Workstation hardening matching lab

Match encryption/patch baseline, AutoRun off, lockout, and firmware password; leave shared-admin and AutoRun-enable unused.

Match each hardening ticket to the right control. Leave shared-admin and AutoRun-enable unused.

CompTIA 2.7 is the workstation baseline: encryption, passwords/lockout, firmware passwords, AutoRun off, and patching before the phishing email.

New hire PC: default apps, no encryption, months behind on patches

Raise the whole baseline before mailbox access.

Worm walked in from a vendor USB without a double-click

Removable media executed itself. Which feature did that?

Nightly brute-force against a local account on a kiosk

Failed logons never stop. Policy should cut them off.

Intern changed boot order and bypassed BitLocker prompts

Pre-OS tampering. OS password was never in the path.

Still on the bench

Disk encryption + patch baseline + disable unused services — Baseline hardening before the user is phished: encrypt, patch, shrink attack surface.
Disable AutoRun/AutoPlay for removable media — AutoRun on USB is how malware walks in without a click. Kill it on managed workstations.
Account lockout threshold after failed password attempts — Stops endless password guessing at the console/RDP. Pair with strong passwords — not instead of them.
Firmware/BIOS supervisor password — block boot-order tampering — Stops casual USB boot bypass of OS controls. OS passwords alone do not protect pre-boot.
Share one local admin password across the whole floor — Shared local admin is lateral-movement candy. Unique/LAPS-style secrets, not hallway sticky notes.
Re-enable AutoRun so 'training USBs work without clicks' — Convenience is not a control. Training media gets deliberate launch — not AutoRun.