Lab 09 Windows Security Assessment

Mission Overview

Welcome to Lab 09 — Windows Security Assessment.

In Lab 08, you assessed the security posture of an authorized Linux host.

Now you will apply the same structured methodology to a Windows system.

A Windows host may appear secure from the network while still containing weaknesses such as excessive local privileges, unnecessary services, weak NTFS permissions, insecure shares, exposed remote administration, insufficient endpoint protection, risky scheduled tasks, or poor logging.

Mission Goal: Perform a structured security assessment of an authorized Windows training system, identify host-level weaknesses, verify defensive controls, prioritize findings, and produce a Windows Security Assessment Report.

Mission Information

Item	Details
Difficulty	Beginner–Intermediate
Estimated Time	90–120 minutes
Primary Skill	Windows Security Assessment
Secondary Skill	Windows Hardening Analysis
Environment	Authorized Windows Training VM
Testing Type	Host-Level Security Review
Primary Outcome	Windows Security Findings Register
Evidence Required	Command output + screenshots + configuration evidence
Safety Level	Authorized Lab Only

Learning Objectives

By completing this lab, you will be able to:

identify Windows operating-system information
identify local users and groups
review local administrator membership
understand User Account Control
identify running processes
review Windows services
identify listening ports
review Windows Firewall
examine NTFS permissions
assess shared folders
review scheduled tasks
understand PowerShell security considerations
review Windows Defender status
inspect Windows Event Logs
review remote administration exposure
understand Windows Update and patch status
identify unnecessary software and services
document Windows security findings
recommend practical remediation

Windows Security Assessment Methodology

Use:

Host → Identity → Privilege → Process → Service → Filesystem → Security Controls → Logging → Patch → Finding

Conceptually:

Windows Host
     ↓
System Profile
     ↓
Users & Groups
     ↓
Administrative Privileges
     ↓
Processes & Services
     ↓
Network Exposure
     ↓
Filesystem & Shares
     ↓
Security Controls
     ↓
Logs & Monitoring
     ↓
Patch Status
     ↓
Risk Analysis

Lab Architecture

Example:

                  GHC Ethical Hacking Lab
                      192.168.56.0/24
                             │
                        Kali Linux
                             │
                             ▼
                    Windows Training VM
                     192.168.56.40
                             │
          ┌──────────────────┼──────────────────┐
          │                  │                  │
          ▼                  ▼                  ▼
       Identity           Services          Security
          │                  │                  │
          ▼                  ▼                  ▼
      Privileges        Network Ports      Defender/Logs

For this lab, use a dedicated Windows training account supplied with the environment.

Part 1 — Confirm Scope

Record:

Target:

Windows IP:

Authorized Account:

Account Type:

Assessment Start:

Administrative Access:
Yes / No

Configuration Changes:
Not permitted unless explicitly instructed

Excluded Systems:

This lab is primarily a security assessment, not a host-compromise exercise.

Part 2 — Create the Workspace

Create:

Ethical-Hacking-Labs/
└── Lab-09/
    ├── Notes/
    ├── Evidence/
    │   ├── System/
    │   ├── Identity/
    │   ├── Privilege/
    │   ├── Services/
    │   ├── Network/
    │   ├── Filesystem/
    │   ├── Firewall/
    │   ├── Defender/
    │   ├── Logs/
    │   └── Patching/
    ├── Screenshots/
    ├── Findings/
    └── Report/

Create:

Lab-09-Investigation-Journal.md

Use:

# Lab 09 — Windows Security Assessment

## Mission Objective

## Scope

## System Profile

## Users and Groups

## Administrative Privileges

## UAC

## Running Processes

## Services

## Listening Ports

## Windows Firewall

## NTFS Permissions

## Shared Folders

## Scheduled Tasks

## PowerShell Security

## Windows Defender

## Remote Administration

## Event Logs

## Patch Status

## Findings

## Evidence

## Recommendations

## Lessons Learned

Part 3 — Identify the Current User

Open PowerShell or Command Prompt.

Run:

whoami

Then:

whoami /groups

Record:

Username:

Domain or Computer:

Important Groups:

Administrative Membership:

This establishes the identity context of your assessment.

Part 4 — Determine Whether the Session Is Elevated

Open PowerShell and observe whether it is running as administrator.

