Security hardening
Security hardening reduces opportunities for attack by tightening configuration, removing unnecessary capabilities, and addressing known weaknesses.
Hardening changes what a system permits. It can include disabling unused services, restricting privileges, applying updates, and enforcing safer settings. It is more specific than telling users to be careful, and broader than installing a single security tool.
A vendor baseline can provide a starting configuration and explain why its settings matter. Microsoft’s security baselines are recommendations for supported products, built around stated assumptions about how those environments are managed. Applying a baseline is not a guarantee that every vulnerability has been removed.
Understand requests to loosen a setting
An application that stops working after a restriction needs investigation. The immediate workaround may restore functionality while reopening the route the restriction was meant to close.
The macro-trust article examines one such request: changing how a document’s active content is trusted. The antivirus-exclusion article covers a different relaxation of protection. Neither change should be treated as harmless just because it is described as troubleshooting.
Treat a necessary departure as a security exception with an owner and a review date. Check the setting on the affected device too: a baseline selected in a management console does not tell you whether that device received and applied it.