Lab 02 — Endpoint Security

Endpoints are where users interact with:

Email

Applications

Corporate Data

Cloud Services

Credentials

Business Systems

That makes endpoints one of the most important security layers in an enterprise.

In the previous lab, you worked with:

Active Directory
      ↓
Users
      ↓
Groups
      ↓
Authentication
      ↓
Privilege

Now you will move to the device itself.

Your security question becomes:

Is This Endpoint
Secure Enough
to Access Corporate Resources?

Mission Information

Lab: Endpoint Security
Level: Beginner → Intermediate
Estimated Time: 150–210 minutes
Environment: Authorized Windows 10/11 or Windows Server lab system
Primary Role: Endpoint Security Engineer
Supporting Roles: Windows Administrator, SOC Analyst, Microsoft Security Engineer, Incident Responder, IAM Engineer

Mission Scenario

Your organization has deployed a Windows workstation for an employee.

Before allowing the device to access sensitive corporate applications, the security team wants it reviewed.

You have been asked to assess:

Device Identity

Operating System

Users

Local Administrators

Security Updates

Microsoft Defender

Windows Firewall

Disk Encryption

Applications

Services

Network Exposure

Security Logs

Device Compliance

Your goal is to determine:

What Is Secure?

What Is Misconfigured?

What Is Missing?

What Is Over-Privileged?

What Should Be Fixed First?

Learning Objectives

By completing this lab, you should be able to:

Identify Windows endpoint information
Review device identity
Review local users
Review local administrators
Understand least privilege
Review Microsoft Defender Antivirus
Review Windows Firewall
Review BitLocker status
Review operating-system updates
Review installed applications
Review running services
Review listening network ports
Review security-related Windows events
Understand endpoint compliance
Understand device-management relationships
Identify common endpoint-security gaps
Create remediation recommendations
Produce a professional endpoint-security report

Endpoint Security Mental Model

Think:

IDENTITY
   ↓
DEVICE
   ↓
CONFIGURATION
   ↓
PRIVILEGE
   ↓
APPLICATIONS
   ↓
NETWORK
   ↓
SECURITY CONTROLS
   ↓
LOGGING
   ↓
MONITORING

Lab Architecture

                    USER
                      |
                      v
             +----------------+
             | Windows Device |
             +--------+-------+
                      |
        +-------------+-------------+
        |             |             |
        v             v             v
     Identity      Security      Applications
        |          Controls          |
        |             |              |
        +-------------+--------------+
                      |
                      v
                Corporate Data
                      |
                      v
              Cloud / Enterprise
                   Resources

Part 01 — Prepare the Lab

Create a workspace in PowerShell:

New-Item -ItemType Directory -Path C:\EndpointSecurityLab -Force

Create subdirectories:

New-Item -ItemType Directory -Path C:\EndpointSecurityLab\Baseline -Force
New-Item -ItemType Directory -Path C:\EndpointSecurityLab\Evidence -Force
New-Item -ItemType Directory -Path C:\EndpointSecurityLab\Findings -Force
New-Item -ItemType Directory -Path C:\EndpointSecurityLab\Reports -Force

Your structure becomes:

C:\EndpointSecurityLab
├── Baseline
├── Evidence
├── Findings
└── Reports

Part 02 — Identify the Device

Start with:

hostname

Then:

Get-ComputerInfo

For a focused view:

Get-ComputerInfo |
Select-Object CsName,WindowsProductName,WindowsVersion,OsBuildNumber,OsArchitecture

Record:

Hostname

Operating System

Version

Build

Architecture

Why Asset Identification Matters

You cannot secure an endpoint properly without knowing:

What Device Is This?

Which OS?

Which Version?

Who Owns It?

What Is Its Business Role?

Part 03 — Capture Baseline

Save device information:

Get-ComputerInfo |
Out-File C:\EndpointSecurityLab\Baseline\ComputerInfo.txt

Capture time:

Get-Date |
Out-File C:\EndpointSecurityLab\Baseline\AssessmentTime.txt

Baseline Principle

You need:

BEFORE

to compare with:

AFTER

if remediation is later performed.

