Design and hardening of enterprise Windows infrastructures: Active Directory security, Group Policy, Credential Guard, Windows Defender Application Control, privileged access workstations (PAW), tiering model, and segmentation. Includes mitigations against pass-the-hash, Kerberos attacks, lateral movement, and configurations compliant with CIS Benchmarks and Microsoft best practices for complex AD environments.