// VMS SERVER HARDENING · HANS STUDY · ONTARIO, CANADA
VMS server hardening
Most Genetec, Milestone, Avigilon, AXIS, C-CURE, OnGuard, and EntraPass servers are still Windows Server boxes underneath, and they usually get treated as appliances nobody touches once they're running. This hardens the host it runs on against a published baseline, not just the application on top.
What it covers
Windows Server baseline hardening, antivirus and Defender exclusions set correctly for the VMS processes and storage paths, local account and service hygiene, patching position and update configuration, disk and volume layout for recording storage, and backup configuration for the system database.
What you receive
- Hardening applied directly on the server, documented as it's done
- A written baseline to apply to the next server in the same estate
- The antivirus exclusion list and patching settings left in place and recorded
Reference reading
The baseline draws on two published references: the antivirus exclusion list for video management systems and the Windows Server 2025 hardening deltas, for servers on or moving to the newer release. The Genetec Security Center rules and Defender exclusions are also published as an open PowerShell script on GitHub.
Questions
Why harden a VMS server if it's an appliance?
It isn't one. Most Genetec, Milestone, Avigilon, AXIS, C-CURE, OnGuard, and EntraPass servers are Windows Server hosts underneath (confirm for your platform), and they usually get treated as appliances nobody touches once they're running.
What does VMS server hardening cover?
Windows Server baseline hardening, antivirus and Defender exclusions, local account and service hygiene, patching and update configuration, disk and volume layout for recording storage, and backup configuration for the system database. The hardening is applied directly on the server and documented as it's done.
Which antivirus exclusions does a VMS need?
The exclusions are set for the VMS processes and storage paths, then left in place and recorded. The list I work from is published as antivirus exclusions for video management systems.
Is there a script for hardening a Genetec workstation?
Yes. The Genetec Security Center rules and Defender exclusions are published as an open PowerShell script on GitHub.
Can VMS server hardening be done remotely?
Yes. It's delivered remotely, or through the DHD, a remote access device shipped to site.
How is VMS server hardening priced?
Bring the platform, version, and server count to a scoping call. The scope is confirmed there, and a written quote comes before any work starts.
Book a scoping call
Bring the platform, version, and server count and a short call confirms the scope.
Delivered remotely, or through the DHD, a remote access device shipped to site.