Part 04 — Determine Device Ownership and Purpose

Document:

Device Owner:

Department:

Business Function:

Corporate / Personal:

Managed / Unmanaged:

Production / Lab:

Data Sensitivity:

Security Question

A finance laptop and a public kiosk should not automatically receive identical security requirements.

Use:

ASSET ROLE
      +
DATA SENSITIVITY
      +
THREAT MODEL

Part 05 — Review Current Identity

Run:

whoami

Then:

whoami /groups

This helps identify:

Current User

Group Membership

Security Context

Part 06 — Review Local Users

Run:

Get-LocalUser

Review:

Name

Enabled

Description

Last Logon

where available.

Local Account Questions

For each account ask:

Who Owns It?

Why Does It Exist?

Is It Enabled?

Does It Need Interactive Login?

Does It Have Administrative Access?

Part 07 — Identify Disabled and Unused Accounts

Run:

Get-LocalUser |
Select-Object Name,Enabled,LastLogon

Potential issues include:

Unused Enabled Accounts

Old Support Accounts

Shared Accounts

Default Accounts Improperly Used

Finding Example

Finding:
Unused Local Account Remains Enabled

Observation:
A local account remains enabled despite
having no current documented business use.

Risk:
Unused identities increase the number of
credentials that may be abused.

Recommendation:
Validate account ownership and disable or
remove unused access through the approved
endpoint lifecycle process.

Part 08 — Review Local Administrators

Run:

Get-LocalGroupMember -Group "Administrators"

Document:

Member

Source

Account Type

Business Requirement

Why Local Administrator Matters

A local administrator may be able to:

Install Software

Create Accounts

Change Security Settings

Disable Controls

Access Sensitive Data

Security Principle

Prefer:

Standard User
      ↓
Approved Elevation
      ↓
Required Administrative Task

instead of:

Every User
      ↓
Permanent Local Administrator

Part 09 — Evaluate Least Privilege

For each administrator ask:

Does This Identity Need Local Admin?

Is It Permanent?

Can Elevation Be Temporary?

Is Administrative Activity Logged?

Is Access Reviewed?

Finding Example

Finding:
Excessive Local Administrator Membership

Observation:
A standard business user has permanent
membership in the local Administrators
group without a documented requirement.

Risk:
Malware, credential compromise, or user
error may gain elevated control of the
endpoint.

Recommendation:
Remove unnecessary permanent local
administrator rights and use controlled
elevation for approved administrative
tasks.

Part 10 — Review Device Join State

Run:

dsregcmd /status

Review relevant areas such as:

Domain Join

Microsoft Entra Join

Device Identity

Tenant Information

Device Relationship Model

A device may be:

Workgroup

Active Directory Domain Joined

Microsoft Entra Joined

Hybrid Joined

Security Significance

Device identity can influence:

Management

Authentication

Compliance

Conditional Access

Policy

Part 11 — Review Domain Membership

Run:

Get-CimInstance Win32_ComputerSystem |
Select-Object Name,Domain,PartOfDomain

Record:

Domain:

Domain Joined:

Workgroup:

Part 12 — Review Operating-System Support

Confirm the system is running:

Supported Windows Version

Supported Build

Approved Enterprise Edition

Unsupported systems may lack:

Security Updates

Vendor Support

Modern Security Features

Part 13 — Review Windows Updates

Inspect update history using the approved Windows Update interface or management platform.

PowerShell environments may also expose relevant update information.

A simple installed-hotfix review can begin with:

Get-HotFix |
Sort-Object InstalledOn -Descending

Important

Get-HotFix is not a complete vulnerability-assessment tool.

It provides one piece of evidence.

Patch Assessment Questions

Ask:

When Was the Device Last Updated?

Are Updates Centrally Managed?

Are Security Updates Delayed?

Did Any Update Fail?

Is a Reboot Pending?

Patch Management Workflow

UPDATE RELEASED
      ↓
TEST
      ↓
PILOT
      ↓
DEPLOY
      ↓
MONITOR
      ↓
VALIDATE

Finding Example

Finding:
Endpoint Security Updates Delayed

Observation:
The endpoint remains behind the approved
security-update baseline.

Risk:
Known vulnerabilities may remain exposed
beyond the organization's remediation
window.