You can also inspect group membership:

whoami /groups

Look for administrative groups such as:

BUILTIN\Administrators

Do not assume membership automatically means every process is running elevated because Windows uses User Account Control.

Part 5 — Identify Windows Version

Run:

Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber, OsArchitecture

Alternatively:

systeminfo

Record:

Item	Value
Windows Edition
Version
Build
Architecture
Hostname

Part 6 — Identify the Hostname

Run:

hostname

or:

$env:COMPUTERNAME

Record:

Hostname:

IP:

Operating System:

Current User:

Part 7 — Review Network Configuration

Run:

ipconfig /all

Record only the information relevant to the lab:

IPv4 Address:

Subnet Mask:

Default Gateway:

DNS Servers:

Network Adapter:

Compare this information with the network map from Lab 03.

Part 8 — Build the Windows System Profile

Create:

Item	Observation
Hostname
Windows Version
Build
Architecture
IP
Current User
Domain/Workgroup

This becomes your assessment baseline.

Part 9 — Review Local Users

Use:

Get-LocalUser

or:

net user

Record relevant training accounts.

Example:

Account	Enabled	Purpose	Review
Administrator	Yes/No	Built-in admin	Review
lab-user	Yes	Training user	Expected
guest	Disabled	Built-in guest	Positive

Do not assume every Windows account belongs to a real person.

Part 10 — Inspect a Specific Local User

For an authorized training account:

Get-LocalUser -Name "lab-user"

Record:

Enabled:

Password Required:

Password Last Set:

Account Expires:

Notes:

Do not modify the account.

Part 11 — Review Local Groups

Run:

Get-LocalGroup

Important groups may include:

Administrators

Remote Desktop Users

Remote Management Users

Users

Backup Operators

Group membership can significantly affect system privileges.

Part 12 — Review Local Administrators

Run:

Get-LocalGroupMember -Group "Administrators"

Create:

Account	Type	Expected	Review
Administrator	Local User	Yes	Expected
lab-admin	Local User	Yes	Expected
lab-user	Local User	No	Investigate

Ask:

Does each account genuinely require local administrative rights?

Part 13 — Understand Least Privilege

Compare:

Standard User
      ↓
Daily Work

with:

Administrator
      ↓
Elevated System Control

Routine users generally should not receive administrative privileges unless required.

An unnecessary administrator account increases the impact of credential compromise.

Part 14 — Understand User Account Control

User Account Control — UAC helps separate normal user activity from elevated administrative actions.

Conceptually:

Administrator Account
        ↓
Normal User Context
        ↓
Elevation Requested
        ↓
UAC Approval
        ↓
Elevated Context

UAC is not a replacement for proper privilege management.

It is an additional control.

Part 15 — Review UAC Configuration

Where permitted, inspect UAC-related settings through:

Control Panel
    ↓
User Accounts
    ↓
Change User Account Control Settings

Document the configured level.

Do not reduce UAC protection.

Record:

UAC Enabled:

Prompt Level:

Security Relevance:

Part 16 — Review Running Processes

Use:

Get-Process

or Task Manager.

Look for:

system processes
application processes
security software
unexpected training applications

Create:

Process	Purpose	Expected
explorer	User shell	Yes
application service	Training app	Yes
unknown process	Unknown	Review

Do not terminate processes during the assessment.

Part 17 — Review Windows Services

Run:

Get-Service

Focus on running services:

Get-Service | Where-Object {$_.Status -eq "Running"}

Ask:

Is the service required?

Does it expose the network?

Does it run automatically?

Does it run with high privilege?

Is it part of the intended host role?

Part 18 — Inspect an Important Service

For example:

Get-Service -Name WinRM

or another service discovered in your lab.

Record:

Service:

Status:

Startup Type:

Purpose:

Expected:

Security Relevance:

Part 19 — Review Service Startup Configuration

Use:

Get-CimInstance Win32_Service |
Select-Object Name, State, StartMode, StartName

This allows you to compare:

service name
current state
startup behavior
service account

Services running with highly privileged identities deserve additional scrutiny.

Part 20 — Understand Service Accounts

Windows services may run as identities such as:

LocalSystem

LocalService

NetworkService

Dedicated service account

Ask:

Does this service run with more privilege than necessary?

A compromised service running as LocalSystem has greater potential impact than one running under a restricted service identity.

