Lab 05 — Windows Security

Windows systems are deeply integrated into enterprise environments.

They may function as:

Employee Workstations

Administrative Workstations

Servers

Jump Hosts

Application Servers

Domain-Joined Systems

Cloud Virtual Machines

Securing Windows therefore requires more than installing antivirus.

A secure Windows system combines:

Identity

Authentication

Privilege

Configuration

Endpoint Protection

Network Security

Encryption

Logging

Monitoring

Hardening

In this lab, you will perform a structured Windows security assessment and convert technical observations into professional security findings.

Mission Information

Lab: Windows Security
Level: Beginner → Intermediate
Estimated Time: 180–240 minutes
Environment: Authorized Windows 10/11 or Windows Server lab
Primary Role: Windows Security Engineer
Supporting Roles: SOC Analyst, Incident Responder, Security Consultant, Endpoint Engineer, Microsoft Security Engineer

Mission Scenario

Your security team has been asked to review a Windows system before it is approved for enterprise use.

The system may contain:

Local Users

Administrative Accounts

Security Policies

Applications

Services

Network Listeners

Scheduled Tasks

PowerShell

Security Logs

Microsoft Defender

Windows Firewall

BitLocker

Your mission is to answer:

Who Can Access the System?

Who Has Administrative Rights?

How Is Authentication Protected?

Which Services Are Exposed?

Are Security Controls Active?

Can Important Activity Be Audited?

Are Persistence Mechanisms Controlled?

Does the System Meet the Security Baseline?

Learning Objectives

By completing this lab, you should be able to:

Identify Windows system information
Review local users and groups
Review local administrator access
Understand local security policy
Review authentication settings
Review user rights assignments
Review Microsoft Defender
Review Windows Firewall
Review BitLocker
Review audit policy
Understand PowerShell security
Review running services
Review network exposure
Review startup mechanisms
Review scheduled tasks
Understand common persistence locations
Review Windows security logs
Identify security misconfigurations
Create remediation recommendations
Validate changes
Build a professional Windows security report

Windows Security Mental Model

Think:

SYSTEM
  ↓
IDENTITY
  ↓
AUTHENTICATION
  ↓
PRIVILEGE
  ↓
SECURITY POLICY
  ↓
PROTECTION
  ↓
NETWORK
  ↓
APPLICATIONS
  ↓
PERSISTENCE
  ↓
LOGGING
  ↓
MONITORING

Lab Architecture

                  WINDOWS SYSTEM
                        |
       +----------------+----------------+
       |                |                |
       v                v                v
    Identity        Security         Services
       |            Controls             |
       |                |                |
       +----------------+----------------+
                        |
                        v
                   Applications
                        |
                        v
                  Network Access
                        |
                        v
                 Security Logging

Part 01 — Prepare the Lab

Create a dedicated workspace:

New-Item -ItemType Directory -Path C:\WindowsSecurityLab -Force

Create:

New-Item -ItemType Directory -Path C:\WindowsSecurityLab\Baseline -Force
New-Item -ItemType Directory -Path C:\WindowsSecurityLab\Evidence -Force
New-Item -ItemType Directory -Path C:\WindowsSecurityLab\Findings -Force
New-Item -ItemType Directory -Path C:\WindowsSecurityLab\Reports -Force

Your workspace becomes:

C:\WindowsSecurityLab
├── Baseline
├── Evidence
├── Findings
└── Reports

Part 02 — Record Assessment Context

Document:

Hostname:

System Owner:

Business Role:

Operating System:

Environment:

Domain / Workgroup:

Assessment Date:

Assessor:

Security Principle

Before assessing configuration, understand:

WHAT IS THIS SYSTEM?

A domain controller, finance workstation, kiosk, and development server should not automatically have identical security requirements.

Part 03 — Identify the System

Run:

hostname

Then:

Get-ComputerInfo |
Select-Object CsName,WindowsProductName,WindowsVersion,OsBuildNumber,OsArchitecture

Save evidence:

Get-ComputerInfo |
Out-File C:\WindowsSecurityLab\Baseline\ComputerInfo.txt

Part 04 — Review System Uptime

Run:

Get-CimInstance Win32_OperatingSystem |
Select-Object LastBootUpTime

Long uptime may indicate:

Pending Reboots

Missed Maintenance

Delayed Patching

but should always be interpreted in context.