Recommendation:
Apply applicable security updates through
the approved update-management process and
validate device health after deployment.

Part 14 — Microsoft Defender Antivirus

Microsoft Defender Antivirus provides endpoint malware protection capabilities on supported Windows systems.

Review:

Get-MpComputerStatus

Focus on relevant fields such as:

AntivirusEnabled

RealTimeProtectionEnabled

AntispywareEnabled

BehaviorMonitorEnabled

AntivirusSignatureLastUpdated

Save Evidence

Get-MpComputerStatus |
Out-File C:\EndpointSecurityLab\Evidence\DefenderStatus.txt

Security Questions

Is Antivirus Enabled?

Is Real-Time Protection Enabled?

Are Security Intelligence Updates Current?

Is Behavior Monitoring Enabled?

Is the Device Reporting Healthy?

Part 15 — Understand Antivirus Limitations

Do not think:

Antivirus Enabled
=
Endpoint Secure

Endpoint security also requires:

Patching

Least Privilege

Firewall

Encryption

Application Security

EDR

Monitoring

Defense in Depth

USER SECURITY
      +
IDENTITY SECURITY
      +
PATCHING
      +
ANTIVIRUS
      +
FIREWALL
      +
EDR
      +
MONITORING

Part 16 — Review Defender Preferences

In an authorized lab:

Get-MpPreference

This can expose a large configuration set.

Focus on relevant security settings rather than copying the entire output blindly.

Important

Do not modify Defender exclusions without understanding their purpose.

Part 17 — Review Defender Exclusions

Review approved exclusions where required.

Broad exclusions can weaken endpoint protection.

Examples requiring scrutiny include exclusions covering:

Entire Drives

User Profile Trees

Temporary Directories

Broad Application Paths

Finding Example

Finding:
Overly Broad Endpoint Protection Exclusion

Observation:
Endpoint protection excludes a location
broader than required by the documented
application requirement.

Risk:
Malicious content within the excluded
location may receive reduced inspection.

Recommendation:
Reduce exclusions to the minimum supported
scope and periodically review their
business requirement.

Part 18 — Endpoint Detection and Response

Antivirus primarily focuses on prevention and detection.

EDR expands visibility into behaviors such as:

Processes

Files

Network Connections

Identity Activity

Persistence

Security Alerts

EDR Investigation Model

ALERT
  ↓
DEVICE
  ↓
USER
  ↓
PROCESS
  ↓
PARENT
  ↓
FILE
  ↓
NETWORK
  ↓
TIMELINE

Part 19 — Review Windows Firewall

Check firewall profile status:

Get-NetFirewallProfile

Focus on:

Domain

Private

Public

Record whether each profile is:

Enabled

Disabled

Save Evidence

Get-NetFirewallProfile |
Out-File C:\EndpointSecurityLab\Evidence\FirewallProfiles.txt

Firewall Mental Model

NETWORK
  ↓
WINDOWS FIREWALL
  ↓
APPLICATION / SERVICE

Part 20 — Firewall Profiles

Windows commonly uses:

Domain Profile

Private Profile

Public Profile

The applicable profile depends on the network context.

Security Question

Ask:

Is the Firewall Enabled
for Every Required Profile?

Finding Example

Finding:
Windows Firewall Disabled

Observation:
One or more required Windows Firewall
profiles are disabled.

Risk:
The endpoint may accept network traffic
without the host-level filtering required
by the security baseline.

Recommendation:
Enable the approved firewall profiles,
validate necessary application rules, and
centrally manage exceptions where possible.

Part 21 — Review Firewall Rules

List enabled inbound rules:

Get-NetFirewallRule |
Where-Object {$_.Enabled -eq "True" -and $_.Direction -eq "Inbound"} |
Select-Object DisplayName,Action,Profile

Assessment Questions

Why Does This Rule Exist?

Which Application Needs It?

Which Profile?

Allow or Block?

Is Its Scope Too Broad?

