A customer planned to implement a Windows security hardening change that included:

• Adding the server to Active Directory security groups
• Disabling weak SSH protocols and ciphers
• Running gpupdate /force
• Rebooting the server

The customer wanted to understand whether these changes could impact MOVEit Transfer operations and whether adding the server to Active Directory security groups could affect external users.

The customer reviewed several days of SFTP logs and reported that no users were authenticating with SHA-1-based algorithms.

Before implementing the security hardening changes:

1. Confirm the scope of the change with the infrastructure team to determine whether TLS/Schannel settings are also affected.
2. Review MOVEit Transfer logs, including SFTP logs, for evidence of SHA-1 or legacy algorithm usage.
3. Verify that modern SSH algorithms and host key settings are enabled.
4. Identify trading partners and integrations that may rely on deprecated cryptographic algorithms.
5. Perform testing in a non-production environment when possible.
6. Create a backup or snapshot before applying the change.
7. After implementation, validate:
   • Inbound SFTP connectivity
   • Outbound SFTP tasks
   • HTTPS web portal access
   • FTPS communications
   • AS2 workflows

Adding the MOVEit Transfer server or service account to Active Directory security groups alone should not affect external users. External users authenticate to MOVEit Transfer (or the configured authentication source) and do not rely on the Active Directory group membership of the server object itself. As long as Active Directory communication remains functional, external access should not be impacted.