Part 21 — Review Listening Ports

Use:

Get-NetTCPConnection -State Listen

or:

netstat -ano

Record:

Local Address	Port	State
0.0.0.0	3389	Listen
0.0.0.0	445	Listen
127.0.0.1	8080	Listen

Compare this with your Nmap results from Lab 04.

Part 22 — Correlate PID to Process

If you identify a listening PID:

Get-Process -Id <PID>

Use the actual PID from your lab.

This provides:

Port
 ↓
PID
 ↓
Process
 ↓
Service/Application

This is host-side service validation.

Part 23 — Understand Listening Addresses

Compare:

127.0.0.1:8080

with:

0.0.0.0:8080

A loopback-bound service generally has much less network exposure.

A service listening on all interfaces may be reachable through the network depending on firewall controls.

Part 24 — Compare Host vs Network Evidence

Example:

Windows Host

3389 listening

Nmap

3389 filtered

Possible explanation:

Service Running
      +
Firewall Restriction
      =
Not Reachable from Kali

This demonstrates why local and remote evidence should be correlated.

Part 25 — Review Windows Firewall

Use:

Get-NetFirewallProfile

Record the state of:

Domain

Private

Public

Example:

Profile	Enabled
Domain	True
Private	True
Public	True

A disabled firewall profile deserves investigation.

Part 26 — Review Firewall Rules

You do not need to analyze thousands of rules.

Focus on services identified during your assessment.

For example:

Get-NetFirewallRule -Enabled True |
Select-Object DisplayName, Direction, Action, Profile

Ask:

Is inbound access explicitly required?
Is the rule too broad?
Which profile applies?
Is administrative access restricted?

Do not change the rule.

Part 27 — Build a Network Exposure Matrix

Create:

Service	Listening	Firewall Allowed	Remote Scan	Final Exposure
SMB	Yes	Yes	Open	Exposed
RDP	Yes	Restricted	Filtered	Restricted
App	Localhost	N/A	Not visible	Local only

This is much stronger evidence than relying on Nmap alone.

Part 28 — Review NTFS Permissions

Windows uses NTFS Access Control Lists to determine access to files and directories.

For a lab-provided directory:

Get-Acl C:\LabData

or:

icacls C:\LabData

Use only authorized training locations.

Part 29 — Understand Common NTFS Permissions

Typical rights include:

Full Control

Modify

Read & Execute

Read

Write

Ask:

Who can modify this resource?

Write or Modify access is particularly important when the directory contains:

application files
scripts
configuration
sensitive data

Part 30 — Review a Training Application Directory

For example:

icacls C:\GHC-Lab\App

Record:

Owner:

Administrators:

Users:

Write Access:

Modify Access:

Unexpected Principals:

Do not change permissions.

Part 31 — Understand Inheritance

Windows permissions may be inherited from parent folders.

Conceptually:

C:\
 ↓
Parent Folder
 ↓
Child Folder
 ↓
Inherited Permissions

An overly broad permission at a parent directory may affect many child resources.

Part 32 — Review Sensitive Configuration Files

Within an approved lab application directory, identify configuration files.

Examples could include:

web.config

application configuration

backup configuration

training credential file

Review only permissions and necessary training content.

Do not expose secrets in screenshots or reports.

Redact values.

Part 33 — Review Windows Shares

Use:

Get-SmbShare

or:

net share

You may see administrative shares such as:

C$

ADMIN$

IPC$

These are normal on many Windows systems and should not automatically be reported as vulnerabilities.

Part 34 — Identify Custom Shares

Look for lab-specific shares.

Example:

Share	Path	Purpose	Expected
LabShare	C:\LabData	Training	Yes
Backups	C:\Backups	Backup	Review

Custom shares deserve closer access-control review.

Use:

Get-SmbShareAccess -Name "LabShare"

Use the actual authorized share.

Record:

Principal:

AccessControlType:

AccessRight:

Expected:

Remember:

Effective access depends on both SMB share permissions and NTFS permissions.

Conceptually:

SMB Share Permission
        +
NTFS Permission
        ↓
Effective File Access

A secure share should have both layers configured appropriately.

Part 37 — Review Remote Desktop

Determine whether Remote Desktop is enabled in your training environment.

You can inspect the relevant Windows Settings interface.