Part 22 — Listening Network Ports

Run:

Get-NetTCPConnection -State Listen

Review:

Local Address

Local Port

Owning Process

Map Port to Process

Example:

Get-NetTCPConnection -State Listen |
Select-Object LocalAddress,LocalPort,OwningProcess

Then for a PID:

Get-Process -Id <PID>

Security Workflow

PORT
 ↓
PID
 ↓
PROCESS
 ↓
SERVICE
 ↓
BUSINESS REQUIREMENT

Important

A listening port is not automatically externally reachable.

Reachability also depends on:

Firewall

Network Path

Application Binding

Cloud / Network Controls

Part 23 — Review Active Connections

Run:

Get-NetTCPConnection |
Where-Object {$_.State -eq "Established"}

Look for:

Unexpected Destinations

Unexpected Processes

Long-Lived Connections

Unknown Applications

Security Principle

Do not classify an unfamiliar connection as malicious solely because you do not recognize the IP address.

Correlate:

Process

Application

Destination

Business Requirement

Security Telemetry

Part 24 — Review BitLocker

BitLocker helps protect data at rest.

Review:

Get-BitLockerVolume

Focus on:

MountPoint

VolumeStatus

ProtectionStatus

EncryptionPercentage

Security Objective

A lost or stolen device should not automatically expose corporate data.

DEVICE LOST
    ↓
DISK ENCRYPTED
    ↓
DATA REMAINS PROTECTED

Part 25 — BitLocker Recovery

Encryption requires recoverability.

Organizations should manage:

Recovery Keys

Authorized Recovery

Key Escrow

Access Controls

Audit

Finding Example

Finding:
Endpoint Disk Encryption Not Enabled

Observation:
The system volume containing corporate
data is not protected by the organization's
required full-disk encryption control.

Risk:
Physical loss or theft of the device may
expose locally stored information.

Recommendation:
Enable approved disk encryption and ensure
recovery information is securely managed
through the organization's endpoint
management process.

Part 26 — Review TPM

Where relevant:

Get-Tpm

Review:

TpmPresent

TpmReady

TpmEnabled

TPM Security Connection

TPM technology can support security capabilities such as:

BitLocker

Windows Hello

Device Trust

Key Protection

Part 27 — Review Windows Security Services

Inspect relevant services:

Get-Service |
Where-Object {$_.Status -eq "Running"}

Do not assume every running service is required.

Service Review Questions

What Is the Service?

Who Installed It?

Does the Device Need It?

Does It Listen on the Network?

Does It Run with High Privilege?

Part 28 — Review Enabled Applications

List installed applications using approved inventory sources.

Use:

Enterprise Inventory

Intune

Software Management

Windows Settings

Approved PowerShell Queries

Avoid relying on only one registry location as a complete inventory.

Application Security Questions

Is the Application Approved?

Is It Required?

Is It Current?

Who Installed It?

Does It Introduce Network Exposure?

Does It Require Administrative Rights?

Part 29 — Unnecessary Software

Every unnecessary application adds:

Code

Dependencies

Attack Surface

Maintenance

Potential Vulnerabilities

Finding Example

Finding:
Unnecessary Endpoint Software

Observation:
Software not required for the endpoint's
documented business role remains installed.

Risk:
Unnecessary software increases endpoint
attack surface and maintenance burden.

Recommendation:
Validate application ownership and remove
unused software through the approved
software-management process.

Part 30 — Review Startup Applications

Review approved startup mechanisms.

One simple view is:

Get-CimInstance Win32_StartupCommand

Assess:

Application

Location

User

Business Purpose

Security Relevance

Unexpected startup execution may represent:

Legitimate Software

Management Agent

User Utility

Misconfiguration

Potential Persistence

Context matters.

Part 31 — Review Scheduled Tasks

List tasks:

Get-ScheduledTask

For security review, focus on:

Unknown Tasks

High-Privilege Tasks

Custom Scripts

Unexpected Executables

Scheduled Task Questions

Who Created It?

Which Account Runs It?

What Does It Execute?

When?

Is the Target Script Protected?

Part 32 — Review Running Processes

Run:

Get-Process

Sort by CPU:

Get-Process |
Sort-Object CPU -Descending |
Select-Object -First 20

Process Investigation Questions

What Is the Process?

Who Owns It?

Where Is the Executable?

What Started It?

Does It Use the Network?

Is It Expected?

