Endpoint Security Hardening in 2026: A Practical Checklist for Busy IT Teams

[For IT Pros]

Most breaches I get called into in 2026 still start the same way: a single laptop with weak controls, a user who clicked, and no proper hardening baseline. The tools are better than ever, but many organisations still rely on hopeful thinking and a default Windows install.

This guide is a practical endpoint hardening checklist you can actually roll out. It’s opinionated, focused on Microsoft-heavy environments (Windows 11, Entra ID, Intune, Defender stack), and designed for two types of readers: the solo IT admin and the security engineer trying to standardise controls across a messy estate.

1. Start with a Clear Baseline: Know What "Good" Looks Like

1.1 Decide Your Security Tiers

Stop trying to make every device identical. Define 2–3 security tiers and harden from there:

  • Tier 0 – Admin & Highly Privileged: Domain/Entra admins, SOC, finance, execs. Most restrictive. No local admin, strict app controls, mandatory device compliance.
  • Tier 1 – Standard Users: Office workers, hybrid users. Strong baseline, fewer exceptions.
  • Tier 2 – Special Cases: Developers, OT, lab machines. Documented deviations and compensating controls.

Write this down. Even a one-page Google/Word doc is better than tribal knowledge. You’ll use these tiers when you build Intune configuration profiles, compliance policies, and Conditional Access.

1.2 Inventory and Ownership

Hardening without asset clarity is guesswork. At minimum, ensure:

  • All Windows endpoints are Entra ID joined or hybrid joined.
  • All corporate devices are in Intune (or your MDM of choice) with a tag/group indicating owner or department.
  • Every device has an owner of record and a criticality tag.

If you can’t list all endpoints and their owners, pause and fix that before you pretend they’re hardened.

2. Identity, Access, and Local Privilege

2.1 Kill Local Admin for Daily Accounts

In 2026, users with permanent local admin are still how a lot of ransomware spreads laterally. The pattern that works:

  • No local admin on user accounts, including developers by default.
  • Just-in-time elevation via Privileged Identity Management (PIM), Endpoint Privilege Management (EPM), or a similar tool.
  • Break-glass local admin accounts unique per device, managed via LAPS.

2.2 Configure Windows LAPS in 2026 (Entra Integrated)

If you’re still using the legacy on-prem LAPS only, move to the built-in Windows LAPS with Entra ID integration.

High-level steps:

  • Enable Windows LAPS in the Entra portal: Entra ID > Devices > Device settings > Local Administrator Password Solution.
  • In Intune, create a Windows LAPS configuration profile (Account protection > Local admin password solution).
  • Set Backup directory to Entra ID, rotation period to 7–30 days, and enforce a strong, random password.

To quickly check LAPS status on a device:

Get-LapsAADPassword -DeviceIds <DeviceId> -IncludePasswords

(Run from a privileged system with the right Entra permissions.)

2.3 MFA and Device Compliance as the Front Door

Endpoints are part of access control now, not just something you secure afterwards. In Conditional Access:

  • Require MFA for all interactive sign-ins (no exceptions, just emergency break-glass).
  • Require compliant device for high-risk apps (admin portals, finance, HR, source code, production management).
  • Block legacy protocols and basic auth completely.

Combine this with Entra ID Protection risk-based policies for sign-in and user risk where licensing allows.

3. OS Hardening: Secure Configuration by Default

3.1 Use Security Baselines, but Don’t Stop There

In Intune, start with Microsoft’s Endpoint Security Baselines for Windows 11 and Edge:

  • In Intune: Endpoint Security > Security baselines > Windows 11 for Enterprise.
  • Deploy baseline to a pilot group first (IT + a few friendly power users).
  • Document any settings that break business apps, and override selectively.

Security baselines give you a strong baseline, but you’ll almost always need custom profiles for things like BitLocker, Firewall, and Attack Surface Reduction.

3.2 BitLocker Everywhere, with Proper Key Management

If a corporate laptop can be lost or stolen without BitLocker, that’s an immediate action item.

Intune BitLocker policy basics:

  • Require device encryption on OS drives.
  • Enforce TPM-only or TPM+PIN depending on your risk profile.
  • Store recovery keys in Entra ID (and optionally in on-prem AD if hybrid).

To check BitLocker status locally:

Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, ProtectionStatus, EncryptionMethod

3.3 Firewall On, Configured, and Logged

Too many orgs disable the Windows Defender Firewall to "fix" something once and never revisit it. Don’t.

  • Ensure the firewall is On for Domain, Private, and Public profiles via Intune or GPO.
  • Block inbound by default, allow only required ports (e.g., RDP from management ranges, not internet).
  • Enable logging for dropped connections and allowed connections.

Quick local check:

# Check firewall state
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction

# Show top inbound rules
Get-NetFirewallRule -Direction Inbound | Where-Object {$_.Enabled -eq 'True'} | \
  Select-Object DisplayName, Action, Profile, LocalPort, Protocol | Format-Table -AutoSize

4. Endpoint Protection & EDR: Defender as a First-Class Citizen

4.1 Standardise on a Single EDR

Running two AV/EDR agents is a performance and troubleshooting nightmare. Choose one platform and standardise. For most Microsoft 365 E5 / Defender for Endpoint organisations, that’s Defender.

Key elements to enforce via Intune or GPO:

  • Real-time protection on and tamper protection enabled.
  • Cloud-delivered protection and automatic sample submission.
  • Strict remediation level for non-server endpoints.

4.2 Attack Surface Reduction (ASR) Rules That Actually Work

ASR rules are still one of the highest-value controls you can enable in 2026. Start in Audit mode, then move to Block.