Record:

RDP Enabled:

RDP Port:

Authorized Users:

Network Exposure:

MFA:
If applicable

Security Relevance:

Do not attempt credential guessing.

Part 38 — Review Remote Desktop Users

Run:

Get-LocalGroupMember -Group "Remote Desktop Users"

Assess whether every member requires remote access.

An account should not receive RDP access merely because it exists.

Part 39 — Review WinRM

Windows Remote Management may support remote administration.

Check:

Get-Service WinRM

Record:

WinRM Running:

Startup:

Required:

Network Exposure:

Authorized Administrators:

Again, presence does not automatically equal vulnerability.

Part 40 — Review Scheduled Tasks

Use:

Get-ScheduledTask

or:

schtasks /query

Focus on lab or custom tasks rather than analyzing every standard Microsoft task.

Part 41 — Analyze Scheduled Task Security

For a custom training task, ask:

What account runs it?

Does it run with highest privileges?

What executable or script does it start?

Who can modify that script?

Who can modify the directory?

Is the task necessary?

A privileged scheduled task referencing a broadly writable script is a serious configuration concern.

Do not exploit it.

Part 42 — Build a Scheduled Task Register

Example:

Task	Runs As	Elevated	Executable	Writable by User	Review
Backup	SYSTEM	Yes	backup.ps1	No	Expected
LabTask	Admin	Yes	lab.ps1	Review	High

Part 43 — Review PowerShell Version

Run:

$PSVersionTable

Record:

PowerShell Version:

Edition:

OS:

PowerShell is a legitimate administration platform but is also important from a security-monitoring perspective.

Part 44 — Review PowerShell Execution Policy

Run:

Get-ExecutionPolicy -List

Record the result.

Important:

Execution Policy is not intended to be a complete security boundary.

Do not report a permissive value as automatic system compromise.

Consider it in the overall administrative-security context.

Part 45 — Review PowerShell Logging Awareness

Enterprise environments may configure:

Script Block Logging
Module Logging
Transcription
centralized event collection

For this lab, determine whether enhanced PowerShell logging is configured if the environment exposes that information.

Do not change policy.

Part 46 — Review Windows Defender

Run:

Get-MpComputerStatus

where Microsoft Defender is present.

Focus on information such as:

Antivirus Enabled

Real-Time Protection

Behavior Monitoring

Signature Status

Record:

Control	Status
Antivirus
Real-Time Protection
Behavior Monitoring
Definitions

Part 47 — Do Not Disable Security Controls

During the lab, do not:

Disable Defender

Add exclusions

Stop security services

Disable firewall

Clear logs

A penetration-test assessment should not weaken security controls without explicit authorization and operational justification.

Part 48 — Review Defender Updates

Where available, Get-MpComputerStatus may show security intelligence update information.

Ask:

Are definitions current?

Is protection active?

Is the endpoint reporting healthy?

An enabled security product with outdated definitions may not provide expected protection.

Part 49 — Review Windows Event Logs

Open:

Event Viewer

or use PowerShell.

Important log categories include:

Security

System

Application

Your lab may also contain:

PowerShell

Windows Defender

Remote Desktop

events.

Part 50 — Review Your Own Authentication Activity

Use Event Viewer to identify events generated during Lab 07.

Look for your own:

successful login
failed login
logout
administrative activity

Do not investigate unrelated user activity unnecessarily.

Part 51 — Understand Important Security Events

You do not need to memorize every Event ID.

The objective is to understand event categories such as:

Authentication Success

Authentication Failure

Account Changes

Privilege Use

Process Activity

Security Control Events

SOC analysts later correlate these events into incident timelines.

Part 52 — Query Recent Security Events

Where administrative permissions allow:

Get-WinEvent -LogName Security -MaxEvents 20

Review the structure:

TimeCreated

Id

Level

Provider

Message

Do not dump unnecessary quantities of logs.

Part 53 — Review System Events

Use:

Get-WinEvent -LogName System -MaxEvents 20

Look for:

service events
system changes
errors
relevant training activity

The purpose is to assess whether useful telemetry exists.

Part 54 — Evaluate Logging Capability

Ask:

Are authentication events recorded?

Are administrative events available?

Are security-control events visible?

Are timestamps reliable?

Are logs protected?

Is log retention adequate?

Are logs forwarded centrally?

Logging is essential for incident response and forensic investigation.

