If you work with Windows daily, keeping your network healthy is just as important as updating the system itself. A healthy network infrastructure prevents downtime, improves performance, and reduces risks that can lead to lost productivity and, importantly, serious security problems.
In the following lines, you'll find a comprehensive and highly practical guide to network management in Windows environments: from system network and internet settings to security best practices (AAA, service hardening, segmentation) and an example of a Windows server-based architecture with separate email, web, file, and database servers. We'll also integrate modern approaches such as Zero Trust, EDR/XDR, and Microsoft Azure solutions to strengthen operations and compliance.
What does it mean to maintain a healthy network infrastructure in Windows?
A "healthy" network is one characterized by stability, low latency, security, and the ability to scale smoothly. Network maintenance is an ongoing service that reviews hardware, software, performance, and configuration , identifying faults and mitigating risks before they escalate.
Among the benefits are seamless connectivity between devices, improved security against cyber threats, reduced costs (fewer interruptions, fewer duplicated resources), and a more agile user experience. However, there are also challenges: compatibility after updates, scalability, human error, and aging hardware with diminishing support.
A network, ultimately, is nothing more than connected devices that share resources and data. Packets travel following protocols, with switches and routers deciding the optimal route so that all information reliably reaches its destination.
Depending on the scope, you'll see LAN, PAN, MAN, or WAN, each with its own characteristics. Whatever your scenario, it's essential to ensure good connectivity, well-maintained equipment, and adequate response times so that applications run smoothly and users don't experience any issues.
Essential Network and Internet Configuration in Windows
Before we delve into more complex topics, it's a good idea to familiarize yourself with the Network and Internet settings. From here you can manage Wi-Fi, Ethernet, VPN, diagnostics, and connection status , all with a single click.
How to get in and what you'll see
To open Settings, you can do two things: type "Settings" after pressing the Start button and go to "Network & Internet," or right-click the Network/Wi-Fi icon in the taskbar and choose "Network & Internet settings." At the top, you'll see the connection status, which is ideal for a quick check when something isn't working properly.
Find your IP (IPv4) address
- Go to "Network & Internet" and select the connection you are using: Wi-Fi if you're wireless or Ethernet if you're using a cable.
- In Connection Properties, locate the "IPv4 Address" field. There you have the IP address assigned to the device.
Set a data limit
If you're using a metered data plan, Windows can help you stay within your limits. From "Data usage," you can set a limit, receive alerts when you're approaching or exceeding it , and adjust your data usage.
- Go to "Network & Internet" and enter "Data usage" for your current connection.
- Select "Enter limit", define the type (monthly, one-time, etc.), complete the fields and save. Ready to control spending.
Airplane mode: turn it on or off
Airplane mode instantly turns off Wi-Fi, cellular, Bluetooth, and NFC. Use it to cut off communications instantly or save battery power in certain situations.
- From the taskbar, open the quick panel (network/volume/battery) and tap "Airplane mode".
- Or go to "Network & Internet" > "Airplane mode" and toggle the switch. Quick and straightforward.
Create a public or private network
The first time you connect to Windows 11, your profile is set to public by default. This mode hides your PC from the network and limits sharing , which is ideal in most environments.
- Public network (recommended by default)The team is not visible and resources are not shared unintentionally.
- Private networkVisible to other devices and suitable for sharing files and printers; only use it where you fully trust it.
To change this: go to "Network & Internet", choose Wi-Fi (and your connected network) or Ethernet, and under "Network profile type" select Public or Private. This allows you to adjust security and sharing settings for each environment.
TCP/IP and DNS: automatic or manual, and DoH encryption
Whenever possible, rely on the router's DHCP server to assign IP addresses and DNS servers. This saves you trouble when moving your equipment between locations.
- In "Network & Internet", go to Wi-Fi > "Manage known networks" (choose your network) or Ethernet (select your connection).
- Next to "IP Assignment", click "Edit". Choose "Automatic (DHCP)" or "Manual" according to your need.
- If you choose manual configuration, define IP address, subnet mask, gateway, and DNS servers; otherwise, let the router handle it.
