Look after Windows like an admin: registry, UAC, Active Directory, Group Policy, NTFS, updates, PowerShell, Defender, BitLocker and event logs, then Hyper-V, virtualization based security, tiered admin, remote access and application control, each tied to a control you can prove.
120 min 500 XPSkills: Active Directory, Group Policy, NTFS permissions, Windows event logs, Hyper-V, Privileged access
What you'll be able to do
›Manage Windows local accounts, UAC, and administrative rights
›Apply Active Directory Group Policy and update ring settings
›Review NTFS permissions, Defender, firewall, and BitLocker configuration
›Inspect Windows event logs and map baseline settings to controls
›Secure a Hyper-V host, separate admin tiers, and allow-list applications
Brief
Imagine a client asking a firm to prove its doors are locked before signing a contract. Tomas faces the same request for computers.
Database server identifier (SQL01). File server identifier (FS01). He manages a 60-person accounting firm with 55 Windows laptops, file server FS01 and database server SQL01.
They belong to one domain, a centrally managed collection of accounts and computers. The client wants evidence that systems are well managed.
Follow Tomas through settings, administrator access, shared policies, file access, updates, protective tools and event logs, which record system activity.
On Windows, most good security is a setting pushed from one place. Your job is to know which settings matter and how to prove they are really applied.
1. Inside Windows: the registry
Think of a filing cabinet for computer settings. The Windows registry is a database arranged into keys, folder-like containers holding values.
Registry Editor, opened with regedit, lets you inspect it. Avoid manual edits unless you understand the setting and have a recovery plan.
HKEY_LOCAL_MACHINE (HKLM) holds computer-wide settings. It includes the Security Account Manager (SAM), the local account database, and SECURITY data.
HKEY_CURRENT_USER (HKCU) holds settings for the currently signed-in user. Many security policies are represented by registry values.
System registry branch (SYSTEM). The example shows RunAsPPL = 1 at HKLM\SYSTEM\CurrentControlSet\Control\Lsa. Protected Process Light (PPL) limits access to sensitive processes.
Local Security Authority (LSA) protection helps protect sign-in secrets from theft tools. A registry value is useful evidence of configured intent.
Where activation or restart matters, also verify the protection is running. Configuration alone does not always prove an active safeguard.
Most Windows security settings end up as a value somewhere in the registry.
2. Local accounts, UAC and admin rights
Think of keeping a master key separate from your everyday keys. Windows distinguishes ordinary work from actions requiring administrator rights.
Each machine has local accounts, which belong to that machine, including a built-in Administrator. The local Administrators group has extensive control.
Administrators can install software and change protections. They can usually obtain access to files, although encryption and other controls can impose limits.
User Account Control (UAC) asks before many actions receive elevated, or increased, rights. Under typical settings, administrators receive two access tokens.
A token records identity and permissions. Ordinary programs use the filtered token. Approved elevated programs use the administrator token.
UAC reduces accidental elevation, but it is not a strong security boundary for an administrator account. Approving a malicious program can grant extensive control.
Use standard accounts for daily work. Use separate administrator accounts only for administrative tasks. Disabling UAC weakens protection and commonly creates an audit finding.
UAC gives admins two passes and only hands over the powerful one after a prompt.
3. Active Directory and Group Policy
Think of a central staff directory instead of separate lists in every office. Active Directory (AD) centrally stores accounts, computers and groups.
Domain controllers are servers providing directory and sign-in services. This firm's domain is corp.example.
Organisational units (OUs) are directory containers used to organise accounts and computers. Examples are Finance, information technology (IT) and Servers.
Groups such as Finance-Readers collect members so access can be assigned to a group instead of separately to each person.
Group Policy distributes settings. A Group Policy Object (GPO) bundles rules, such as minimum password length or enabling a firewall.
Linking a GPO to an OU targets relevant users or computers there. Filtering, inheritance and policy precedence affect what actually applies.