Part 55 — Review Audit Policy

Where authorized:

auditpol /get /category:*

This displays configured Windows auditing categories.

Do not change them.

Review whether important activity is audited.

Part 56 — Review Time Configuration

Accurate time is important for logs.

Run:

w32tm /query /status

or review Windows time settings.

Record:

Time Source:

Synchronization:

Time Zone:

Poor time synchronization can make event correlation significantly harder.

Part 57 — Review Windows Update Status

Use Windows Update through:

Settings
  ↓
Windows Update

Record:

Last Update:

Pending Updates:

Restart Required:

Update Status:

Do not install patches unless instructed.

Part 58 — Review Installed Updates

One available method is:

Get-HotFix

Record relevant information rather than every update.

The important question is:

Is the host supported and appropriately patched for its role?

Part 59 — Avoid Simple Build-Number Assumptions

Do not conclude:

Old-looking build
   =
Vulnerable

Evaluate:

support status
cumulative updates
installed patches
vendor security guidance
vulnerability applicability

This follows the same validation principle used in Labs 06 and 08.

Part 60 — Review Installed Software

Depending on the environment, use:

Settings
  ↓
Apps
  ↓
Installed Apps

Focus on:

unexpected server applications
outdated training software
unnecessary remote-access tools
unnecessary services

Do not uninstall anything.

Part 61 — Compare Software to Host Role

Example:

Host Role:
Employee Workstation

Observed:
Web Server
FTP Server
Database Server

This deserves investigation.

Unnecessary software:

increases attack surface
+
requires patching
+
creates configuration burden
+
creates monitoring burden

Part 62 — Review Guest Account

Check:

Get-LocalUser -Name "Guest"

where present.

In many environments, the built-in Guest account should remain disabled unless there is an explicit requirement.

Record:

Guest Enabled:

Requirement:

Security Relevance:

Part 63 — Review Built-in Administrator

Check the built-in Administrator account.

Ask:

Is it enabled?

Is its use controlled?

Is a separate named administrative account used?

Is activity monitored?

Do not change it.

Part 64 — Review Password Policy

Use:

net accounts

This may show:

Minimum password length

Maximum password age

Minimum password age

Password history

Lockout threshold

Record the policy.

Part 65 — Compare Password Policy with Lab 07

Correlate:

Lab 07
Authentication Behavior
      +
Lab 09
Host Password Policy
      =
Stronger Authentication Assessment

For example:

Observed weak training password
+
Minimum password length too low
=
Configuration explanation

Part 66 — Review Account Lockout Policy

From:

net accounts

observe:

Lockout threshold

Lockout duration

Lockout observation window

Do not trigger additional lockouts unless specifically authorized.

Part 67 — Build the Windows Security Control Matrix

Create:

Security Area	Status	Evidence	Priority
Local Users	Review	Get-LocalUser	Medium
Administrators	Review	Group membership	High
UAC	Enabled	Settings	Medium
Services	Review	Get-Service	High
Firewall	Enabled	Firewall profile	High
NTFS	Review	ACLs	High
SMB Shares	Review	Get-SmbShare	High
Defender	Enabled	Defender status	High
Logging	Enabled	Event Logs	High
Updates	Review	Windows Update	High

Part 68 — Record Positive Controls

Document controls that work correctly.

Examples:

Guest account disabled.

Standard user not in Administrators.

UAC enabled.

Windows Firewall enabled.

Defender real-time protection enabled.

Sensitive directory permissions restricted.

RDP restricted.

Security auditing enabled.

System is current with approved updates.

A professional assessment is not only a list of problems.

Part 69 — Finding Example: Excessive Administrator Rights

Finding:
Standard user assigned unnecessary local administrative privileges.

Asset:
Windows Training VM

Observation:
The training account is a member of the local Administrators
group despite its standard-user role.

Impact:
Compromise of the account could provide significantly greater
control over the Windows endpoint.

Recommendation:
Remove unnecessary administrative membership and use controlled
privilege elevation for administrative tasks.

Part 70 — Finding Example: Broad NTFS Permissions

Finding:
Application directory has overly broad modification permissions.

Observation:
Standard users can modify files within a directory used by the
training application.

Impact:
Unauthorized modification could affect application integrity
or expose configuration information.

Recommendation:
Restrict Modify and Write permissions to identities that
require them.