For DNS over HTTPS (DoH), you have several options: "Disabled," "Enabled (automatic template)," or "Enabled (manual template)." With DoH, DNS queries are encrypted via HTTPS . Additionally, you can enable or disable "Fallback to plaintext": if enabled, the query will be sent in plaintext if HTTPS is unavailable; if disabled, the query will not be sent.
Once you've adjusted everything, tap "Save". And check that the resolution and connectivity are working as expected.
Windows settings that you should disable when not in use
While useful, some features are best left disabled if you don't need them daily. This reduces the attack surface and prevents unnecessary vulnerabilities.
- Remote Desktop (RDP)If you don't use it, disable it in Settings > System > Remote Desktop. If your credentials fall into the wrong hands, they could gain access to everything.
- File and printer sharingDisable it in Public and Private Networks under Network & Internet > Advanced network settings > Sharing settings. This is the most sensible thing to do outside your trusted network.
- clipboard historyIf you handle sensitive data, turn it off in System > Clipboard. Less trace, less risk.
- Activity historyIn Privacy and security > Activity history, prevent data from being stored and delete what has already been recorded. Improves local privacy.
- Windows Script Host (WSH)If you don't automate with scripts, disable them in the Registry (HKLM\Software\Microsoft\Windows Script Host\Settings > DWORD value "Enabled" to 0). This prevents malicious scripts from running unexpectedly.
- Network discoveryTurn it off in untrusted environments (Network & Internet > Advanced sharing settings). Zero visibility, fewer problems.
- Remote/Fast AssistanceUse it only with people you completely trust and deactivate it in System > About > Advanced system settings > Remote tab.
- Automatic connection to public Wi-FiIn Wi-Fi > Manage known networks, remove "Connect automatically" for old public networks that you no longer control.
Safety and continuous maintenance: best practices, EDR/XDR and Zero Trust
Security isn't a "do it once and forget it" situation. It requires ongoing integrity verification, patching, auditing, and documentation because threats change and environments evolve.
Integrity verification and change control
Check system and package hashes against the original ones from the provider. Checking before and after updating avoids many surprises.Generic example:
verify /sha512 <PATH:filename>
Manage configurations like code: record every modification with purpose, justification, and approval. Compare current configurations with recent backups to detect unauthorized changes and roll back instantly if needed.
File system order and boot
Avoid leaving old images or outdated configurations scattered across network devices. Remove items that are no longer in use:
delete <PATH:filename>
Save permanent changes so they survive unexpected restarts:
copy running-config startup-config. Consistency after a reboot is key to operations.
Update, patch, and review support
Apply stable versions and security patches regularly. Systems with outdated software are vulnerable . Check if your hardware is still supported by the manufacturer and plan for upgrades before it reaches the end of its lifespan.
Centralized and redundant AAA
Controlling who enters, what they can do, and what is logged requires AAA. Implement at least two RADIUS/TACACS+ servers with unique and complex keys and configure devices to use them by default.
Example AAA configuration:
aaa group server radius <GRUPO>
server-private <IP_1> key <CLAVE_1>
server-private <IP_2> key <CLAVE_2>
Local accounts and passwords: strict hygiene
Goodbye to default and shared accounts. Create unique administrative users to ensure traceabilityDisable unnecessary accounts:
no username <NOMBRE>
Store secrets with secure algorithms, never in plain text. Example with robust hash:
username <NOMBRE> algorithm-type sha256 secret <CONTRASEÑA>
It requires long passwords (at least 15 characters), with a variety of characters and no trivial patterns. Do not reuse passwords across devices or accounts , and only change them if there is suspicion or as a reasonable policy.
Remote administration and hardened network services
Disable clear-text administration: goodbye Telnet and HTTP. Use SSH and HTTPS with strong encryption and modern protocol versions.
- SSH v2 required:
ip ssh version 2 - Robust keys: RSA 3072 or ECC 256:
crypto key generate rsa modulus 3072 - HTTPS with TLS 1.2+ on compatible devices:
ip http secure-server - SNMP v3; removes v1/v2c:
no snmp-server community,no snmp-server host. Authentication and encryption or nothing.
