Setting Up & Hardening a Standalone (Non-AD) Windows Server 2019

Plenty of Windows Servers run standalone — workgroup, no Active Directory: a backup target, an app host, a lab box. Without a domain you can’t push policy centrally, so everything is local. Here’s a practical setup-and-hardening checklist for a non-AD Windows Server 2019, in the order I actually do it.

1. Stop Server Manager launching at every logon

On a standalone box you rarely need Server Manager popping up each time you sign in. Turn it off:

Quickest (this user): Server Manager → Manage → Server Manager Properties → tick “Do not start Server Manager automatically at logon” → OK.

All users (PowerShell, disables the scheduled task that launches it):

Get-ScheduledTask -TaskName ServerManager | Disable-ScheduledTask

Via local policy (so it’s part of your baseline): in gpedit.msc → Computer Configuration → Administrative Templates → System → Server Manager → Do not display Server Manager automatically at logon → Enabled.

2. Rename and lock down the local Administrator

A predictable Administrator account is the first thing attackers try:

Rename-LocalUser -Name 'Administrator' -NewName 'svc-admin'
# Create a separate administrator for admin tasks; use a standard account for ordinary work
New-LocalUser -Name 'opsadmin' -FullName 'Ops Admin' -Password (Read-Host -AsSecureString 'Password')
Add-LocalGroupMember -Group 'Administrators' -Member 'opsadmin'

Disable the Guest account if it isn’t already:

Disable-LocalUser -Name 'Guest'

3. Set local security policy (account & lockout)

With no domain password policy, set it locally. Open secpol.msc → Account Policies:

• Password Policy: minimum length 14+, complexity Enabled, max age 365 or per your standard.
• Account Lockout Policy: threshold 10 invalid attempts, duration 15 min, reset counter after 15 min — this blunts brute-force without locking you out constantly.

Prefer the command line? net accounts sets several of these:

net accounts /minpwlen:14 /maxpwage:365 /lockoutthreshold:10 /lockoutduration:15 /lockoutwindow:15

To make this repeatable across servers, capture it once and batch-apply it with LGPO.exe instead of clicking through secpol.msc on every box.

4. Configure the Windows Firewall

Keep all three profiles on and deny inbound by default:

Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True `
  -DefaultInboundAction Block -DefaultOutboundAction Allow

Then review existing inbound exceptions. Adding a narrow allow rule does not override a broader allow rule. Enabling RDP can create rules for TCP and UDP; custom or policy-managed rules may also permit it.

Before restricting RDP, keep a local console, hypervisor console or other tested management route available so you can recover from a lockout. In Windows Defender Firewall with Advanced Security → Inbound Rules:

1. Find the enabled Remote Desktop rules and any custom rules allowing the RDP service or its listening port (3389 by default).
2. For each applicable TCP and UDP allow rule, open Properties → Scope → Remote IP address and enter the approved admin addresses/subnets. Confirm the profiles also match the intended networks.
3. Disable or narrow any duplicate broad exceptions. If a rule comes from policy, change it at the policy source rather than adding a local exception.
4. Test a new connection from an allowed address and a disallowed address. Only after the tests should you consider the restriction complete.

Keep the firewall configuration backed up before changing it. Apply the same review to every other service exposed by the server.

5. Harden Remote Desktop

• Require Network Level Authentication (Server 2019 default — confirm it’s on).
• Don’t expose 3389 to the internet. Restrict by IP (above) or front it with a VPN/RD Gateway.
• Limit who can log in: only members of a specific admins group via Allow log on through Remote Desktop Services in secpol.msc → Local Policies → User Rights Assignment.

6. Updates without WSUS

Standalone means no central patch server. Automate it locally with the PSWindowsUpdate module on a scheduled task so the box patches itself monthly.

7. Apply Microsoft’s security baseline

For a hardened starting point, download the Windows Server 2019 Security Baseline (part of the Security Compliance Toolkit) and apply it locally with LGPO.exe. It sets hundreds of vetted local-policy values you’d never configure by hand — and on a standalone server it’s the closest you’ll get to domain-grade hardening.

Quick checklist

• Server Manager autostart disabled
• Built-in Administrator renamed; Guest disabled; separate daily admin
• Local password + lockout policy set (and captured for LGPO)
• Firewall default-deny inbound; only needed ports open, scoped by IP
• RDP restricted (NLA on, IP-limited, not internet-facing)
• Automated patching via PSWindowsUpdate
• Security baseline applied with LGPO

FAQ

Can I use Group Policy at all without a domain? Only local group policy (gpedit.msc / secpol.msc). It applies to that one machine — use LGPO.exe to copy it to others.

Is gpedit.msc available on Server Core? No GUI on Core — manage policy with LGPO.exe and PowerShell instead.

Sources: Microsoft Learn — Firewall rule precedence, Microsoft Learn — Modify existing rules, Windows OS Hub — Prevent Server Manager from starting at logon, Microsoft Learn — Security Compliance Toolkit