Policies refresh regularly, often restoring managed settings after local changes. A linked policy shows intent; reports of applied settings provide stronger evidence.
Domain Admins is a highly privileged group with broad domain control. Keep membership small and review it regularly.
Do not use these privileged accounts for email or web browsing. Those everyday activities expose powerful credentials to unnecessary risk.
Link a policy to an OU and everything inside gets the settings automatically.
4. NTFS permissions and file shares
Think of needing permission at both a building entrance and an office door. Network file access has two permission layers.
New Technology File System (NTFS) permissions control access to files and folders. Permissions include Read, Modify and Full control.
Inheritance copies applicable permissions from parent folders to children. It simplifies management but can spread excessive access.
Share permissions add another layer for network access. Effective access must satisfy both layers. Read at the share limits NTFS Modify to reading.
Tomas sees Finance-Readers with Read, Human Resources (HR) with Modify, and Everyone with Full control. Everyone grants dangerously broad rights.
These rights can allow changes or deletion if other access layers permit them. Guest access depends on configuration, not this entry alone.
Inherited rights can reach Payroll and salaries.xlsx. Remove unnecessary Everyone access and grant only approved groups.
Keep dated permission exports before and after changes. icacls and Get-Acl can report permissions; Get-Acl retrieves access control lists (ACLs).
Inheritance spreads a mistake: Everyone Full control on the top folder reaches every file below.
5. Patching with update rings
Imagine testing new shop equipment in one branch before replacing it everywhere. Update rings install patches in controlled waves.
A patch fixes software problems, including security weaknesses. Microsoft releases many security updates on the second Tuesday monthly, often called Patch Tuesday.
Urgent fixes may arrive outside that schedule. Installing everywhere immediately risks widespread disruption if an update causes trouble.
In this example, ring 0 uses IT test machines on day 0. Ring 1 uses a pilot group, about 10 percent, on day 3.
Ring 2 reaches remaining staff on day 7. Ring 3 covers critical servers after change approval, shown as day 10 in the figure.
Pause deployment if the pilot fails. Keep the ring policy, a report of update coverage and reasons for machines that are behind.
A claim that updates happen is not enough. A dated report showing 97 percent current within 14 days provides measurable evidence.
Patch in waves so a bad update stops at the pilot, not the whole firm.
6. Services, scheduled tasks and PowerShell
Think of a cleaner working after hours and a timer switching lights on. Services run background work; scheduled tasks run when specified conditions occur.
Attackers can misuse either to restart malicious software after reboot. Review new or unnecessary entries.
PowerShell is a command shell and scripting language for administration. It collects repeatable evidence that can be saved in dated reports.
Get-LocalGroupMember Administrators lists local administrator group members. Get-Service reports service status; startup configuration may require additional properties or commands.
Get-ScheduledTask lists scheduled tasks. Get-HotFix lists certain installed updates, not every possible update type. Check coverage before claiming complete patch compliance.
Corporate domain name (CORP). Tomas finds CORP\temp.contractor in FS01's local Administrators group two months after the contractor left. This is excessive access that needs removal.
The Print Spooler service also runs on a server that never prints. It manages printing and has been targeted by attackers.
Check dependencies, then disable it if unnecessary. Collect consistent, dated reports across all machines in scope, not just one example.
Three PowerShell commands, two findings: a leftover contractor admin and an unneeded service.
7. Defender, firewall and BitLocker
Think of protecting a shop with a door guard, an alarm and a safe. Windows needs several protection layers working together.
Windows Firewall filters network traffic. Enable its Domain, Private and Public profiles, which select rules according to network classification.
Domain applies when a domain network is authenticated. Private marks trusted networks. Public suits untrusted locations, such as cafés, and should be restrictive.
Microsoft Defender Antivirus detects malicious software. Enable real-time scanning and tamper protection, which limits unauthorised changes but cannot prevent every attempt.
BitLocker encrypts disk volumes, making stored data unreadable without appropriate unlocking information. It protects a lost laptop's data when the device is secured.