Limit administrative access with ACLs to specific sources and apply to VTY lines: access-list 10 permit 192.168.1.0 0.0.0.255 y access-class 10 in. Less surface area, fewer scares.
Configure downtime and keep-alives: ip ssh time-out 300, exec-timeout 5 0, service tcp-keepalives-in, service tcp-keepalives-out. You avoid forgotten sessions and session hijackings.
Reduce lateral movement by disabling overhangs from VTY when they are not needed: line vty 0 4 + transport output none. Blocking is preventing.
Routes and interfaces: default security
Remove source IP routing from the equation: no ip source-route. It's a classic that facilitates MITM attacks and evasions..
Enable uRPF on exposed interfaces: ip verify unicast source reachable-via rx. This is how they stop source IP spoofing.
Authenticates routing protocols: in OSPF with message-digest and in BGP with neighbor password. Only routes from legitimate sources, no "phantom" updates.
router ospf 1
area 0 authentication message-digest
neighbor <IP_VECINO> password <SECRETO>
Disable dynamic trunking and negotiate only what you need: switchport mode access, switchport nonegotiate. Manual control prevents VLAN hopping.
Enables port security: maximum number of MAC addresses, shutdown violations, etc.: switchport port-security, switchport port-security maximum 2, switchport port-security violation shutdown. And close unused ports with a manual "shutdown"..
Deactivate discovery protocols where they don't contribute: no cdp enable. The less information you give away, the better..
Notice and compliance banners
The legal banners inform users of authorized use and that monitoring is in place. They serve as a deterrent and legal supportConfigure them in login and MOTD and save the configuration (
configure terminal, banner login # ... #, write memory). Adjust the text to your regulations and validate with the legal department.
EDR, XDR and extended coverage
Let's face it: 100% prevention is unrealistic. You need active detection and response . Endpoint EDR is powerful, but it doesn't always detect printers, NAS devices, network devices, BYOD, cloud, or IoT. That's where XDR comes in: unified correlation and control across endpoints, network, and cloud to break down silos, plus recovery plans to repair your system after a serious virus.
Note: There's no single definition of XDR, and marketing can create confusion. Start with a well-operated EDR and evolve to XDR where you have the most risk , with a strategy, resources, and prepared analysts. AI and ML help, but they require data, context, and well-governed automation.
Zero Trust and Azure ecosystem
Zero Trust assumes that every request should be verified, regardless of its origin. In Azure, you can orchestrate this with Blueprints, Policy, Defender for Cloud, Sentinel, and Azure Arc , extending controls to hybrid environments.
- Monitoring and alerts: Enables Defender planes (servers, Storage, containers, SQL) and connects signals to Microsoft Sentinel (SIEM/SOAR).
- Application Identities and RBAC: applies directives to label, restrict regions and sizes, and enforce consistent configurations.
- Human access JIT and JEA: temporary privileges, fewer admins with elevated privileges, and SAW (secure workstations) for critical tasks.
- Blocking unauthorized deploymentsAzure Blueprints and Policy as a technical barrier; alerts, webhooks or automation in case of violations.
- SegmentsVNets, peering, NSG/ASG and Azure Firewall to isolate loads and control traffic with granularity.
Step-by-step maintenance in practice
- Music: evaluates architecture, diagrams and documentation; aligns recent changes and maintenance window plan.
- Security: audits firewalls/IPS, updates antimalware, automatically manages patches, and prioritizes critical vulnerabilities.
- Hardware and softwareChecks memory, CPU, disk and logs on servers and routers; validates switch and AP configurations.
- UnlimitedIt analyzes bandwidth and traffic patterns; monitors latency limits and corrects bottlenecks before they cause problems.
- Copies and recovery: verifies backups, performs test restores and adjusts RPO/RTO; without testing, there is no reliable backup.
- Documentation: updates configs, patches and changes; logs incidents, resolution and lessons learned for subsequent iterations.
Windows infrastructure design: a complete example with roles and security
This reference design addresses a typical interview scenario involving email, a public website, file storage, production and test databases (not exposed to the internet), and two applications (client-server and web) with production/test environments. It includes server counts and proposed segmentation.