Recommended high-value ASR rules:

  • Block executable content from email and webmail clients
  • Block Office from creating child processes
  • Block credential stealing from LSASS
  • Block process creations originating from PSExec and WMI commands
  • Use advanced protection against ransomware

In Intune: Endpoint Security > Attack surface reduction > ASR rules. Start with:

  • Tier 0 devices: Directly set to Block for all critical rules.
  • Tier 1 devices: Audit for 2–4 weeks, review Defender alerts, then move to Block.

4.3 Controlled Folder Access and Ransomware Protection

Controlled Folder Access can be noisy but is useful for high-risk roles (finance, legal, execs). Configure it in Block mode for specific groups, approve known business apps, and monitor for third-party tools that need write access.

In a ransomware-heavy environment, it’s worth the tuning time, especially for Tier 0/Tier 1 users with sensitive data.

5. Application Control: From "Anything Goes" to Least Privilege

5.1 App Allowlisting with WDAC or Intune App Control

In 2026, we’re far past the point where "install anything" is acceptable on corporate devices. The modern approach:

  • Use Windows Defender Application Control (WDAC) policies for strict environments.
  • For general users, use App Control for Business via Intune on Windows 11.
  • Allow apps based on publisher, signed binaries, and Microsoft Store where possible.

Basic WDAC deployment approach:

  1. Generate an audit-only policy from a reference device using New-CIPolicy.
  2. Deploy in Audit mode via Intune or GPO and collect events.
  3. Refine and then switch to Enforced mode for Tier 0 first.

5.2 Browser Hardening and Extensions

Most attacks still come through the browser. Standardise on Edge or Chrome with managed policies:

  • Force sign-in with corporate accounts.
  • Sync and manage approved extensions (password managers, security tools, not random stuff).
  • Block dangerous categories via DNS filtering or Secure Web Gateway tools.

On Edge, use the security baseline in Intune and enforce Safe Browsing / SmartScreen with enhanced protection.

5.3 Blocking Legacy and High-Risk Software

Have a ban list of software categories you won’t allow (e.g., unapproved remote access tools, torrent clients, outdated Java runtimes). Enforce with:

  • Intune app protection and uninstall assignments.
  • EDR custom detection rules (e.g., alert or block when TeamViewer or AnyDesk appears unexpectedly).

6. Hardening PowerShell and Admin Tools

6.1 Log and Monitor PowerShell, Don’t Just Disable It

Disabling PowerShell breaks modern Windows management. Instead, make it observable.

  • Enable script block logging and module logging via Intune or GPO.
  • Ship logs to your SIEM (Sentinel, Splunk, etc.).
  • Alert on suspicious patterns (encoded commands, recon cmdlets in user context, known attacker frameworks).

Local quick check:

Get-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging

6.2 Separate Admin Workstations (PAWs)

Admin accounts shouldn’t be used on the same device people browse Reddit and open email attachments.

  • Use Privileged Access Workstations (PAWs) or secure VDI for admin tasks.
  • Block internet browsing and email on PAWs; restrict to management tools only.
  • Harden PAWs more aggressively: all ASR rules, strict WDAC, no local data storage.

7. Patch, Update, and Prove It

7.1 Patch Cadence That Reflects 2026 Threats

Monthly patching is still the basic expectation, but you need a fast lane for critical issues.

  • Normal updates: 14–21 day rollout with pilot rings in Intune or WSUS/ConfigMgr.
  • Critical zero-days (actively exploited): emergency ring, 24–72 hours to patch exposed endpoints.

In Intune, define update rings:

  • Ring 0: IT + test machines.
  • Ring 1: 10–20% of general users.
  • Ring 2: everyone else.

7.2 Third-Party Patching

Attackers love outdated browsers, PDF readers, and collaboration tools. If you don’t have a third-party patching solution, fix that.

  • Options include integrated Intune connectors, ConfigMgr, or cloud tools that plug into Intune.
  • At minimum, keep browsers, Java runtimes (if you still need them), and VPN clients current.

7.3 Compliance and Reporting

Executives will ask, "Are we secure?" You need numbers, not feelings.

  • Use Intune device compliance and Defender security recommendations as your primary KPIs.
  • Set a target like 95% of endpoints compliant within 7 days of patch release.
  • Export reports monthly, review non-compliant devices, and chase owners.

8. A Minimal, Actionable Endpoint Hardening Checklist

If you only do one thing after reading this, do this: pick a pilot group and implement a real baseline within 30 days. Here’s a condensed checklist you can turn into tickets:

Core Hardening Actions (Baseline for All Devices)

  • All endpoints Entra ID joined and Intune enrolled.
  • No permanent local admin for standard user accounts; LAPS enabled and enforced.
  • BitLocker enabled on all laptops/desktops with keys in Entra ID.
  • Windows Defender Firewall on for all profiles, default-deny inbound.
  • Defender for Endpoint deployed with tamper protection and EDR in block mode (where licensed).
  • ASR rules in Audit for 2–4 weeks, then Block for critical rules.
  • Standardised browser with managed policies and security extensions.
  • Monthly OS and app patch cycle with clear rings and reporting.

Next-Level Controls (Within 90 Days)

  • Tiered security model (Tier 0/1/2) mapped to actual device groups.
  • Conditional Access enforcing MFA + compliant device for sensitive apps.
  • App allowlisting (WDAC / App Control for Business) for Tier 0 devices.
  • Privileged Access Workstations for admins with stricter controls.
  • Centralised PowerShell logging and detection rules in your SIEM.

Hardened endpoints won’t make you breach-proof, but they massively reduce the blast radius when something goes wrong. Pick one section of this guide, turn it into a small project, and get it done this month. Then move to the next. That’s how real security maturity happens in busy, imperfect IT environments.