Deploy the following servers:

For all servers:

Deploy and configure at least one domain controller. For information about deploying and configuring Active Directory Domain Services (AD DS), see Microsoft's Active Directory Domain Services documentation: Active Directory Domain Services overview

Configure domain controllers to synchronize time using a trusted public time source. For information about configuring time synchronization in Windows, see Microsoft's Windows Time Service documentation: Windows Time service tools and settings

Create a separate administrator account for each individual IT administrator. For information about managing privileged administrator accounts, see Microsoft's Privileged Access Accounts documentation: Privileged access: Accounts

Configure a password policy that enforces a minimum password length and eliminates periodic forced password rotation, in accordance with NIST SP 800-63B Section 5.1.1:  NIST SP 800-63B. For information about configuring password policies in Active Directory, see Microsoft's Fine-Grained Password Policies documentation: Configure fine-grained password policies for Active Directory Domain Services

Ensure Active Directory domain authentication is based on Kerberos. For information about Kerberos authentication in Active Directory, see Microsoft's Kerberos Authentication Overview documentation: Kerberos authentication overview in Windows Server

Join all servers and client computers running XProtect Corporate components to the Active Directory domain. For information about joining computers to an Active Directory domain, see Microsoft's domain join documentation: Join a computer to a domain

Restrict local and Remote Desktop (RDP) logon access on XProtect Corporate servers to authorized IT administrators only. For information about configuring Remote Desktop logon permissions, see Microsoft's security policy documentation: Allow log on through Remote Desktop Services and Deny log on through Remote Desktop Services

Issue certificates to all servers running the IT environment and XProtect Corporate components. For information about deploying and managing Active Directory Certificate Services (AD CS), see Microsoft's Active Directory Certificate Services documentation: What is Active Directory Certificate Services?

Automatically enroll and deploy certificates to domain-joined systems. For information about certificate auto-enrollment, see Microsoft's Active Directory Certificate Services documentation: Configure auto-enrollment of certificates for Network Policy Server

Automatically renew certificates before expiration. For information about certificate renewal and auto-enrollment, see Microsoft's Active Directory Certificate Services documentation: Configure auto-enrollment of certificates for Network Policy Server

Revoke certificates that are no longer trusted or required. For information about certificate revocation, see Microsoft's Active Directory Certificate Services documentation: PKI design considerations using Active Directory Certificate Services

Configure issued certificates with a validity period of one year. For information about certificate templates and certificate validity periods, see Microsoft's Active Directory Certificate Services documentation: Certificate templates concepts

X.509 v3 certificate

Key usage: Digital Signature and Key Encipherment

Enhanced Key Usage (EKU): Server Authentication (1.3.6.1.5.5.7.3.1)

Key size: RSA 2048 bits or higher

Hash algorithm: SHA-256 or stronger

Private key: non-exportable

Subject Alternative Name (SAN): must include the FQDN of the server

Restrict SQL Server administrative access to authorized IT administrators only. For information about SQL Server administrative roles and permissions, see Microsoft's SQL Server security documentation: Server-level roles

Use Windows Integrated Authentication for production deployments. For information about SQL Server authentication modes, see Microsoft's SQL Server authentication documentation: Choose an authentication mode

Configure encrypted SQL Server communications using certificates issued by the organizational PKI. For information about configuring encrypted SQL Server communications, see Microsoft's SQL Server encryption documentation: Encrypt connections to SQL Server by importing a certificate

Apply Microsoft security updates when available. For information about SQL Server servicing and updates, see Microsoft's SQL Server documentation: Install SQL Server servicing updates