Implement a tiered administration model to limit the blast radius of service exploitation - Deploy attack surface reduction rules to block exploitation of vulnerable services - Enable Windows Defender Exploit Guard mitigations - Regularly audit which services are running and needed across all server