Part 33 — Review Windows Defender Firewall and Services Together

A good endpoint assessment correlates:

RUNNING SERVICE
       +
LISTENING PORT
       +
FIREWALL RULE
       =
NETWORK EXPOSURE

Part 34 — Review Event Viewer

Windows Event Viewer contains important security evidence.

Useful log categories include:

Security

System

Application

Microsoft Defender

PowerShell

Event Investigation Mental Model

EVENT
 ↓
TIME
 ↓
USER
 ↓
PROCESS
 ↓
DEVICE
 ↓
ACTION

Part 35 — Review Recent Security Events

An authorized PowerShell example:

Get-WinEvent -LogName Security -MaxEvents 50

Do not dump excessive event logs into a report.

Focus on events relevant to the assessment.

Part 36 — Security Events to Understand

Security teams often care about categories such as:

Successful Logons

Failed Logons

Account Changes

Privilege Use

Process Creation

Policy Changes

Important

Learn:

What Happened

before memorizing:

Event ID

Event IDs are useful, but context matters more.

Part 37 — Review PowerShell Logging Concept

PowerShell is a powerful administrative platform.

Security teams may use PowerShell logging to support:

Administrative Monitoring

Threat Detection

Incident Investigation

Security Question

Ask:

Can We Determine
What Administrative Scripts
Were Executed?

according to your organization’s logging standard.

Part 38 — Review Audit Policy

Run:

auditpol /get /category:*

This shows audit-policy configuration.

Review whether the environment captures required events.

Audit Areas

Potential categories include:

Account Logon

Account Management

Logon/Logoff

Privilege Use

Policy Change

Process Tracking

System Events

Part 39 — Logging Is Not Monitoring

Understand:

Logging
=
Events Are Recorded

while:

Monitoring
=
Events Are Reviewed
and Used for Detection

A device can generate excellent logs that nobody ever looks at.

Part 40 — Centralized Security Monitoring

A mature endpoint design may follow:

WINDOWS ENDPOINT
      ↓
SECURITY TELEMETRY
      ↓
CENTRAL PLATFORM
      ↓
SIEM / XDR
      ↓
ALERT
      ↓
SOC

Part 41 — Device Compliance

Managed endpoints may be evaluated against a compliance policy.

Possible requirements include:

Supported OS

Encryption

Security Controls

Password Requirements

Threat State

Compliance Model

DEVICE STATE
      ↓
COMPLIANCE POLICY
      ↓
COMPLIANT
or
NONCOMPLIANT

Part 42 — Compliance and Conditional Access

Combine:

USER IDENTITY
       +
DEVICE COMPLIANCE
       +
APPLICATION
       +
RISK
       ↓
ACCESS DECISION

Scenario

User Password Correct
      ↓
MFA Successful
      ↓
Device Noncompliant
      ↓
Sensitive App Access Restricted

This is a Zero Trust-style security model.

Part 43 — Endpoint Security Baseline

Create an approved baseline covering:

OS Version

Patching

Local Administrators

Antivirus

Firewall

Encryption

Applications

Audit Policy

Logging

Device Compliance

Example Baseline

Control	Expected State
Supported OS	Yes
Updates	Current
Standard user	No permanent admin
Defender	Enabled
Firewall	Enabled
BitLocker	Protected
Logging	Enabled
Compliance	Compliant

Part 44 — Compare Baseline to Actual State

Create:

Control	Expected	Actual	Result
Defender	Enabled	Enabled	Pass
Firewall	Enabled	Disabled	Fail
BitLocker	Enabled	Disabled	Fail
Local Admin	Restricted	Broad	Fail
Updates	Current	Current	Pass

Part 45 — Prioritize Findings

Do not treat every gap equally.

Consider:

Exposure

Privilege

Data Sensitivity

Likelihood

Business Impact

Compensating Controls

Priority Example

User Has Local Admin
        +
Device Handles Sensitive Data
        +
No EDR
        ↓
Higher Risk

Part 46 — Lost Laptop Scenario

Scenario:

Corporate Laptop Is Lost

Investigate:

Device Ownership

Encryption

User

Last Check-In

Recent Sign-In Activity

Corporate Data

Device Management State

Then follow approved procedures for:

Access Restriction

Remote Actions

Credential Response

Incident Documentation

Part 47 — Malware Detection Scenario

Scenario:

Endpoint Security Generates
Malware Alert

Use:

ALERT
  ↓
DEVICE
  ↓
USER
  ↓
FILE
  ↓
PROCESS
  ↓
PARENT
  ↓
NETWORK
  ↓
TIMELINE

Do not immediately assume every antivirus detection means a complete system compromise.

