Introduction to Windows configuration audits
You audit local administrators, UAC, services, updates, the firewall, endpoint protection and shares on a Windows machine with PowerShell, read the event logs and apply a first round of hardening.
Level 101 · 13 lessons · 12 practice labs
Lessons
Getting to know Windows
- Local accounts and groups: who is in Administrators
- Why User Account Control matters
- Windows services and the accounts they run as
- Short task: audit the local administrators group and remove the extras
Basic audits
- Auditing update status
- Auditing Windows Firewall profiles
- Verifying the state of endpoint protection
- Auditing shared folders and their permissions
- Basic audit commands in PowerShell
- Short task: produce a baseline report for a Windows machine
Logs and report
- Logon records in the event logs
- Introduction to security baselines
- Capstone: audit a Windows server and apply the first hardening
Practice labs
- Audit the local Administrators group and remove extras: Compare members with job needs, remove the unneeded one and confirm the change in the event log.
- Audit and fix User Account Control settings: Read UAC registry values, set the recommended level and confirm the admin consent prompt appears.
- Audit the accounts Windows services run as: Find a service running as a user with admin rights, move it to a virtual or managed account and confirm it runs.
- Report the Windows machine's update state: Pull installed updates and last install date with PowerShell and flag the missing security update.
- Audit firewall profiles and enable the disabled one: Check domain, private and public profile states, enable the disabled one and remove the unneeded inbound rule.
- Verify endpoint protection status and exclusions: Check real-time protection, signature date and exclusion list, and remove an overly broad exclusion.
- List shared folders and their permissions: Put the machine's shares with share and NTFS permissions into a table.
- Find a share writable by Everyone and tighten it: Find the share giving Everyone write access, limit it to the right group and confirm a non-member is refused.
- Find and report sensitive files exposed on shares: Find widely accessible sensitive files on Sedirli Hukuk Bürosu's file server shares, restrict access and report.
- Read logon records in the event logs: Summarise successful and failed logon events by account and logon type.
- Compare the machine with a security baseline: Compare baseline settings with the current policy and list ten that differ.
- Audit a Windows server and apply the first hardening: Fix account, update, firewall and share findings and write the status report as before and after.
About this course
You audit local administrators, UAC, services, updates, the firewall, endpoint protection and shares on a Windows machine with PowerShell, read the event logs and apply a first round of hardening.
What you will learn
- Getting to know Windows
- Basic audits
- Logs and report
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.