Part 05 — Review Domain Membership

Run:

Get-CimInstance Win32_ComputerSystem |
Select-Object Name,Domain,PartOfDomain

Document whether the system is:

Workgroup

Active Directory Domain Joined

Cloud Managed

Hybrid Managed

Part 06 — Review Current User

Run:

whoami

Then:

whoami /groups

This identifies:

Current Identity

Group Membership

Security Context

Part 07 — Review Local Users

Run:

Get-LocalUser

Review:

Name

Enabled

Description

LastLogon

PasswordRequired

where available.

Security Questions

For every local account ask:

Who Owns It?

Why Does It Exist?

Is It Enabled?

Does It Need Interactive Access?

Is It Administrative?

Part 08 — Identify Dormant Local Accounts

Create a review list:

Get-LocalUser |
Select-Object Name,Enabled,LastLogon

Potential issues include:

Old Support Account

Unused Local Admin

Former Employee Account

Temporary Account Left Enabled

Finding Example

Finding:
Dormant Local Account Remains Enabled

Observation:
A local identity with no current documented
business use remains enabled.

Risk:
Unused identities increase the available
credential attack surface.

Recommendation:
Validate business ownership and disable or
remove unused local accounts through the
approved access lifecycle.

Part 09 — Review Local Groups

Run:

Get-LocalGroup

Identify groups relevant to:

Administration

Remote Access

Backup

Event Log Access

Remote Management

Part 10 — Review Local Administrators

Run:

Get-LocalGroupMember -Group "Administrators"

Document:

Member	Source	Type	Required
Administrator	Local	User	Review
Admin-A	Domain	User	Yes
SupportGroup	Domain	Group	Review

Part 11 — Assess Least Privilege

For each administrator ask:

Does This Identity Need Administrator Access?

Is It Permanent?

Could a Standard User Account Work?

Could Elevation Be Temporary?

Is Activity Audited?

Finding Example

Finding:
Excessive Local Administrative Privilege

Observation:
A standard user has permanent membership
in the local Administrators group without
a documented technical requirement.

Risk:
User or credential compromise may result in
elevated control of the Windows system.

Recommendation:
Remove permanent local administrator access
and use approved privilege-elevation
mechanisms where administrative activity is
required.

Part 12 — Review Built-In Administrator Use

The built-in Administrator account should be understood and controlled according to the organization’s security baseline.

Review:

Enabled State

Usage

Remote Access

Password Management

Monitoring

Security Principle

Do not rely on:

Account Renaming Alone

as a security control.

Focus on:

Access

Authentication

Usage

Monitoring

Part 13 — Windows LAPS Concept

Organizations can use Windows Local Administrator Password Solution capabilities to help manage local administrator credentials.

The security objective is:

UNIQUE LOCAL ADMIN PASSWORD
          +
CONTROLLED STORAGE
          +
AUTHORIZED RETRIEVAL
          +
ROTATION

instead of:

Same Local Admin Password
Across Every Endpoint

Security Risk

Password reuse across systems can significantly increase the impact of credential compromise.

Part 14 — Review Local Security Policy

Open the approved Local Security Policy interface where available:

secpol.msc

Review areas such as:

Account Policies

Local Policies

Audit Policy

User Rights Assignment

Security Options

Important

Do not modify production-like security settings simply for experimentation.

Use the lab environment and document:

Current State

Expected State

Proposed Change

Part 15 — Password Policy

Review concepts such as:

Password Length

Password History

Password Requirements

Password Age

Security design should reflect the organization’s current authentication strategy.

Security Principle

Password controls should work together with:

MFA

Account Lockout

Credential Protection

Monitoring

Part 16 — Account Lockout Policy

Review:

Lockout Threshold

Lockout Duration

Reset Counter

Security Trade-Off

Too weak:

Repeated Password Guessing

Too aggressive:

Unnecessary User Lockouts
+
Potential Denial of Service

Part 17 — Review User Rights Assignment

Windows can grant specific rights to users and groups.

Review permissions such as:

Log On Locally

Log On Through Remote Desktop Services

Access This Computer from the Network

Back Up Files and Directories

Debug Programs

Shut Down the System

Log On as a Service

Security Question

Ask:

Who Has This Right?

Why?

Is It Required?

Part 18 — High-Impact User Rights

Some user rights can provide significant capability.