Part 48 — Firewall Disabled Scenario

Scenario:

Firewall Disabled

Ask:

Who Disabled It?

When?

Why?

Was It Central Policy?

Was It Troubleshooting?

Did Exposure Increase?

Part 49 — Local Admin Scenario

Scenario:

Employee Requests
Permanent Administrator Rights
for One Application

Instead of immediately granting it, ask:

Which Application?

Which Function Requires Elevation?

Can the Application Be Reconfigured?

Can Temporary Elevation Be Used?

Can a Smaller Permission Be Granted?

Part 50 — Noncompliant Device Scenario

Scenario:

Device Is Noncompliant
because Encryption Is Disabled

Workflow:

IDENTIFY CONTROL
      ↓
VALIDATE STATE
      ↓
REMEDIATE
      ↓
SYNC DEVICE
      ↓
RECHECK COMPLIANCE
      ↓
VALIDATE ACCESS

Part 51 — Security Control Validation

Do not stop at:

Configured

Validate:

Effective

Example:

Firewall Enabled

is good.

But also ask:

Are the Rules Appropriate?

Part 52 — Negative Testing

In an authorized disposable lab, validate that prohibited behavior is actually blocked.

Examples:

Standard User
Cannot Perform Admin Task

Unapproved Inbound Access
Is Blocked

Noncompliant Device
Is Restricted Where Policy Requires

Part 53 — Create an Endpoint Inventory

Document:

Hostname

Owner

Operating System

Build

Join State

Management State

Compliance

Security Status

Endpoint Inventory Template

Item	Value
Hostname
Owner
OS
Build
Domain/Entra State
Managed
Compliant
Last Reviewed

Part 54 — Create a Local Access Matrix

Identity	Type	Local Admin	Required	Action
User-A	Employee	No	No	None
Admin-A	Admin	Yes	Yes	Review
OldSupport	Local	Yes	No	Disable/Review

Part 55 — Create a Security Control Matrix

Control	State	Expected	Finding
Defender	Enabled	Enabled	None
Firewall	Enabled	Enabled	None
Encryption	Disabled	Enabled	Yes
Updates	Current	Current	None
Logging	Review	Enabled	Review

Part 56 — Create Application Inventory

Application	Required	Approved	Current	Owner
Browser	Yes	Yes	Yes	IT
Office	Yes	Yes	Yes	IT
Unknown App	Review	Review	Review	Unknown

Part 57 — Create Network Exposure Matrix

Port	Process	Required	Firewall	Action
Review	Process	Yes/No	Allowed/Blocked	Review

Part 58 — Finding: Excessive Local Admin

Finding:
Permanent Local Administrative Privilege

Observation:
A standard business user possesses
permanent local administrator access.

Risk:
Compromise of the user context may provide
elevated control of the endpoint and its
security configuration.

Recommendation:
Remove unnecessary permanent privilege and
provide controlled elevation for approved
administrative tasks.

Part 59 — Finding: Firewall Disabled

Finding:
Host Firewall Protection Disabled

Observation:
A required Windows Firewall profile is not
enabled.

Risk:
The endpoint may accept unnecessary network
traffic and rely entirely on upstream
network controls.

Recommendation:
Restore the approved firewall profile and
validate required application exceptions.

Part 60 — Finding: Missing Encryption

Finding:
Full-Disk Encryption Not Enforced

Observation:
The system volume is not protected using
the organization's required disk-encryption
control.

Risk:
Loss or theft of the device may expose
locally stored corporate information.

Recommendation:
Enable approved full-disk encryption and
securely manage recovery information.

Part 61 — Finding: Security Telemetry Gap

Finding:
Insufficient Endpoint Security Visibility

Observation:
The endpoint does not provide the security
telemetry required by the organization's
monitoring standard.

