GRC Engineering Academy logogrceng.academy
YAML lab 50 bonus XP

Write the firm's Windows baseline

Start labRead the room

Objectives

Agree the Windows baseline before distributing settings through Group Policy. Fill in YAML Ain't Markup Language (YAML), a structured text format. Use booleans, true or false values, for switches. Use numbers for counts and sizes.

A manager asks to keep SMBv1 on "for the old scanner". The requirements say it must be off, so leave that request for an approved exception, not the baseline.

Agreed requirements

Minimum password length: 14.
Lock the account after: 5 failed attempts.
Unique, rotating local admin passwords (LAPS): on.
SMBv1: off.
BitLocker on laptops: on, recovery key stored in the directory.
Firewall: on for the domain, private and public profiles.
Security log: at least 1024 MB, forwarded to the central log store.

Checks the server runs (6)

  • Set password length and lockout
  • Unique local admin passwords
  • Turn off SMBv1
  • Encrypt laptops and store the key safely
  • Firewall on for every profile
  • Big enough log, forwarded

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Accounts first

    Enter the required password length and lockout counts. Enable LAPS. Done means both numbers and the switch match. Do not quote booleans.

    Set password length and lockoutUnique local admin passwords

  2. Step 2

    Remove the old protocol

    Set SMBv1 to false. Done means the outdated protocol is disabled in the baseline. Do not include an unapproved scanner exception.

    Turn off SMBv1

  3. Step 3

    Protect the device

    Enable BitLocker, set the recovery key location and list all three firewall profiles. Done means all requirements match. Do not omit the public profile.

    Encrypt laptops and store the key safelyFirewall on for every profile

  4. Step 4

    Keep the story

    Enter the required Security log size in MB and enable forwarding. Done means size and forwarding both match. Do not enter gigabytes in a megabyte field.

    Big enough log, forwarded

Rules summary

  • XP on pass

    50 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 13 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.