Project Overview

This project focused on designing and configuring a more secure remote administration environment for Windows systems using a Windows Bastion Host.

Instead of allowing administrators to connect directly to internal Windows systems through Remote Desktop Protocol (RDP), the Bastion Host acts as a controlled entry point between remote administrators and protected internal resources.

The solution was designed around network segmentation, restricted access, authentication controls, firewall policies, least-privilege principles, and security monitoring.

Architecture

Administrator → Bastion Host → Protected Windows Systems

The Bastion Host is positioned within a dedicated management network or DMZ, providing a controlled gateway for remote administration.

This approach helps reduce the exposure of internal systems and provides a centralized point where remote-access security policies can be applied.

Key Security Controls

• Network Level Authentication (NLA)
• Restricted RDP access
• Windows Defender Firewall configuration
• Network segmentation
• Dedicated Bastion Host
• Least-privilege access
• Group Policy configuration
• Windows security hardening
• Event logging and monitoring
• PowerShell administration

Technologies & Tools

Operating Systems

• Windows Server 2022
• Windows 10
• Windows 11

Remote Access

• Remote Desktop Protocol (RDP)
• Remote Desktop Connection (MSTSC)

Security & Administration

• Windows Defender Firewall
• Group Policy
• Network Level Authentication
• PowerShell

Networking

• DMZ / Management Network
• Network Segmentation
• Access Control

Monitoring & Logging

• Windows Event Viewer
• Windows security logs

Project Objectives

The primary objectives of the project were to:

• Reduce the attack surface associated with remote desktop access
• Prevent direct RDP exposure of protected internal systems
• Establish a controlled remote administration pathway
• Apply least-privilege access principles
• Strengthen authentication requirements
• Restrict network access through firewall rules
• Improve visibility through logging and monitoring
• Demonstrate secure Windows remote administration practices

Implementation

The project involved configuring a Windows Server to function as a Bastion Host and establishing controlled remote access to protected Windows systems.

Security controls were applied at multiple layers, including:

Network → Firewall → Authentication → Authorization → System Configuration → Monitoring

Remote access was restricted through firewall policies and authentication requirements, while Group Policy and Windows security configurations were used to enforce appropriate access controls.

Windows Event Viewer and system logging were used to provide visibility into remote access and administrative activity.

Security Architecture

The design follows a defense-in-depth approach rather than relying on a single security control.

The Bastion Host provides a controlled administrative entry point, while additional protections are applied through:

• Network segmentation
• Restricted firewall rules
• Network Level Authentication
• User access controls
• Group Policy
• Least-privilege principles
• Logging and monitoring

This layered approach helps limit unnecessary exposure and provides greater control over remote administrative access.

Skills Demonstrated

Infrastructure Engineering · Windows Server Administration · Network Security · Remote Access Security · RDP Security · Network Segmentation · Firewall Configuration · Group Policy · PowerShell · Security Hardening · Monitoring & Logging

Project Type

Internal / Demonstration Infrastructure Security Project

Completed

March 9, 2023

Project Repository

GitHub:
https://github.com/donval/My-top-repositories

Project Outcome

The project demonstrates how a Bastion Host can be used to create a more controlled remote administration architecture for Windows environments.

It also demonstrates practical experience with Windows infrastructure, network security, remote-access controls, system hardening, firewall configuration, access management, and operational monitoring.

---

Technologies

Windows Server 2022 · Windows 10/11 · RDP · Network Level Authentication · Windows Defender Firewall · Group Policy · PowerShell · Windows Event Viewer · Network Segmentation · DMZ / Management Network

Related GTech Innovators Capabilities

Cloud & AI Engineering
Digital & Cloud Transformation
Infrastructure & Security Engineering