How to Audit Windows Operating Systems: Servers and Clients Checklist

Windows servers run Active Directory, file shares and many business applications, while Windows laptops sit on almost every desk. Attackers know this, so Windows is a common path to ransomware and data theft. When you audit Windows operating systems, you check patching, administrator rights, security settings and logging against a hardened baseline.

This guide explains audit policy, useful built-in commands, and separate checklists for servers and clients.

Two meanings of “auditing” in Windows

First, avoid a common confusion. Windows has a feature called audit policy, which decides which events the system writes to the Security log. A security audit, on the other hand, is your review of the system’s controls. Both matter, because the audit policy creates the evidence you need during investigations.

Use Advanced Audit Policy Configuration rather than the older basic settings. It gives fine-grained control over categories such as logon events, account management, privilege use and process creation.

Useful tools and commands

• Microsoft Security Compliance Toolkit: security baselines you can compare against Group Policy.
• CIS Benchmarks: independent hardening guides for Windows Server and Windows 11.
• PingCastle or similar tools: quick health checks of Active Directory.
• Built-in commands: most evidence comes from PowerShell or the command prompt.

# Current audit policy
auditpol /get /category:*

# Members of the local Administrators group
Get-LocalGroupMember -Group "Administrators"

# Installed updates and OS version
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Get-ComputerInfo -Property OsName, OsVersion, OsBuildNumber

# Applied Group Policy (HTML report)
gpresult /h C:\Temp\gp-report.html

# BitLocker status
Get-BitLockerVolume

# Defender status
Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated

# Listening ports
Get-NetTCPConnection -State Listen

Steps in the audit

1. Scope: list domain controllers, servers and client groups in scope.
2. Collect baselines: decide which benchmark you will compare against.
3. Gather evidence: run the commands above, export Group Policy and review Active Directory.
4. Compare: note every deviation from the baseline and judge its risk.
5. Report: group findings by theme, such as patching or admin rights.

Checklist: Windows servers

• The server runs a supported Windows Server version.
• Monthly security updates install within your defined timeline.
• Only named admins belong to local and domain admin groups.
• Domain admins use separate admin accounts and log in only to domain controllers or admin workstations.
• Microsoft LAPS manages local administrator passwords.
• SMBv1 stays disabled, and SMB signing is required.
• Remote Desktop requires Network Level Authentication and is reachable only from admin networks.
• Defender or another EDR tool runs with current signatures.
• Advanced audit policy records logons, account changes, privilege use and process creation.
• Security logs go to a SIEM and are large enough to keep useful history.
• Backups cover system state for domain controllers, and the team tests restores.
• Unneeded roles, features and services are removed.

Checklist: Windows clients

• Devices run a supported Windows 10 or 11 release.
• BitLocker encrypts system drives.
• Users work without local admin rights.
• Windows Update or Intune installs patches automatically.
• Microsoft Defender, SmartScreen and attack surface reduction rules are on.
• The firewall is on for all network profiles.
• Screens lock after a short idle period.
• Office macros from the internet stay blocked.
• Devices enrol in Intune or another management tool.

Common findings

Auditors often find too many domain admins, local admin passwords that are the same on every machine, SMBv1 still enabled on an old file server, and Security logs that overwrite themselves within hours.

Related guides

• How to audit Unix and Linux systems
• ISO 27001 access control

Sources

• CIS Benchmarks

Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.