Windows 10/11 Workstation Security Training Course – Best Practices, Hardening and Threat Prevention

Securing Windows 10/11 involves enabling BitLocker disk encryption, requiring TPM 2.0 and Secure Boot, applying Microsoft security baselines (Windows Hardening Baseline), running Microsoft Defender or another EDR, restricting local admin via LAPS, applying least-privilege user accounts, configuring Windows Defender Application Control or Smart App Control, patching weekly, and limiting attack surface via ASR rules. MFE-IT trains administrators on the full Windows workstation hardening checklist.

Windows Defender Application Control (WDAC) is a Windows feature that lets administrators define exactly which executables, drivers, and scripts are allowed to run on managed devices — blocking everything else, including unknown malware. It is significantly stronger than traditional antivirus, but requires careful policy authoring. Through MFE-IT’s hands-on approach, learners design and deploy a WDAC policy on a sample environment during the training.

Microsoft Local Administrator Password Solution (LAPS) automatically rotates the local administrator password on each Windows endpoint and stores the current password securely in Active Directory or Microsoft Entra ID — accessible only to authorized administrators. It eliminates the practice of using a single shared local admin password fleet-wide, a major attack vector. The MFE-IT Windows 10/11 Workstation Security training covers Windows LAPS deployment end to end.

Microsoft Defender Antivirus, paired with Microsoft Defender for Endpoint (the EDR component included in Microsoft 365 E5 / Defender for Business), is now considered enterprise-grade and consistently rated among the top EDRs in independent tests. For most organizations, replacing third-party AV with Defender simplifies licensing and integration. Our MFE-IT training course on Windows 10/11 Workstation Security covers Defender deployment and tuning.