It does not protect files already accessible in an unlocked session. Keep its recovery key, an emergency unlocking secret, safely in the directory or management tool.
IT must be able to retrieve it when needed. Do not leave it on a sticky note beside the device.
Keep an enforced policy and device reports covering firewall, antivirus and BitLocker on every machine. One unencrypted laptop still creates exposure.
Firewall, antivirus and disk encryption: three layers, all on, on every machine.
8. Event logs that matter
Think of numbered entries in a building security diary. Windows event logs record activity, and Event Viewer displays those records.
The Security log supports governance, risk and compliance (GRC), the work of overseeing safeguards, risks and obligations.
An event identifier (ID) is a number describing the event type. Event 4624 records a successful sign-in. Event 4625 records a failed sign-in.
Repeated 4625 events may indicate password guessing. Event 4720 records creation of a user account.
Event 4732 records adding a member to a local security group, including Administrators. Check which group changed before calling it administrator access.
Event 1102 records clearing the Security log. Investigate promptly; it can signal attempts to hide activity, although authorised clearing is also possible.
To show administrator changes are monitored, collect relevant 4732 events centrally and demonstrate alerts. A sign-in event alone does not prove this.
Forward logs off the machine. Size the Security log to avoid rapid overwriting. Synchronise clocks so records from different computers can be compared.
Five Event IDs tell most of the story: sign-ins, failures, new users, new admins and cleared logs.
9. A Windows baseline mapped to controls
Think of an inspection checklist shared by every office. A baseline records required settings for each type of Windows machine.
Start with public security baselines, adapt them and distribute applicable settings through Group Policy. Map each requirement to a control and proof.
A control is a safeguard addressing risk. Minimum passwords of 14 characters and lockout after five failed attempts support authentication, checking identity.
Use applied policy reports as evidence. Local Administrator Password Solution (LAPS) manages different, rotating local administrator passwords for each machine.
This supports privileged access control by limiting password reuse. One stolen local password should not unlock every machine.
Server Message Block version 1 (SMBv1) is an outdated network file-sharing protocol associated with serious vulnerabilities and ransomware attacks. Disable it.
This supports configuration management. BitLocker on laptops supports data protection. A forwarded Security log supports monitoring and preserves evidence away from the machine.
The example requires a one-gigabyte (GB) log, expressed as 1024 megabytes (MB) in the lab. Storage labels can use different conventions.
Tomas finds SMBv1 enabled somewhere and missing log forwarding. Track both fixes with commands or reports that verify the result.
A short baseline, mapped to controls, turns red rows into a fix list with proof.
Part 2, 10. Virtualization with Hyper-V
Think of one big house split into flats. Each flat has its own door, but they share one set of walls and foundations.
A virtual machine (VM) is a whole computer made of software. Hyper-V is the hypervisor built into Windows Server that runs many VMs on one host.
Tomas moves FS01 and SQL01 onto a new host, Hyper-V server 01 (HV01). Whoever controls HV01 now controls both servers.
A virtual switch connects VMs to networks. External reaches the real network, Internal reaches only the host, and Private links VMs only to each other.
Generation 2 VMs start like modern computers. They support Secure Boot, which only loads trusted start up code.
They also support a virtual Trusted Platform Module (TPM), a security chip in software. BitLocker inside the VM can use it.
A checkpoint saves a VM's state so you can roll back. It is stored next to the VM, so it is not a backup.
Keep HV01 itself minimal: no web browsing, no extra roles, and admin accounts used only for the host.
Generation 2, the right switch type, and checkpoints kept in their place.
Part 2, 11. Virtualization based security
Think of a bank that keeps its most valuable items in a vault inside the building. Even staff in the main hall cannot open it.
Virtualization based security (VBS) uses the hypervisor to make a walled-off area of memory that normal Windows cannot read.
Credential Guard stores sign-in secrets in that area. A tool that reads memory finds nothing useful to steal.
Memory integrity, also called hypervisor-protected code integrity (HVCI), checks that drivers and kernel code are trusted before they run.