Risk:
Suspicious endpoint activity may be
difficult to detect, investigate, or
correlate with broader incidents.

Recommendation:
Enable approved endpoint telemetry and
forward required security events to the
central monitoring platform.

Part 62 — Finding: Unsupported Endpoint

Finding:
Unsupported Operating System

Observation:
The endpoint runs an operating-system
version outside the organization's
supported security lifecycle.

Risk:
The device may not reliably receive
required security updates or modern
security capabilities.

Recommendation:
Upgrade or replace the device with a
supported operating-system release.

Part 63 — Endpoint Security Report

Your report should contain:

1. Executive Summary

Document:

Endpoint Assessed

Business Role

Overall Security Posture

Highest-Risk Findings

Priority Recommendations

2. System Information

Include:

Hostname

Operating System

Build

Owner

Device Role

Join State

3. Identity Review

Document:

Local Users

Local Administrators

Unused Accounts

Privileged Access

4. Patch Status

Document:

OS Update State

Recent Security Updates

Observed Gaps

5. Endpoint Protection

Document:

Antivirus

Real-Time Protection

Security Intelligence

EDR / Security Telemetry

6. Firewall

Document:

Profile Status

Relevant Rules

Observed Exposure

7. Encryption

Document:

BitLocker State

Protection Status

Recovery Process

8. Applications

Document:

Approved Applications

Unknown Applications

Unsupported Applications

Business Owners

9. Services and Network

Document:

Running Services

Listening Ports

Relevant Processes

Unexpected Connections

10. Logging

Document:

Security Events

Audit Policy

Centralized Monitoring

Visibility Gaps

11. Compliance

Document:

Compliance State

Failed Controls

Remediation Requirements

12. Findings

For each:

ID

Title

Severity

Observation

Evidence

Risk

Recommendation

Owner

Part 64 — Endpoint Security Checklist

Asset

Identity

Patching

Reviewed update status
Reviewed installed hotfix evidence
Reviewed update-management approach
Checked for outdated OS

Defender

Firewall

Encryption

Reviewed BitLocker
Reviewed protection status
Reviewed recovery process
Reviewed TPM where appropriate

Applications

Reviewed installed applications
Reviewed application ownership
Identified unnecessary software
Reviewed unsupported software
Reviewed startup applications

Services

Reviewed running services
Identified high-privilege services
Correlated services with listeners
Reviewed scheduled tasks

Processes

Reviewed process inventory
Investigated unusual processes
Correlated processes with connections
Distinguished unknown from malicious

Logging

Compliance

Understood compliance state
Compared device to baseline
Identified failed controls
Created remediation recommendations

Reporting

Common Endpoint Security Mistakes

Avoid:

Giving Every User Local Admin

Disabling Firewall for Troubleshooting

Ignoring Disk Encryption

Ignoring Update Failures

Assuming Antivirus Is Enough

Creating Broad Defender Exclusions

Ignoring Unknown Applications

Ignoring Stale Accounts

Ignoring Startup Tasks

Ignoring Outbound Connections

Ignoring Security Logs

Assuming Enrolled Means Secure

Assuming Compliant Means Impossible to Compromise

Endpoint Security Maturity Model

Level 1 — Basic

Antivirus

Firewall

Patching

Level 2 — Managed

Central Device Management

Encryption

Compliance

Application Management

Least Privilege

Level 3 — Security Integrated

EDR

Conditional Access

Central Logging

Automated Remediation

Security Baseline

Level 4 — Zero Trust Endpoint

Identity + Device + Risk

Continuous Evaluation

Controlled Privilege

Automated Compliance

Advanced Detection

Career Connection

This lab directly supports:

Endpoint Administrator

Endpoint Security Engineer

Windows Administrator

SOC Analyst

Microsoft Security Engineer

Incident Responder

Cloud Security Engineer

Security Consultant

Interview Scenario 01

Why are local administrator rights risky?

Because administrator-level compromise may allow:

Security Control Changes

Software Installation

Credential Access

Persistence

Data Access

Interview Scenario 02

Is Microsoft Defender Antivirus enough to secure a Windows endpoint?

No.