For sensitive assignments, document:

Assigned Identity

Business Reason

System Scope

Review Date

Finding Example

Finding:
Excessive User Rights Assignment

Observation:
A user or group is granted a sensitive
local user right not required for its
documented responsibilities.

Risk:
The assignment may enable actions beyond
the intended security role.

Recommendation:
Remove unnecessary rights and align user
rights with the approved least-privilege
baseline.

Part 19 — Review Remote Desktop Access

Review local membership:

Get-LocalGroupMember -Group "Remote Desktop Users"

Then ask:

Who Can Connect?

Does the System Need RDP?

Is Network Access Restricted?

Are Administrators Using It?

Is Authentication Strong?

Part 20 — Review RDP Exposure

Check whether the system is listening for remote desktop connectivity where applicable.

Run:

Get-NetTCPConnection -State Listen |
Select-Object LocalAddress,LocalPort,OwningProcess

Do not assume:

Port Listening
=
Internet Exposed

Actual reachability also depends on:

Windows Firewall

Network Firewall

Cloud Security Rules

Routing

Part 21 — Microsoft Defender Antivirus

Review:

Get-MpComputerStatus

Focus on:

AntivirusEnabled

RealTimeProtectionEnabled

BehaviorMonitorEnabled

AntivirusSignatureLastUpdated

Save:

Get-MpComputerStatus |
Out-File C:\WindowsSecurityLab\Evidence\DefenderStatus.txt

Part 22 — Review Defender Configuration

Run:

Get-MpPreference

Review security-relevant areas including:

Exclusions

Cloud Protection

Scanning Configuration

Protection Settings

depending on the environment.

Part 23 — Defender Exclusions

Broad exclusions may weaken security.

Review:

Excluded Paths

Processes

Extensions

Ask:

Who Requested It?

Which Application Requires It?

Can It Be Narrower?

Is It Still Needed?

Finding Example

Finding:
Overly Broad Defender Exclusion

Observation:
Endpoint protection excludes a filesystem
location broader than required by the
documented application dependency.

Risk:
Malicious files in the excluded location
may receive reduced protection.

Recommendation:
Reduce the exclusion to the minimum
supported scope and periodically review its
business requirement.

Part 24 — Windows Firewall

Review:

Get-NetFirewallProfile

Check:

Domain

Private

Public

Expected Security Question

Are Required Firewall Profiles Enabled?

Save evidence:

Get-NetFirewallProfile |
Out-File C:\WindowsSecurityLab\Evidence\FirewallProfiles.txt

Part 25 — Review Enabled Inbound Rules

Run:

Get-NetFirewallRule |
Where-Object {$_.Enabled -eq "True" -and $_.Direction -eq "Inbound"} |
Select-Object DisplayName,Action,Profile

Ask:

Which Application Needs the Rule?

What Port Is Used?

Which Profile?

What Source Scope?

Is the Rule Still Required?

Part 26 — Review Network Listeners

Run:

Get-NetTCPConnection -State Listen |
Select-Object LocalAddress,LocalPort,OwningProcess

Use:

PORT
 ↓
PROCESS
 ↓
SERVICE
 ↓
APPLICATION
 ↓
BUSINESS REQUIREMENT

Part 27 — Map Process to Listener

For a selected PID:

Get-Process -Id <PID>

Document unexpected listeners rather than automatically calling them vulnerabilities.

Finding Example

Finding:
Unnecessary Listening Service

Observation:
A service listens on a network port despite
having no documented business requirement
on the assessed system.

Risk:
The service increases network attack
surface and may expose additional software
to remote interaction.

Recommendation:
Validate the service requirement and
disable or restrict unnecessary network
listeners.

Part 28 — BitLocker

Review:

Get-BitLockerVolume

Focus on:

VolumeStatus

ProtectionStatus

EncryptionPercentage

KeyProtector

Security Objective

Protect:

DATA AT REST

if the system or storage media is lost.

Part 29 — BitLocker Recovery

Verify that recovery processes are:

Documented

Secure

Controlled

Auditable

Encryption without a sound recovery process can create operational problems.

Finding Example

Finding:
System Drive Not Protected by Full-Disk
Encryption

Observation:
The Windows operating-system volume does
not meet the organization's required disk
encryption baseline.

Risk:
Physical loss or theft of the device could
expose locally stored corporate data.

Recommendation:
Enable approved full-disk encryption and
securely manage recovery information.

