1 The Challenge
A small business switching IT providers asked us to review their existing server as part of onboarding, standard practice for any new client, and often where the most surprising findings turn up, since nobody has looked closely at the configuration in years.
The server had been in production for roughly six years, set up by a previous provider who was no longer reachable, with no documentation of what had been configured or why.
2 Our Assessment
The review found a server that had drifted a long way from any reasonable baseline, mostly through years of accumulated shortcuts rather than any single bad decision:
- The operating system was two major versions behind and no longer receiving security updates
- A local administrator account with a password that hadn’t been changed since initial setup, shared informally among several staff
- Remote desktop enabled and reachable from the internal network with no additional access controls, and reachable from a wider IP range than intended due to a misconfigured firewall rule
- No centralized logging, security-relevant events existed only in local logs that rotated out after a few days
- Backups running to an external drive kept in the same room as the server, with no offsite or cloud copy
- Several services running with default configurations, including a database service exposed on the network with a default administrative password still in place
3 The Solution
None of these issues were unusual on their own, what made the server risky was how many had accumulated without anyone reviewing the whole picture at once. The hardening work addressed them as a set rather than one at a time:
- Upgraded the operating system to a supported version and brought it fully current on patches, then scheduled ongoing patch management
- Reset all administrative credentials, assigned individual accounts instead of a shared login, and enforced MFA
- Restricted remote desktop access to a VPN-only path with logging enabled, removing the internet-facing exposure entirely
- Deployed centralized log collection with alerting on privileged account activity and failed login patterns
- Set up automated backups to an offsite location, independent of the server room, with a verified restore schedule
- Reviewed every running service, disabled what wasn’t needed, and changed every default credential still in place
4 The Result
The server moved from an unsupported, internet-reachable, single-point-of-failure configuration to a patched, access-controlled, logged, and properly backed-up system within about two weeks, without requiring new hardware or significant downtime, since almost all of the work was configuration rather than replacement.
5 Business Impact
None of what this assessment found was the result of a single bad decision, it was six years of small shortcuts and deferred maintenance compounding quietly, which is exactly the pattern we see most often when picking up a server from a previous provider. The business had been operating this way for years without incident, which is a matter of luck rather than security, and is the kind of exposure that only gets found through a deliberate review rather than day-to-day use.
If you’ve inherited infrastructure from a previous provider, or aren’t certain when your server configuration was last actually reviewed rather than just kept running, that’s worth checking before something forces the question. Our Security Configuration and Server Installation teams handle exactly this kind of assessment and clean-up.