- Perimeter/DMZ:
- L7/WAF edge firewall (x2 in HA).
- Load balancer (x2 in HA) for public web.
- Reverse proxy/WAF for IIS (optional ARR) (x2).
- Exchange Edge Transport (x1) for SMTP relay and mail sanitization.
- Directory and Management Core:
- AD DS + DNS Domain Controllers (x2).
- DHCP (x2 in failover).
- WSUS/MECM (x1) for patches and software distribution.
- Copy/backup server (x1) Veeam type or equivalent.
- AAA RADIUS/NPS servers (x2) for network devices.
- Email:
- Exchange Server multi-role (x2) in DAG for high availability.
- Edge Transport in the aforementioned DMZ. CAS/OWAs are published via proxy/WAF.
- Public Web (IIS):
- Web servers in DMZ (x2) behind WAF/balancer.
- Static content and segregated public app. Without direct connection to internal databases.
- File storage:
- File servers (x2) in cluster/DFS with quotas and SMB signing/encryption.
- Databases:
- SQL Server Production (x2) in AG/FCI.
- SQL Server Testing (isolated x1-x2). Separate segments, with no internet access.
- Applications:
- Client-server app Prod (x2) and Test (x1) on its own VLAN.
- Internal web app Prod (x2) and Test (x1) behind internal balancer.
- Database connection according to environment, with separate strings and service accounts with minimal privileges. No mixing production and testing.
- Safety and observability:
- EDR/XDR on servers and endpoints.
- SIEM (Microsoft Sentinel in the Cloud) integrated with Defender for Cloud.
Segmentation : VLANs/zones for DMZ, Servers, Management, Users, Testing, and Storage. NSG/ACLs between segments with "deny by default". Microsegmentation for databases and hopping only from authorized application layers.
Security notes : Management protocols only accessible from the management network, MFA/JIT for privileged access, immutable backups, encryption in transit (TLS 1.2+) and at rest, centralized logging and alerting. Scheduled recovery testing and planned DR.
Governance, automation, and data: 10 ideas to leave no loose ends
In addition to technology, a method is needed. Establish clear data governance with owners, administrators, and policies for security, quality, retention, and sharing. Monitor quality and conduct regular audits.
Automate where it hurts : from deployments to monitoring, with open-source scripts and tools and cloud-based AI/ML capabilities for provisioning, data loading, querying, and fault handling. Improve decision speed and reduce manual errors.
Classify and categorize information to better manage risks and access. Maintain metadata and lineage to comply with regulations and understand where each piece of data comes from and where it goes.
It offers layered protection : encryption in transit and at rest, RBAC, up-to-date patches, and ongoing training to combat phishing and social engineering. It defines response protocols to contain and recover as quickly as possible.
Observe and scale : telemetry and alerts to detect anomalies, capacity forecasting, load balancing, and optimized databases (indexes, caching, query tuning). Modernize hardware where you remain on-premises and leverage cloud elasticity where it makes sense.
And don't forget the people: train the team in new technologies (including generative AI, data mesh, RAG and vector data types), and foster communities and training with vendors and user groups.
Quick FAQ
- Why is network maintenance key? Because it guarantees optimal performance, avoids interruptions and protects the infrastructure, keeping operations always running.
- What are the differences between preventive and corrective maintenance? Preventative maintenance is scheduled to avoid failures; corrective maintenance comes into play when an incident occurs and it is necessary to restore service.
- How often? Depending on criticality and use: monthly or quarterly as a preventative measure, with metrics and SLAs in view.
- What indicators should we look at? Availability, number of incidents, MTTR and SLA compliance. If those four are moving in the right direction, you're on the right track..
A well-maintained Windows network infrastructure combines fine-tuning of the system, intelligent segmentation, AAA controls, constant monitoring, and a Zero Trust culture supported by modern tools (EDR/XDR, Azure Policy, Defender, Sentinel). With clear procedures, up-to-date documentation, and good security hygiene, the network remains stable, fast, and much more resilient to attacks and everyday changes.
