Base Pro 901
    Cooling
    Noctua NH-D15S Chromax black
    Keyboard
    Logitech G915 X (wired)
    Mouse
    Logitech G903 with PowerPlay charger
    Internet Speed
    900Mb/sec
    Browser
    Microsoft Edge
    Antivirus
    Windows Defender
You must log in or register to reply here.

Similar threads

  • Article Article
Latest Windows 10/11 hardening guidance and key dates
Replies
0
Views
743
Brink
Brink
  • Article Article
Microsoft's latest Windows hardening guidance and key dates
Replies
10
Views
4K
dbartenstein
dbartenstein

Latest Support Threads

Latest Tutorials

Back
Top Bottom