Part 30 — Review TPM

Run where applicable:

Get-Tpm

Review:

TpmPresent

TpmReady

TpmEnabled

TPM capabilities can support:

BitLocker

Credential Protection

Device Trust

Windows Hello

Part 31 — Review Installed Updates

Run:

Get-HotFix |
Sort-Object InstalledOn -Descending

Remember:

Get-HotFix

is useful evidence but is not a complete vulnerability-management solution.

Patch Review Questions

Is the OS Supported?

When Were Updates Last Applied?

Are Security Updates Managed?

Are Reboots Pending?

Were Any Updates Repeatedly Delayed?

Part 32 — Review Installed Applications

Use approved inventory sources to identify software.

For each application ask:

Is It Approved?

Is It Required?

Is It Supported?

Is It Current?

Who Owns It?

Part 33 — Attack Surface Reduction

Every unnecessary application or component adds:

Code

Dependencies

Services

Potential Vulnerabilities

Reduce unnecessary software where business requirements allow.

Part 34 — Review Services

Run:

Get-Service

Review active services:

Get-Service |
Where-Object {$_.Status -eq "Running"}

Ask:

What Does It Do?

Does It Need to Run?

What Account Runs It?

Does It Listen on the Network?

Does It Start Automatically?

Part 35 — Review Service Configuration

Use appropriate Windows administrative tooling to examine selected services.

Security-relevant fields include:

Service Name

Startup Type

Executable

Service Account

Business Owner

Service Account Principle

Avoid unnecessarily running applications as:

Highly Privileged Identity

when:

Restricted Service Identity

would work.

Part 36 — Unquoted Service Path Concept

Security assessments may review service executable paths for insecure configuration.

The broader lesson is:

Service Configuration
      +
Filesystem Permissions
      +
Privilege

must be assessed together.

Do not treat a suspicious-looking path alone as proof of exploitability.

Part 37 — Review Scheduled Tasks

Run:

Get-ScheduledTask

Focus on:

Custom Tasks

Unknown Tasks

Administrative Tasks

Tasks Running as Privileged Users

Scheduled Task Review

For each sensitive task identify:

Task Name

Trigger

Action

Run-As Identity

Executable / Script

Owner

Part 38 — Scheduled Task Security

Potential risks include:

Unknown Script

Writable Script Location

Over-Privileged Run-As Account

Abandoned Task

Unexpected Binary

Finding Example

Finding:
Unmanaged Privileged Scheduled Task

Observation:
A scheduled task runs with elevated
privilege but has no documented technical
owner or current business purpose.

Risk:
The task may provide unnecessary privileged
execution or become difficult to monitor
and maintain securely.

Recommendation:
Validate ownership and necessity, reduce
privilege where possible, and remove
obsolete scheduled tasks.

Part 39 — Review Startup Applications

Run:

Get-CimInstance Win32_StartupCommand

Review:

Name

Command

Location

User

Part 40 — Persistence Awareness

Common Windows persistence locations may include:

Startup Entries

Scheduled Tasks

Services

Registry Run Locations

User Startup Folders

Security analysts should be familiar with these because both:

Legitimate Software

and:

Threat Actors

may use them.

Part 41 — Review Registry Startup Locations

In an authorized training environment, review relevant startup locations through approved Windows tooling.

The purpose is to determine:

What Executes Automatically?

Who Configured It?

Is It Expected?

Is Its File Location Protected?

Part 42 — Persistence Does Not Mean Malware

Remember:

Auto-Start
≠
Malicious

Many legitimate applications use persistence mechanisms.

Assess:

Publisher

Path

Owner

Business Purpose

Creation Time

Security Telemetry

Part 43 — Review Running Processes

Run:

Get-Process

A focused review:

Get-Process |
Sort-Object CPU -Descending |
Select-Object -First 20

Process Analysis Model

PROCESS
  ↓
PATH
  ↓
USER
  ↓
PARENT
  ↓
NETWORK
  ↓
BUSINESS PURPOSE

Part 44 — Review PowerShell Version

Run:

$PSVersionTable

Document the PowerShell environment used for administration.

Part 45 — PowerShell Security

PowerShell is both:

A Powerful Administrative Tool

and:

A Valuable Security Telemetry Source

Security controls may include:

Script Logging

Module Logging

Transcription

Constrained Administration

Code-Signing Policies

depending on organizational design.