Both need hardware support and Secure Boot. Switch them on through Group Policy or device management, then confirm they are running.
For evidence, msinfo32 lists virtualization based security services running. Get-CimInstance Win32_DeviceGuard shows the same from PowerShell.
The hypervisor builds a wall that even the system's own kernel cannot climb.
Part 2, 12. Windows Server roles
Think of a shop worker who should only hold the keys for their own job. Extra keys only add risk.
A role is a main job a server does, such as File Server, Domain Name System (DNS) or Dynamic Host Configuration Protocol (DHCP).
DNS turns names into addresses. DHCP hands out addresses to devices. Each role adds services, open ports and things to patch.
Install only the roles a server needs. FS01 needs File Server; the DNS and Print roles found on it have no owner.
Get-WindowsFeature | Where Installed lists installed roles and features. Compare the list with what the server is for.
Server Core is a version of Windows Server with no desktop. Fewer parts means fewer patches and less for an attacker to use.
Installed but not needed: each red row is a finding.
Part 2, 13. Privileged access: tiers and separate accounts
Think of a bank: the vault key never leaves the vault room, and nobody carries it to lunch.
The tiered admin model splits systems by how much damage they could do. Tier 0 is identity: domain controllers and the systems that manage them.
Tier 1 is servers. Tier 2 is laptops and the people who use them.
An admin gets a separate account per tier, such as t0-anna, t1-anna and anna for daily work. Higher tier accounts never sign in to lower tier machines.
Why? A laptop that reads email and browses the web is the easiest machine to break into. A Tier 0 sign-in left there hands over the domain.
Add Tier 0 accounts to the Protected Users group. It blocks weaker sign-in methods and stops secrets being cached.
Keep Domain Admins nearly empty. Grant smaller rights for smaller jobs, which is called just enough administration.
One person, three accounts, and the top one never touches a laptop.
Part 2, 14. Remote management
Think of a service hatch on a building. Useful for staff, dangerous if strangers can reach it.
PowerShell remoting lets an admin run commands on another machine. Enter-PSSession -ComputerName FS01 opens a remote prompt.
It uses Windows Remote Management (WinRM). Limit it to admin accounts and the management network.
Remote Desktop Protocol (RDP) shows a full remote screen on port 3389. Never expose it to the whole internet.
Network Level Authentication (NLA) makes the user prove who they are before a session opens. The registry value UserAuthentication = 1 shows it is on.
Allow RDP only from the management network, or through a gateway with multi-factor authentication (MFA).
For evidence, export the firewall rules for Remote Desktop and WinRM, with their allowed sources and profiles.
Prove the setting and the firewall rule, not just the intention.
Part 2, 15. Application control and script logging
Think of a guest list at the door. If your name is not on it, you do not get in, however friendly you look.
Antivirus tries to spot bad programs. Application control does the opposite: it only allows programs you approved.
AppLocker and the newer App Control for Business can allow programs by publisher signature, by folder such as Program Files, or by file hash.
A program dropped into Downloads, such as invoice.exe, is then blocked. So is an unsigned script.
PowerShell script block logging records the content of each script that runs, as Event ID 4104. Investigators can then see what an attack did.
Constrained language mode limits what PowerShell can do for normal users. Start with audit mode, then enforce once the list is right.
Allow the known good, block the rest, and record every script.
Part 2, 16. Backup and recovery on Windows
Think of saving a document twice: once on your desk and once in a safe across town.
Volume Shadow Copy Service (VSS) makes quick copies on the same server. Users can bring back a deleted file in seconds.
Shadow copies sit on the same disk, and ransomware often deletes them first. They help with mistakes, not disasters.
Real backups go to separate storage. Keep at least one copy offline or immutable, which means it cannot be changed or deleted for a set time.
A domain controller backup must include system state, the directory database and its settings. Without it you cannot rebuild the domain.
Test a restore every quarter and record the date, what was restored and how long it took.