Part 71 — Finding Example: Unnecessary Remote Administration

Finding:
Remote administration service increases host attack surface.

Observation:
RDP is enabled and reachable from a broader network segment than
required for the host's intended role.

Impact:
The host exposes an additional authentication surface that may
be targeted if user credentials are compromised.

Recommendation:
Restrict RDP to approved administrative networks and users,
apply strong authentication, and monitor remote access.

Part 72 — Finding Example: Endpoint Protection Disabled

Finding:
Endpoint real-time protection is disabled.

Observation:
The Windows endpoint does not currently have expected real-time
malware protection enabled.

Impact:
Malicious files and suspicious behavior may have reduced
prevention and detection coverage.

Recommendation:
Enable and centrally manage approved endpoint protection and
monitor protection health.

Part 73 — Finding Example: Logging Gap

Finding:
Insufficient security auditing reduces investigation visibility.

Observation:
Important authentication or administrative activity is not
covered by the configured audit policy.

Impact:
Security incidents may be more difficult to detect,
investigate, and reconstruct.

Recommendation:
Enable appropriate Windows auditing and forward relevant events
to centralized monitoring.

Part 74 — Build the Findings Register

Example:

ID	Area	Observation	Severity	Confidence	Recommendation
WIN-01	Privilege	User is local admin	High	Confirmed	Least privilege
WIN-02	NTFS	Broad Modify rights	High	Confirmed	Restrict ACL
WIN-03	RDP	Broad exposure	Medium	Confirmed	Restrict access
WIN-04	Defender	Enabled	Positive	Confirmed	Maintain
WIN-05	Logging	Audit enabled	Positive	Confirmed	Maintain

Part 75 — Prioritize Findings

Use:

Privilege + Exposure + Asset Importance + Control Weakness + Potential Impact

Example:

Administrative User
        +
Weak Authentication
        +
RDP Exposure
        +
No MFA
        =
Higher Identity Risk

Findings should also be correlated with previous labs.

Part 76 — Build the Windows Attack-Surface Map

Example:

                      Windows Host
                           │
       ┌───────────────────┼────────────────────┐
       │                   │                    │
       ▼                   ▼                    ▼
    Identity             Network             Files
       │                   │                    │
 ┌─────┼─────┐       ┌─────┼─────┐       ┌─────┼─────┐
 │     │     │       │     │     │       │     │     │
User Admin  RDP     SMB   RDP  WinRM    ACLs Shares Config
       │                   │                    │
       └───────────────────┼────────────────────┘
                           ▼
                     Windows Risk

This helps prepare for later attack-path analysis.

Part 77 — Evidence Requirements

Capture:

Evidence 01

Windows system profile.

Evidence 02

Current user and groups.

Evidence 03

Local user inventory.

Evidence 04

Local Administrators membership.

Evidence 05

UAC configuration.

Evidence 06

Running processes.

Evidence 07

Running services.

Evidence 08

Listening ports.

Evidence 09

Windows Firewall status.

Evidence 10

Relevant firewall rules.

Evidence 11

NTFS permissions.

Evidence 12

SMB shares and share permissions.

Evidence 13

Scheduled tasks.

Evidence 14

PowerShell configuration observations.

Evidence 15

Defender status.

Evidence 16

Relevant Windows Event Logs.

Evidence 17

Audit policy.

Evidence 18

Patch/update status.

Evidence 19

Final Windows Security Findings Register.

Part 78 — Mission Challenge

Answer:

Windows Edition:

Build:

Hostname:

Current User:

Local Administrators:

Unexpected Administrator Accounts:

Guest Account:

UAC Enabled:

Running Services:

Unexpected Services:

Listening Ports:

Externally Reachable Services:

Windows Firewall:

RDP Enabled:

RDP Authorized Users:

WinRM Enabled:

Custom SMB Shares:

Broad Share Permissions:

Broad NTFS Permissions:

Privileged Scheduled Tasks:

Defender Enabled:

Real-Time Protection:

Security Logging:

Audit Policy:

Pending Updates:

Highest-Risk Finding:

Strongest Security Control:

Top Remediation Priority:

Support every answer with evidence.