Part 46 — PowerShell Execution Policy

Review:

Get-ExecutionPolicy -List

Important

Execution Policy should not be treated as:

A Complete Security Boundary

It is one layer in a broader PowerShell security strategy.

Part 47 — Review Script Locations

If administrative scripts exist, assess:

Owner

Filesystem Permissions

Change Control

Source Control

Secrets

Execution Context

Security Risk

A privileged task executing a script from a location writable by ordinary users can create security problems.

Part 48 — Review Windows Audit Policy

Run:

auditpol /get /category:*

Save:

auditpol /get /category:* |
Out-File C:\WindowsSecurityLab\Evidence\AuditPolicy.txt

Audit Areas

Review categories such as:

Account Logon

Account Management

Logon/Logoff

Object Access

Policy Change

Privilege Use

Process Tracking

System

Part 49 — Audit Design Principle

Ask:

Which Events Matter
for This System's Threat Model?

More logs are not automatically better if:

Nobody Monitors Them

Part 50 — Review Security Event Log

Run:

Get-WinEvent -LogName Security -MaxEvents 100

Do not copy all events into your report.

Identify security-relevant activity.

Security Event Questions

Who?

What?

When?

Where?

Result?

Privilege?

Context?

Part 51 — Review Failed Logons

Look for patterns involving:

Repeated Failures

Unexpected Accounts

Remote Sources

Administrative Accounts

Unusual Times

Important

Failed logons can result from:

User Error

Old Password

Service Configuration

Mapped Drive

Scheduled Task

Credential Guessing

Investigation requires context.

Part 52 — Review Successful Logons

Successful authentication can be more important than failures.

Review suspicious cases such as:

Unexpected Remote Access

Privileged Account Use

Unusual Hours

Unexpected Logon Type

Part 53 — Review Account Changes

Security monitoring should include:

Account Created

Account Enabled

Account Disabled

Password Changed

Group Membership Changed

Part 54 — Review Privilege Changes

Investigate changes involving:

Administrators Group

Remote Desktop Users

Sensitive User Rights

Service Accounts

Part 55 — Review Process Creation Logging

Where appropriately configured, process creation events can help answer:

Which Program Ran?

Which User Ran It?

When?

What Command Was Used?

This can significantly improve incident investigation.

Part 56 — Review Windows Defender Events

Windows Defender-related logs can help identify:

Detection

Remediation

Protection Changes

Configuration Events

Use Event Viewer or approved PowerShell log access.

Part 57 — Review System Events

The System log may help identify:

Service Changes

Driver Problems

Startup Events

Shutdown Events

System Failures

Part 58 — Review Application Events

Application logs can help correlate:

Security Event
      +
Application Behavior

during troubleshooting or investigation.

Part 59 — Time Synchronization

Accurate time is essential for:

Authentication

Logging

Forensics

Incident Timelines

Review:

w32tm /query /status

Security Principle

Poor time synchronization can make event correlation significantly harder.

Part 60 — Review Network Configuration

Run:

Get-NetIPConfiguration

Review:

IP Addresses

DNS Servers

Gateway

Interface

Part 61 — Review DNS

Run:

Get-DnsClientServerAddress

Unexpected DNS configuration can cause:

Authentication Problems

Name Resolution Problems

Security Monitoring Concerns

Part 62 — Review Routes

Run:

Get-NetRoute

Understand:

Default Route

Local Networks

Unexpected Routes

Part 63 — Review Established Connections

Run:

Get-NetTCPConnection |
Where-Object {$_.State -eq "Established"}

Correlate:

Destination

Port

Owning Process

Business Function

Part 64 — Windows Security Baseline

Create an expected-state matrix.

Control	Expected State
Supported OS	Yes
Security Updates	Current
Local Admin	Restricted
Defender	Enabled
Firewall	Enabled
Disk Encryption	Enabled
Audit	Enabled
Unnecessary Services	Disabled
Time Sync	Healthy
Logging	Available

Part 65 — Compare Baseline to Actual State

Example:

Control	Expected	Actual	Result
Local Admin	Restricted	Broad	Fail
Defender	Enabled	Enabled	Pass
Firewall	Enabled	Enabled	Pass
BitLocker	Enabled	Disabled	Fail
Audit Policy	Baseline	Partial	Review
Updates	Current	Delayed	Fail

Part 66 — Prioritize Windows Findings

Consider:

Privilege

Network Exposure

Data Sensitivity

Likelihood

Business Impact

Ease of Abuse

Existing Controls

High-Risk Example

Permanent Local Admin
      +
Unpatched System
      +
Weak Monitoring
      +
Sensitive Data
      ↓
High Priority

Part 67 — Finding: Local Admin

Finding:
Excessive Local Administrative Access

Observation:
A standard user retains permanent local
administrator rights without an approved
business requirement.

