Hardening endpoints: application control, macros, local admin rights and baselines
Antivirus and EDR catch threats; hardening removes the openings they use. This course covers application control (allowlisting) rolled out through audit mode, the default blocking of macros in Office files from the internet and safe ways to trust the files that really need macros, removing everyday local admin rights and managing local administrator passwords, and adopting a published configuration baseline with recorded deviations and drift checks.
- Level
- Intermediate
- Length
- About 50 minutes
- Contents
- 3 lessons · 1 video · final exam
- Status
- Published · updated 3 Oct 2026
Skills you'll practise
- Explain how application control differs from antivirus and why it is rolled out in audit mode first
- Read an audit-mode report and decide which entries need a narrow allow rule and which should stay blocked
- Choose a safe way to let a trusted macro-enabled file run without re-enabling macros for every internet file
- Explain why daily accounts should not be local administrators and what a local administrator password solution adds
- Plan the adoption of a published baseline with a pilot, recorded deviations and drift monitoring
Course outline
- 1.Hardening endpoints in six stepsVideo · 3 min
- 2.Application control: only approved code runsLesson · 17 min
- 3.Macros and local admin rightsLesson · 16 min
- 4.Baselines, deviations and driftLesson · 15 min
- 5.Hardening endpoints: application control, macros, local admin rights and baselines: knowledge checkKnowledge check · 18 questions
- 6.Finance wants macros backScenario
- 7.Final exam10 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- NIST SP 800-167: Guide to Application Whitelisting (2015)
- Microsoft Learn: Application Control for Windows (App Control for Business and AppLocker)
- Microsoft Learn: Macros from the internet are blocked by default in Office
- Microsoft Learn: What is Windows LAPS?
- Microsoft Learn: Windows security baselines
- Center for Internet Security: CIS Benchmarks (consensus configuration recommendations)
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.