Defensive recommendations

Defensive recommendations are a part of the great SharpSCCM wiki. Here, we will cover the ones that are most effective but also easy to implement. I will not repeat things such as install updates, ensure that privileged accounts use strong passwords, audit activities, enforce signing if possible, and so on. Let’s look at some defensive recommendations:

• To prevent coercion, NTLM fallback should be disabled
• Disable NAAs in the domain and use enhanced HTTP instead
• Use the Software Update functionality to install clients instead of Automatic site-wide client push installation
• Clean task sequences and device collection variables from sensitive data
• For PXE, set a strong password for media and disable F8 Debugging
• Check service accounts to ensure the least privileges principle is applied
• Do not run the web client service to avoid HTTP coercion
• Enable multi-factor authentication for SMS provider calls[17]
• Require Extended...