Risk:
Credential compromise or malicious code
running in the user's context may gain
elevated control over the endpoint.

Recommendation:
Remove unnecessary permanent privilege and
provide controlled administrative
elevation where required.

Part 68 — Finding: Firewall Gap

Finding:
Required Windows Firewall Profile Disabled

Observation:
A network firewall profile required by the
organization's endpoint baseline is
disabled.

Risk:
The system may accept network traffic not
permitted by the approved host-security
policy.

Recommendation:
Enable the required firewall profile and
validate necessary business application
rules.

Part 69 — Finding: Encryption Gap

Finding:
System Volume Not Encrypted

Observation:
The Windows operating-system volume is not
protected by the organization's approved
full-disk encryption control.

Risk:
Loss or theft of the device may expose
locally stored business data.

Recommendation:
Enable approved disk encryption and
securely manage recovery information.

Part 70 — Finding: Logging Gap

Finding:
Insufficient Windows Security Auditing

Observation:
The endpoint does not record all security
events required by the approved audit
baseline.

Risk:
Security incidents may be more difficult to
detect, investigate, and reconstruct.

Recommendation:
Apply the approved Windows audit policy,
validate event generation, and integrate
required logs with centralized monitoring.

Part 71 — Finding: Unnecessary Service

Finding:
Unnecessary Windows Service Enabled

Observation:
A service remains active despite having no
documented business dependency.

Risk:
Unnecessary services increase system attack
surface and administrative complexity.

Recommendation:
Validate the service requirement and
disable unnecessary components through
approved change management.

Part 72 — Finding: Unmanaged Scheduled Task

Finding:
Unmanaged Privileged Scheduled Task

Observation:
A scheduled task executes with elevated
rights but lacks a documented owner or
current business requirement.

Risk:
The task may provide unnecessary privileged
execution or become a persistence and
maintenance risk.

Recommendation:
Validate ownership, inspect the executed
content, reduce privilege where possible,
and remove obsolete tasks.

Part 73 — Remediation Workflow

For each finding use:

IDENTIFY
  ↓
VALIDATE
  ↓
ASSESS IMPACT
  ↓
BACKUP / ROLLBACK
  ↓
CHANGE
  ↓
TEST
  ↓
MONITOR
  ↓
DOCUMENT

Part 74 — Do Not Harden Blindly

A security setting can break:

Legacy Applications

Authentication

Remote Administration

Business Services

Therefore apply:

TEST
  ↓
PILOT
  ↓
DEPLOY
  ↓
VALIDATE

Part 75 — Validate Local Administrator Changes

After approved remediation:

Get-LocalGroupMember -Group "Administrators"

Compare:

Before

After

Part 76 — Validate Defender

Run:

Get-MpComputerStatus

Confirm the required protection state.

Part 77 — Validate Firewall

Run:

Get-NetFirewallProfile

Confirm expected profiles are enabled.

Part 78 — Validate BitLocker

Run:

Get-BitLockerVolume

Confirm protection state where remediation was performed.

Part 79 — Validate Services

Run:

Get-Service

Confirm unnecessary services were removed or disabled only through approved change procedures.

Part 80 — Validate Audit Policy

Run:

auditpol /get /category:*

Compare against the approved baseline.

Part 81 — Negative Testing

In an authorized disposable lab, confirm security restrictions actually work.

Examples:

Standard User
Cannot Perform Admin-Only Action

Unapproved Inbound Connection
Is Blocked

Disabled Account
Cannot Authenticate

Restricted User
Cannot Use Unauthorized Remote Access

Part 82 — Build System Inventory

Create:

Item	Value
Hostname
Owner
OS
Build
Domain
Business Role
Assessment Date

Part 83 — Build Local Account Matrix

Account	Enabled	Admin	Owner	Required
User-A	Yes	No	Business	Yes
Admin-A	Yes	Yes	IT	Yes
OldSupport	Yes	Yes	Unknown	No

Part 84 — Build Security Control Matrix

Control	Expected	Actual	Status
Defender	Enabled
Firewall	Enabled
BitLocker	Enabled
Audit	Baseline
Updates	Current
Local Admin	Restricted

