Review the firm's Windows evidence

Objectives

Tomas's assistant drafted six statements for the client. Accept only the ones that are true and backed by the evidence described. Reject the rest and pick the single root problem.

Reason codes: excess-access means someone has more rights than they should. Sample-only means the proof covers only some machines when the claim is about all. Wrong-evidence means the proof does not show what is claimed. Log-risk means logs could be lost or erased.

Verdicts are accept or reject. Every rejection needs one reason code from: excess-access | sample-only | wrong-evidence | log-risk.

WN-1 | The Finance share is secure. Its permission list includes Everyone: Full control.
WN-2 | All 55 laptops are encrypted. Proof: screenshots of BitLocker status from 5 laptops.
WN-3 | Password policy is enforced: the GPO report for the domain shows minimum length 14 and lockout after 5 attempts, linked to all user OUs.
WN-4 | Admin changes are monitored: Event ID 4624 events are collected for every server.
WN-5 | Security logs are kept on each server only, and are set to overwrite when full.
WN-6 | A dated PowerShell export of local Administrators from all servers is attached; no unexpected accounts remain after the contractor was removed.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the request before the artefact

   Judge each statement on its own, comparing the claim with its proof.

2. Step 2

   Judge every line, including the boring ones

   Give every statement a verdict.

   Every line in the fixture carries a verdict

3. Step 3

   Separate what is wrong from what is merely ugly

   Accept statements whose proof is complete, current and shows exactly what is claimed.

   Accept and reject land on the right lines

4. Step 4

   Say why, in the vocabulary the programme uses

   For each rejection pick the one reason code that names the real problem.

   Each rejection cites a valid reason code

Rules summary

• XP on pass

  50 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 13 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.