In 2023, attackers walked into a small firm's network by guessing the built-in "Administrator" username and a weak password. No zero-day, no phishing — just a machine left the way it came out of the box. That story repeats constantly, because a default installation is built for convenience, not safety. Hardening is the work of turning that convenient default into something an attacker has to fight.
CompTIA A+ Core 2 (220-1202) covers workstation hardening in the Security domain: changing or disabling the default administrator account, disabling AutoRun and AutoPlay, disabling unused services, patching, and restricting what software can run and where it comes from. Related controls have their own articles in this section — password rules in Password Considerations, guest accounts and lockout policy in Account Management, BitLocker and EFS in Windows Encryption Tools, and antivirus and firewall settings in Defender Antivirus and Firewall — so this article focuses on the hardening techniques themselves: shrinking a workstation's attack surface until there is very little left to attack.
Hardening means shrinking the attack surface, one doorway at a time
Every feature an operating system enables is a doorway. A service listening on a port, a browser plugin, a file-sharing feature, an account that can log in, a USB port that auto-launches media — each is a way in, and the sum of them is the attack surface. Hardening is the discipline of closing every doorway you don't actively need.
The mindset behind it is default-deny thinking. Instead of asking "is there a reason to turn this off?", a hardened configuration asks "is there a reason to turn this on?" The flip matters because attackers don't need the feature you use every day — they need the one you forgot was enabled: the Telnet service nobody has touched since imaging, the AutoPlay handler on removable drives, the built-in Administrator account with its well-known name. None of these help the user, and all of them help an intruder.
Two corollaries follow. First, you cannot be exploited through code that isn't installed or running. Second, hardening is never one setting; it's a layered stack of small reductions — defense in depth. Exam tip: when a question asks how to reduce a workstation's attack surface, the answers are always subtractive: remove, disable, restrict, uninstall.
Least privilege keeps everyday work out of administrator territory
The most effective workstation hardening habit costs nothing: do daily work from a standard user account, not an administrator account. The principle of least privilege says every account should hold only the permissions its tasks require. A standard user can run applications, browse, and edit documents, but cannot install system-wide software, alter services, or modify other users' files. Malware running as that user inherits the same limits — it can damage one profile, but cannot silently install a kernel driver or disable security tooling machine-wide.
Windows makes this workable through Run as Administrator and User Account Control (UAC). When a standard user needs an administrative task, they right-click the program, choose Run as Administrator, and supply admin credentials for that one operation. Even members of the Administrators group don't run with full rights all the time: UAC keeps their session at standard privilege and interrupts with a consent prompt — the screen-dimming Secure Desktop dialog — whenever a program requests elevation, converting a silent privilege grab into a visible decision.
The most common hardening mistake is the reverse: every user made a local administrator "so things just work." Exam tip: if a scenario describes limiting damage from malware or user error, the answer is least privilege — standard accounts for daily use, elevation only on demand, and never disabling UAC to stop the prompts.
SmartScreen and application control decide what is allowed to execute
Beyond who can run things, hardening also controls what can run. Windows SmartScreen is the first layer: a reputation service built into Windows and Microsoft Edge that checks downloaded files and visited sites against Microsoft's data, throwing a full-screen warning before an unrecognized or known-malicious installer executes. It is not antivirus — it judges reputation, not file contents — and its warning can be overridden, but it stops the huge category of attacks that rely on a user double-clicking a fresh download. Leave it on; verify it under Windows Security > App & browser control.
The stricter layer is application control, where the operating system enforces a list of what may execute. Windows offers this through Software Restriction Policies and, with enforcement supported on Enterprise and Education editions, AppLocker, managed through Group Policy. An administrator defines rules by publisher (the code-signing certificate), path, or file hash, and anything outside the rules simply will not launch. Configured as an allow list, this is default-deny applied to software: it permits known-good programs and refuses everything else, so ransomware dropped into a temp folder never gets its first instruction executed.
At the A+ level you need the concept, not the rule syntax. Exam tip: antivirus is a deny list (block known bad), while AppLocker-style application control is an allow list (permit known good) — the stronger, more restrictive posture.
Where software comes from matters as much as what it does
A hardened workstation is only as trustworthy as its installers, so treat software sources as a security control. The safe pattern is boring: download directly from the vendor's official site or from a managed repository like the Microsoft Store. The dangerous pattern is the third-party "download portal" that wraps a legitimate free program in its own downloader, bundling toolbars, adware, or worse. If a search result offers a familiar utility through an unfamiliar site, walk away and find the vendor's own domain.
The Microsoft Store adds real hardening value: Store apps are vetted, delivered over a verified channel, updated automatically, and typically sandboxed, while a sideloaded installer from a random site is none of those things. Managed environments can configure Windows (under Settings > Apps) to warn before installing apps from outside the Store, or to allow Store apps only — the same allow-list logic applied to acquisition.
Two verification tools close the loop. Code signing attaches a publisher's cryptographic signature to an executable; when UAC or SmartScreen shows "Unknown publisher" on an elevation prompt, that is your cue to stop. And for downloads that matter — imaging tools, drivers, anything run as admin — reputable vendors publish a file hash, usually SHA-256 (Secure Hash Algorithm). Compute the hash of your copy with PowerShell's Get-FileHash or certutil -hashfile and compare; a mismatch means corruption or tampering, and the file does not get executed. Exam tip: hashing verifies integrity, while a digital signature verifies integrity and the publisher's identity.
AutoRun and AutoPlay are different features, and only one was a malware highway
These two get merged in casual conversation, but the exam rewards keeping them straight. AutoRun is the older mechanism: when media is inserted, Windows reads an autorun.inf file from its root and can launch a program listed there automatically, with no user action.