Part 85 — Build Service Matrix

Service	State	Account	Network	Required
Service-A	Running	Local Service	No	Yes
Service-B	Running	System	Yes	Review

Part 86 — Build Persistence Review Matrix

Mechanism	Item	Owner	Expected	Action
Startup	App-A	IT	Yes	Keep
Scheduled Task	Task-B	Unknown	No	Review
Service	Service-C	App Team	Yes	Keep

Part 87 — Build Network Exposure Matrix

Port	Process	Service	Required	Firewall
Review	Process-A	Service-A	Yes/No	Review

Part 88 — Windows Security Report

Your final report should include:

1. Executive Summary

Document:

System Assessed

Business Role

Overall Security Posture

Highest-Risk Findings

Priority Actions

2. System Information

Document:

Hostname

Operating System

Build

Domain

Owner

Business Function

3. Identity and Privilege

Include:

Local Users

Local Groups

Administrators

Remote Access

Sensitive User Rights

4. Authentication

Document:

Password Policy

Lockout

Administrative Authentication

Credential Management

5. Endpoint Protection

Document:

Defender State

Real-Time Protection

Exclusions

Protection Health

6. Network Security

Document:

Firewall

Inbound Rules

Listening Ports

Established Connections

Network Configuration

7. Encryption

Document:

BitLocker

TPM

Recovery Process

8. Software and Services

Document:

Installed Applications

Running Services

Service Accounts

Unnecessary Components

9. Persistence Review

Document:

Startup Entries

Scheduled Tasks

Services

Other Auto-Start Mechanisms

10. Logging and Auditing

Document:

Audit Policy

Security Events

Defender Logs

System Logs

Time Synchronization

Central Monitoring

11. Findings

For each:

Finding ID

Title

Severity

Observation

Evidence

Risk

Recommendation

Owner

Target Date

Validation

Windows Security Checklist

System

Accounts

Privilege

Applied least-privilege review
Reviewed sensitive user rights
Reviewed remote desktop access
Reviewed privilege separation
Understood Windows LAPS concept

Authentication

Reviewed password policy
Reviewed lockout policy
Reviewed administrative access
Reviewed credential-management practices

Defender

Firewall

Encryption

Reviewed BitLocker
Reviewed system volume
Reviewed recovery process
Reviewed TPM

Patching

Reviewed OS support
Reviewed installed updates
Reviewed patch-management state
Checked maintenance status

Applications

Reviewed installed software
Reviewed application ownership
Identified unnecessary applications
Identified unsupported software

Services

Reviewed running services
Reviewed startup types
Reviewed service identities
Identified unnecessary services
Correlated services with network ports

Persistence

PowerShell

Logging

Reporting

Common Windows Security Mistakes

Avoid:

Giving Users Permanent Local Admin

Reusing Local Admin Passwords

Disabling Firewall to Fix Applications

Creating Broad Defender Exclusions

Ignoring BitLocker

Ignoring Scheduled Tasks

Ignoring Startup Entries

Leaving Unnecessary Services Enabled

Ignoring Unsupported Software

Assuming Every Unknown Process Is Malware

Ignoring Security Logs

Collecting Logs Without Monitoring Them

Hardening Without Testing

Changing Production Security Settings
Without Rollback Planning

Windows Security Maturity Model

Level 1 — Basic

Supported Windows

Patching

Antivirus

Firewall

Level 2 — Hardened

Disk Encryption

Least Privilege

Security Baseline

Service Reduction

Audit Policy

Level 3 — Managed

Central Endpoint Management

Credential Management

Security Telemetry

Configuration Enforcement

Compliance Monitoring

Level 4 — Enterprise Security

EDR / XDR

Privileged Access Management

Automated Detection

Continuous Hardening

Centralized Incident Response

Career Connection

This lab directly supports:

Windows Security Engineer

Endpoint Security Engineer

Microsoft Security Engineer

SOC Analyst

Incident Responder

Security Consultant

Windows Administrator

Cloud Security Engineer

Interview Scenario 01

Why is local administrator access a security risk?

Because it may allow:

Software Installation

Security Control Modification

Credential Access

Persistence

System-Wide Changes

Interview Scenario 02

What is Windows LAPS intended to improve?

It helps organizations manage local administrator passwords so systems do not rely on the same unmanaged local credential across many devices.