Part 79 — What Not to Do

This lab does not require:

Password dumping

Credential extraction

Registry credential harvesting

Privilege escalation

UAC bypass

Disabling Defender

Firewall manipulation

Persistence

Scheduled-task modification

SAM database extraction

Deleting logs

Exploitation frameworks

The objective is to assess the Windows host’s security posture, not take control of it.

Part 80 — Troubleshooting

`Get-LocalUser` Is Not Available

Some Windows editions or PowerShell environments may not expose the module.

Use:

net user

and document the tooling limitation.

Access Denied

This may be expected for a standard account.

Record:

Resource:

Access:
Denied

Account:

Interpretation:
Privilege boundary operating as expected.

Do not bypass the restriction.

`Get-MpComputerStatus` Fails

The system may use:

another endpoint-security product
a Windows edition without Defender
restricted permissions

Document what can actually be verified.

Security Log Is Inaccessible

This may indicate appropriate privilege separation.

Do not circumvent it.

Nmap and Windows Show Different Ports

Check:

Listening interface

Firewall

Protocol

Scan source

Service state

Time of assessment

Differences are often useful evidence rather than errors.

Mission Deliverables

Complete:

scope confirmed
Windows system profile documented
current identity reviewed
local users reviewed
local groups reviewed
local Administrators assessed
UAC reviewed
processes reviewed
services reviewed
listening ports reviewed
network results correlated
Windows Firewall assessed
NTFS permissions reviewed
SMB shares reviewed
scheduled tasks reviewed
PowerShell security observations documented
Defender status reviewed
RDP/WinRM exposure assessed
Windows Event Logs reviewed
audit policy reviewed
patch status assessed
positive controls documented
Windows Security Findings Register completed
remediation priorities established
final report completed

Lab Report Template

# Lab 09 — Windows Security Assessment

## Executive Summary

## Mission Objective

## Scope

## Windows System Profile

## Users and Groups

## Administrative Privilege Assessment

## User Account Control

## Running Processes

## Windows Services

## Network Exposure

## Windows Firewall

## NTFS Security

## SMB Shares

## Scheduled Tasks

## PowerShell Security

## Endpoint Protection

## Remote Administration

## Windows Event Logging

## Audit Policy

## Patch and Update Status

## Positive Security Controls

## Security Findings

## Risk Prioritization

## Recommendations

## Evidence

## Limitations

## Lessons Learned

## Conclusion

Knowledge Check

Question 1 — Why review the local Administrators group?

Because membership provides substantial control over the Windows system and should be limited according to least privilege.

Question 2 — What is UAC?

User Account Control helps separate ordinary activity from actions requiring administrative elevation.

Question 3 — Does an open RDP port automatically mean the host is vulnerable?

No.

You must evaluate authentication, network restrictions, authorized users, patching, MFA, and business requirements.

Question 4 — Why review both NTFS and SMB permissions?

Because effective network file access depends on both the share permissions and underlying filesystem permissions.

Question 5 — Why compare `Get-NetTCPConnection` with Nmap?

The local command shows services listening on the Windows host, while Nmap shows which of those services can actually be reached from the assessment workstation.

Question 6 — Is a running service automatically a vulnerability?

No.

Determine whether it is required, properly configured, patched, restricted, and monitored.

Question 7 — Why is Defender status security-relevant?

Endpoint protection provides prevention and detection capabilities that can materially reduce risk from malicious activity.

Question 8 — Why review scheduled tasks?

Privileged scheduled tasks can create serious risk when the executed files or scripts are writable by lower-privileged users.

Question 9 — Why are Windows Event Logs important?

They provide evidence of authentication, process, system, security-control, and administrative activity required for monitoring and incident investigation.

Skills Achieved

After completing this lab, you should understand:

Windows system profiling
Windows local users and groups
local administrator analysis
least privilege
UAC concepts
Windows process assessment
Windows service assessment
listening-port analysis
host vs network exposure
Windows Firewall
NTFS security
SMB share permissions
scheduled-task security
PowerShell security concepts
Defender health assessment
remote administration assessment
Windows Event Logs
audit-policy concepts
Windows patch analysis
finding prioritization
Windows hardening recommendations
professional host reporting

Professional Takeaway

A Windows security assessment is not:

“Find something exploitable on the machine.”

A professional assessor asks:

“Who has administrative control, what services are running, what is reachable, who can modify sensitive resources, how is remote administration protected, which defensive controls are active, what evidence is recorded, and where can the host be hardened?”

