Hardened workstation images disable RDP, but weeks later drift re-enables it on several clerk PCs. Which mitigation keeps the secure baseline from eroding?

Configuration enforcement uses ongoing policy, management tooling, and hardened image practices to detect and correct drift that reintroduces risky services such as RDP. One-time documentation, unmanaged local-admin changes, and user memory alone do not sustain the secure baseline.