Interview Scenario 03

Why should Windows services be reviewed?

Because services can:

Run Automatically

Use Privileged Accounts

Listen on the Network

Increase Attack Surface

Interview Scenario 04

What is the difference between logging and monitoring?

Logging
=
Recording Events

Monitoring
=
Analyzing Events
for Security-Relevant Activity

Interview Scenario 05

How would you investigate an unknown Windows startup item?

Review:

Name

Executable Path

Publisher

Owner

User

Creation Context

Business Purpose

Security Telemetry

before determining whether it is legitimate or suspicious.

40 Windows Security Interview Questions

What is Windows security?
Why should Windows systems use a security baseline?
What is least privilege?
Why are local administrators risky?
What is Windows LAPS?
Why is local administrator password reuse dangerous?
What is Local Security Policy?
What are user rights assignments?
What is account lockout?
Why should RDP access be restricted?
What is Microsoft Defender Antivirus?
What is real-time protection?
Why are Defender exclusions important to review?
What is Windows Firewall?
What are firewall profiles?
How do you identify listening ports?
How do you map a port to a process?
What is BitLocker?
Why is BitLocker recovery important?
What is TPM?
Why is Windows patching important?
What is attack-surface reduction?
Why should unnecessary applications be removed?
Why should unnecessary services be disabled?
What is a Windows service account?
What is a scheduled task?
Why are scheduled tasks security relevant?
What are startup entries?
What is persistence?
Does persistence automatically mean malware?
Why is PowerShell important for security?
Is PowerShell Execution Policy a complete security control?
What is Windows audit policy?
Why are Windows Security logs important?
What information is useful in process-creation logging?
Why is time synchronization important?
How would you investigate repeated failed logons?
How would you review Windows remote access?
How would you validate Windows hardening changes?
How would you perform a Windows security assessment?

Final Windows Security Mental Model

When assessing Windows, ask:

WHAT SYSTEM IS THIS?
      ↓
WHO CAN LOG IN?
      ↓
WHO IS ADMIN?
      ↓
HOW IS AUTHENTICATION CONTROLLED?
      ↓
IS THE OS SUPPORTED?
      ↓
IS IT PATCHED?
      ↓
IS DEFENDER ACTIVE?
      ↓
IS THE FIREWALL ACTIVE?
      ↓
IS THE DISK ENCRYPTED?
      ↓
WHAT SOFTWARE EXISTS?
      ↓
WHAT SERVICES RUN?
      ↓
WHAT PORTS LISTEN?
      ↓
WHAT STARTS AUTOMATICALLY?
      ↓
WHAT IS AUDITED?
      ↓
CAN SECURITY EVENTS BE INVESTIGATED?

Mission Accomplished

You have now completed the Microsoft security lab sequence:

Lab 01 — Active Directory
        ↓
Lab 02 — Endpoint Security
        ↓
Lab 03 — Identity Security
        ↓
Lab 04 — Microsoft 365 Security
        ↓
Lab 05 — Windows Security

Across these labs, you have worked through:

Active Directory

Endpoint Security

Cloud Identity

Microsoft 365

Windows Host Security

The key lesson from this final lab is:

Windows Security
Is Not a Single Setting
or Security Product

It is the coordinated protection of:

IDENTITY
   +
AUTHENTICATION
   +
PRIVILEGE
   +
CONFIGURATION
   +
ENDPOINT PROTECTION
   +
NETWORK
   +
DATA
   +
LOGGING
   +
MONITORING

What’s Next?

➡️ Runbook 01 — Active Directory Assessment

You will now move from guided labs into repeatable professional security procedures.

The first runbook will provide a structured methodology for assessing an enterprise Active Directory environment.

You will work through:

Assessment Preparation
      ↓
Domain Discovery
      ↓
Domain Controller Review
      ↓
User Assessment
      ↓
Privileged Group Review
      ↓
Service Account Review
      ↓
Computer Review
      ↓
OU and Delegation Review
      ↓
Group Policy Review
      ↓
Authentication Review
      ↓
Logging and Monitoring
      ↓
Risk Prioritization
      ↓
Remediation
      ↓
Retesting
      ↓
Final Security Report

Your Microsoft runbook sequence begins:

Runbook 01 — Active Directory Assessment
        ↓
Runbook 02 — Microsoft 365 Security Review
        ↓
Runbook 03 — Windows Security Assessment