Use:

Host → Identity → Privilege → Process → Service → Network → Filesystem → Controls → Logs → Patch → Risk

This gives you a repeatable Windows host-assessment methodology that works across workstations, servers, enterprise environments, and certification labs.

What’s Next?

➡️ Lab 10 — Web Application Reconnaissance

In the next lab, you will move from host-level assessment into the web application layer.

You will learn how to map an authorized web application before testing its security controls.

You will identify:

application pages
technologies
endpoints
authentication areas
forms
parameters
cookies
headers
client-side resources
APIs
hidden application functionality
trust boundaries

The methodology becomes:

Application → Content → Endpoint → Input → Authentication → Session → Technology → Attack Surface → Evidence

By the end of Lab 10, you should be able to answer:

“What functionality does this web application expose, where does it accept input, which areas require authentication, and what should be assessed in the next stage?”

Lab 09 Windows Security Assessment

Mission Overview

Mission Information

Learning Objectives

Windows Security Assessment Methodology

Lab Architecture

Part 1 — Confirm Scope

Part 2 — Create the Workspace

Part 3 — Identify the Current User

Part 4 — Determine Whether the Session Is Elevated

Part 5 — Identify Windows Version

Part 6 — Identify the Hostname

Part 7 — Review Network Configuration

Part 8 — Build the Windows System Profile

Part 9 — Review Local Users

Part 10 — Inspect a Specific Local User

Part 11 — Review Local Groups

Part 12 — Review Local Administrators

Part 13 — Understand Least Privilege

Part 14 — Understand User Account Control

Part 15 — Review UAC Configuration

Part 16 — Review Running Processes

Part 17 — Review Windows Services

Part 18 — Inspect an Important Service

Part 19 — Review Service Startup Configuration

Part 20 — Understand Service Accounts

Part 21 — Review Listening Ports

Part 22 — Correlate PID to Process

Part 23 — Understand Listening Addresses

Part 24 — Compare Host vs Network Evidence

Windows Host

Nmap

Part 25 — Review Windows Firewall

Part 26 — Review Firewall Rules

Part 27 — Build a Network Exposure Matrix

Part 28 — Review NTFS Permissions

Part 29 — Understand Common NTFS Permissions

Part 30 — Review a Training Application Directory

Part 31 — Understand Inheritance

Part 32 — Review Sensitive Configuration Files

Part 33 — Review Windows Shares

Part 34 — Identify Custom Shares

Part 35 — Review SMB Share Permissions

Part 36 — Understand Share + NTFS Permissions

Part 37 — Review Remote Desktop

Part 38 — Review Remote Desktop Users

Part 39 — Review WinRM

Part 40 — Review Scheduled Tasks

Part 41 — Analyze Scheduled Task Security

Part 42 — Build a Scheduled Task Register

Part 43 — Review PowerShell Version

Part 44 — Review PowerShell Execution Policy

Part 45 — Review PowerShell Logging Awareness

Part 46 — Review Windows Defender

Part 47 — Do Not Disable Security Controls

Part 48 — Review Defender Updates

Part 49 — Review Windows Event Logs

Part 50 — Review Your Own Authentication Activity

Part 51 — Understand Important Security Events

Part 52 — Query Recent Security Events

Part 53 — Review System Events

Part 54 — Evaluate Logging Capability

Part 55 — Review Audit Policy

Part 56 — Review Time Configuration

Part 57 — Review Windows Update Status

Part 58 — Review Installed Updates

Part 59 — Avoid Simple Build-Number Assumptions

Part 60 — Review Installed Software

Part 61 — Compare Software to Host Role

Part 62 — Review Guest Account

Part 63 — Review Built-in Administrator

Part 64 — Review Password Policy

Part 65 — Compare Password Policy with Lab 07

Part 66 — Review Account Lockout Policy

Part 67 — Build the Windows Security Control Matrix

Part 68 — Record Positive Controls

Part 69 — Finding Example: Excessive Administrator Rights

Part 70 — Finding Example: Broad NTFS Permissions

Part 71 — Finding Example: Unnecessary Remote Administration

Part 72 — Finding Example: Endpoint Protection Disabled

`Get-LocalUser` Is Not Available

`Get-MpComputerStatus` Fails

Question 5 — Why compare `Get-NetTCPConnection` with Nmap?