Skip to content
Home » Help Center » Prixl Warden guides » Run the security audit and apply fixes

Run the security audit and apply fixes

What you will do

Read the results of Warden’s security audit on the Hardening tab, apply the safe fixes, decide carefully about the risky ones, and learn how to undo a fix. The audit runs 29 checks covering Remote Desktop, the Windows Firewall, risky ports (3389, 445, 5985, 5986 and 1433), account and password policy, SMBv1, Microsoft Defender, how recently Windows Update ran, and audit and PowerShell logging. 21 of the checks have a one-click fix, and every applied fix can be reverted.

Time: about 15 minutes. You need: the dashboard open (see Open the dashboard); a paid plan to apply fixes; for risky fixes, a second way into the server that does not depend on Remote Desktop.

On the free trial the audit is view-only. You see every check and its result, and the tab shows “View only – upgrade your plan to apply fixes.” instead of the apply button. Use the results as a to-do list, or see the pricing page to apply fixes from the dashboard.

Read your results

  1. Click the Hardening tab. The strip at the top shows your “Hardening Score” out of 100 and the two steps: “1 Select” and “2 Review & Apply”.
  1. Scroll through the sections, in this order: “Failing – Safe Fixes”, “Failing – Risky Fixes (use caution)”, “Passing”, “Not Auto-Fixable” and “Previously Applied”.
  2. Each card has a PASS, WARN or FAIL badge, a short description, a “?” with more detail, and a Learn more → link to a plain-English article.
  3. Click Refresh at any time to run the checks again.

Apply safe fixes

Safe fixes change Windows settings that normally do not affect how staff connect, for example “NLA Required”, the three Windows Firewall profiles, “Account Lockout”, “Min Password Length”, “Guest Account”, “SMBv1”, “Audit Logon Policy”, “PS Script Block Logging” and the password history, age and complexity settings.

  1. Click Select All Safe, or tick only the cards you want under “Failing – Safe Fixes”. The line next to the buttons shows how many runs and fixes you have left today.
  2. Some cards open to show the “Current” and “Configured” values and a Set value list. Choose the value you want; the “Effect” and “Caution” lines say what will change.
  1. The “SMB Internet Exposure” and “WinRM Internet Exposure” cards have a Restrict mode list: “LAN only (no Guard access)” or “LAN + Guard”. “LAN + Guard” is available only after at least one Secure Access device has been set up.
  1. Click Review Selected →.
  2. Step 2 shows each fix with its Current, Expected and Selected Value, what the fix does (“Fix”), its “Effect” and any “Caution”. Read them. Click ← Back to change your selection.
  3. Click Accept & Apply.

About passwords: Warden’s audit flags a minimum length under 10; we recommend 15. The “Min Password Length” fix offers 8, 10, 12 or 14, so choose 14 and encourage staff to use longer passphrases.

About lockout: the “Account Lockout” fix makes Windows lock an account after repeated wrong passwords. If Remote Desktop on this server is open to the internet, attackers can use lockout to lock your staff out by guessing on purpose. That is one more reason to close Remote Desktop to the internet with Secure Access.

Risky fixes: read before you click

The section “Failing – Risky Fixes (use caution)” holds five fixes: “RDP Port”, “Port 445 Open”, “Port 5985 Open”, “Port 5986 Open” and “Port 1433 Open”. They change how other computers reach the server, so a wrong choice can cut off staff, software or your IT vendor. On the review step they carry the warning “This fix may affect system behavior – review carefully.”

  • Before applying any of them, make sure you can still get into the server another way: your cloud provider’s console, the server’s remote management card, or someone at the keyboard.
  • Port 445 is Windows file sharing, 5985 and 5986 are Windows remote management, and 1433 is Microsoft SQL Server. Ask your IT vendor whether anyone reaches these from outside the office before you change them. Read the “Fix” and “Effect” lines on the review step: they say exactly what will change.
  • “RDP Port” moves Remote Desktop to a new, randomly chosen port. Its caution reads: “Existing RDP sessions will disconnect. Note the new port number”. Write the new number down before you click, and update your router’s port forward and every staff member’s Remote Desktop connection. Changing the port only cuts down log noise; it does not close Remote Desktop. The real fix is locking Remote Desktop to Secure Access or allowing only known addresses.
  • To put Remote Desktop back on its usual port, use Reset to 3389 on the “RDP Port” card of the Overview tab.

Undo a fix

  1. Scroll down to “Previously Applied”. Each fix shows when it was applied, the previous value and the new value.
  2. Click Revert next to the fix and confirm. The setting goes back to its previous value.
  1. A reverted fix shows “Reverted” with the time, and a Re-apply button if you change your mind.

If your licence has expired and the dashboard has paused other changes, reverting a fix still works. Uninstalling Warden does not undo password, lockout, SMBv1 or audit policy changes: revert them first if you want them gone.

What Warden leaves to you

Some checks have no fix button because the change needs a human decision. The card tells you what to do by hand:

  • “RDP Enabled”, “RDP Inbound”, “Local Admin Count”, “Windows Defender”, “Windows Updates” and “Account Password Expiry Overrides”.
  • “RDP Internet Exposure” is fixed from the Secure Access tab with the switch Lock RDP to Secure Access only. Follow Lock Remote Desktop to Secure Access only so you do not lock yourself out.

Check it worked

  • The fixes you applied now appear under “Previously Applied”, and the “Hardening Score” has gone up.
  • Click Refresh: the checks you fixed show PASS.
  • Every alert recipient gets an email “[Prixl Warden] Security Hardening Applied” naming the device (and “Security Fix Reverted” for a revert).

If something goes wrong

  • Remote Desktop stopped working after an “RDP Port” fix: connect on the new port number shown in the fix, or use the server’s console, then click Reset to 3389 on the Overview tab or Revert the fix.
  • No Accept & Apply button: you are on the trial, where the audit is view-only.
  • A policy you switched off in Windows came back on: Warden turns its required audit policies back on and emails you when it does. This is by design.
  • More answers in Troubleshooting Warden.

Next

Previous: Open the dashboard and find your way around. Next: Block attackers: manual blocks, auto-block and trusted IPs. Back to Prixl Warden guides.