A strong endpoint requires multiple controls:

Patching

Least Privilege

Firewall

Encryption

EDR

Logging

Monitoring

Interview Scenario 03

Why is BitLocker important?

It helps protect data at rest when a device or drive is lost or stolen.

Interview Scenario 04

How would you investigate an unknown listening port?

Use:

PORT
 ↓
PID
 ↓
PROCESS
 ↓
SERVICE
 ↓
BUSINESS REQUIREMENT
 ↓
FIREWALL EXPOSURE

Interview Scenario 05

What is the difference between endpoint management and endpoint security?

Endpoint management focuses on:

Lifecycle

Configuration

Applications

Updates

Compliance

Endpoint security focuses more specifically on:

Protection

Detection

Privilege

Exposure

Response

They strongly overlap.

40 Endpoint Security Interview Questions

What is endpoint security?
Why are endpoints important attack surfaces?
What is endpoint management?
What is a managed endpoint?
What is device identity?
How do you identify local users?
Why are stale local accounts risky?
How do you review local administrators?
What is least privilege?
Why should users normally avoid permanent local admin?
What is Microsoft Defender Antivirus?
What is real-time protection?
Why must malware intelligence remain updated?
What is EDR?
How does EDR differ from antivirus?
What is Windows Firewall?
What are firewall profiles?
Why should host firewalls remain enabled?
How do you identify listening ports?
How do you map a port to a process?
What is BitLocker?
Why is recovery-key management important?
What is TPM?
Why are security updates important?
What is patch management?
Why use phased update deployment?
Why should installed software be inventoried?
Why are unnecessary applications risky?
Why should scheduled tasks be reviewed?
What is configuration drift?
What is an endpoint security baseline?
What is device compliance?
How does compliance relate to Conditional Access?
What is Windows audit policy?
Why is centralized logging important?
How would you handle a lost laptop?
How would you investigate a malware alert?
How would you assess an endpoint with its firewall disabled?
What controls would you prioritize on a corporate endpoint?
How would you perform an endpoint-security assessment?

Final Endpoint Security Mental Model

When assessing a Windows endpoint, ask:

WHAT DEVICE IS THIS?
        ↓
WHO USES IT?
        ↓
WHO IS ADMIN?
        ↓
IS IT PATCHED?
        ↓
IS ANTIVIRUS ACTIVE?
        ↓
IS EDR AVAILABLE?
        ↓
IS FIREWALL ENABLED?
        ↓
IS DATA ENCRYPTED?
        ↓
WHAT SOFTWARE EXISTS?
        ↓
WHAT SERVICES RUN?
        ↓
WHAT PORTS ARE OPEN?
        ↓
WHAT IS BEING LOGGED?
        ↓
IS IT COMPLIANT?

Mission Accomplished

You have now assessed endpoint security across:

Device Identity

Users

Local Administrators

Patching

Microsoft Defender

Firewall

BitLocker

Applications

Processes

Services

Networking

Logging

Compliance

The most important lesson is:

Endpoint Security
Is Not One Product

It is the combination of:

IDENTITY
   +
CONFIGURATION
   +
LEAST PRIVILEGE
   +
PATCHING
   +
PROTECTION
   +
NETWORK SECURITY
   +
ENCRYPTION
   +
MONITORING

What’s Next?

➡️ Lab 03 — Identity Security

In the next lab, you will move from securing the device to securing cloud identity.

You will work through:

Microsoft Entra ID
      ↓
User Inventory
      ↓
Groups
      ↓
Authentication Methods
      ↓
MFA
      ↓
Conditional Access
      ↓
Administrative Roles
      ↓
Privileged Identity
      ↓
Guest Access
      ↓
Enterprise Applications
      ↓
Sign-In Logs
      ↓
Identity Risk
      ↓
Security Findings

Your Microsoft lab sequence continues:

Lab 01 — Active Directory
        ↓
Lab 02 — Endpoint Security
        ↓
Lab 03 — Identity Security
        ↓
Lab 04 — Microsoft 365 Security
        ↓
Lab 05 — Windows Security
        ↓
Runbook 01 — Active Directory Assessment
        ↓
Runbook 02 — Microsoft 365 Security Review
        ↓
Runbook 03 — Windows Security Assessment