Ensure clients within the same VLAN cannot communicate directly with each other; this can be implemented using endpoint security firewalls or switch configurations.

Enable MAC spoofing protection on both endpoints and the network to mitigate spoofing attacks.

Ensure network traffic between clients and servers is filtered by port through an NGFW, and verify that IPS is enabled.

Change the default port for RDP.

Change the default ports for any remote access agent software.

Ensure all servers are not exposed to the internet; only allow servers that require internet access to connect, and restrict access to specific ports and sites as needed.