Quick undo, real copy, safe copy, proven restore.
Part 2, 17. Cloud-joined devices and compliance policies
Think of a club that checks your membership card and your dress code before you go in.
Many firms now connect laptops to a cloud directory as well as the office one. This is called hybrid join.
A device management service then pushes settings and checks each laptop against a compliance policy.
The policy might require BitLocker on, firewall on, a recent update and Defender running.
Conditional access uses the result. A laptop that fails the check can be blocked from email until it is fixed.
For evidence, export the compliance report for every device, not a screenshot of one. Unknown devices are findings too.
The device has to pass the check before it gets the data.
Part 2, 18. Collect the evidence with PowerShell
Think of a pilot's pre-flight checklist. The same checks, in the same order, every time.
Tomas writes a read-only PowerShell script. It changes nothing; it only reads and saves.
Get-LocalGroupMember Administrators shows who has admin rights. Get-BitLockerVolume shows encryption status.
Get-NetFirewallProfile shows whether each profile is on. Get-HotFix shows the latest installed updates.
Export-Csv saves each result with the server name and date in the file name, ready for the auditor.
Run it on a schedule across every server. Failed checks become findings with an owner and due date.
Read-only commands an auditor can rerun and get the same answer.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: Everyone means everyone
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
The Finance share has Everyone: Full control at the top folder. Tomas notices the Payroll subfolder and salaries.xlsx have the same entry even though nobody set it there.
Term bank, not all of these are right
everyoneinheritanceadministratorsreplication
1.1Which group entry should be removed from the folder? (one word)
1.2What Windows behaviour copied the entry into the subfolder? (one word)
Task 2: The contractor who never left
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
PowerShell output on FS01 shows CORP\temp.contractor in the local Administrators group, two months after the contract ended. The security team wants to know whether anyone added the account recently.
Term bank, not all of these are right
get-localgroupmember4732get-service4624
2.1Which PowerShell command lists members of a local group? (one word, starting with Get)
2.2Which Event ID records a user being added to a local security group? (a number)
Task 3: One policy to rule them all
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
Tomas wants every server to get the same password and firewall settings, and to have them put back automatically if someone changes them locally. All servers sit in the same folder in Active Directory.
Term bank, not all of these are right
gpoouuacsam
3.1What does he create to bundle and push the settings? (three letters)
3.2What type of Active Directory folder does he link it to? (two letters)
Task 4: The laptop on the train
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
A partner leaves a laptop on a train. The device report shows its disk was not encrypted. Tomas wants every laptop encrypted, with the unlock key kept somewhere IT can reach.
Term bank, not all of these are right
bitlockerdirectorydefenderdesktop
4.1Which built-in Windows feature encrypts the whole disk? (one word)
4.2Where should the recovery key be stored? (one word)
Task 5: The silent night
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
After a weekend, SQL01's Security log starts on Sunday at 03:12 with a single entry. Before that there is nothing at all. On Friday night the log shows dozens of failed sign-ins for the same account.
Term bank, not all of these are right
1102462546244720
5.1Which Event ID means the Security log was cleared? (a number)
5.2Which Event ID records a failed sign-in? (a number)
Task 6: The undo button that was not a backup
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
HV01's storage fails. The ticket says SQL01 is "backed up daily", but the daily copies were saved states stored next to the VM. Also, SQL01 is an older VM type that cannot use Secure Boot or a virtual TPM.
Term bank, not all of these are right
checkpoint2backup1
6.1What does Hyper-V call these saved VM states? (one word)
6.2Which VM generation supports Secure Boot and a virtual TPM? (a number)
Task 7: The domain admin who checked the news
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
Tomas uses his Domain Admins account for everything, including email and web browsing on his laptop. A malicious advert infects the laptop and the attacker copies his sign-in from memory. Within an hour they control the domain controllers.
Term bank, not all of these are right
0protected users2domain users
7.1In the tiered admin model, which tier holds the domain controllers? (a number)
7.2Which built-in group gives its members extra sign-in protection? (two words)
Task 8: Remote Desktop for the whole world
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
An internet scan shows FS01 answering Remote Desktop to anyone. The sign-in screen appears before the server checks who is connecting, so attackers can reach it without any account.
Term bank, not all of these are right
nla3389uac445
8.1Which Remote Desktop setting checks the user before a session starts? (three letters)
8.2Which port does Remote Desktop use by default? (a number)
Task 9: The secrets left in plain memory
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
A test shows a common attack tool can read sign-in secrets straight out of a laptop's memory. The laptops have the hardware for hypervisor protection, but nobody turned it on.
Term bank, not all of these are right
credential guardvbsbitlockeruac
9.1Which feature keeps sign-in secrets in isolated memory? (two words)
9.2What is the three-letter short name for the hypervisor-backed protection it is part of? (three letters)
Task 10: The invoice that was a program
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
A staff member runs invoice.exe from the Downloads folder, and it starts an unsigned PowerShell script. Nothing stopped it, and the logs only show that PowerShell started, not what the script did.
Term bank, not all of these are right
applockerscript blockdefendertranscript
10.1Which built-in Windows tool can allow only approved programs and scripts? (one word)
10.2Which PowerShell logging records the content of every script that runs? (two words)
Labs
150 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
Agree the Windows baseline before distributing settings through Group Policy. Fill in YAML Ain't Markup Language (YAML), a structured text format. Use booleans, true or false values, for switches. Use numbers for counts and sizes.
A manager asks to keep SMBv1 on "for the old scanner". The requirements say it must be off, so leave that request for an approved exception, not the baseline.
Agreed requirements
Minimum password length: 14.
Lock the account after: 5 failed attempts.
Unique, rotating local admin passwords (LAPS): on.
SMBv1: off.
BitLocker on laptops: on, recovery key stored in the directory.
Firewall: on for the domain, private and public profiles.
Security log: at least 1024 MB, forwarded to the central log store.
Tomas's assistant drafted six statements for the client. Accept only the ones that are true and backed by the evidence described. Reject the rest and pick the single root problem.
Reason codes: excess-access means someone has more rights than they should. Sample-only means the proof covers only some machines when the claim is about all. Wrong-evidence means the proof does not show what is claimed. Log-risk means logs could be lost or erased.
Verdicts are accept or reject. Every rejection needs one reason code from: excess-access | sample-only | wrong-evidence | log-risk.
Statements for the client
WN-1 | The Finance share is secure. Its permission list includes Everyone: Full control.
WN-2 | All 55 laptops are encrypted. Proof: screenshots of BitLocker status from 5 laptops.
WN-3 | Password policy is enforced: the GPO report for the domain shows minimum length 14 and lockout after 5 attempts, linked to all user OUs.
WN-4 | Admin changes are monitored: Event ID 4624 events are collected for every server.
WN-5 | Security logs are kept on each server only, and are set to overwrite when full.
WN-6 | A dated PowerShell export of local Administrators from all servers is attached; no unexpected accounts remain after the contractor was removed.
Tomas is moving FS01 and SQL01 onto a new Hyper-V host, HV01. Write HV01's baseline as YAML before he builds anything.
A consultant suggests opening Remote Desktop to the internet "so we can fix things from home". The requirements say management network only, so do not follow that advice.
Agreed requirements for HV01
Virtual machines: generation 2, with Secure Boot and a virtual TPM switched on.
Credential Guard and memory integrity: on.
Remote Desktop: Network Level Authentication required. Allowed only from 10.0.8.0/24.
PowerShell script block logging: on.
Checkpoints: never counted as backups.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
Checks
Generation 2 with Secure Boot and virtual TPM
Credential Guard and memory integrity on
Remote Desktop only from the management network
Record every PowerShell script
Checkpoints are not backups
Next on your path · IT Fundamentals
Git and Pipelines
Follow a change from local Git history through review and a safe, evidence-backed pipeline deployment.
