Finding and closing privilege misconfigurations on Windows
You audit and close service, registry and scheduled-task permissions, unquoted paths, credentials left on disk and risky user rights on Windows, roll out LAPS and credential protections, and monitor with Sysmon and the audit policy.
Level 201 · 17 lessons · 15 practice labs
Lessons
Services
- Auditing service permissions: who can change them
- Finding and fixing unquoted service paths
- Write permissions on service program files
- Short task: find and fix two services with wrong permissions
Registry and tasks
- Risky permissions on registry keys
- Auditing and disabling the AlwaysInstallElevated policy
- Scheduled task accounts and script permissions
- Auditing items that run at startup
- Short task: close the misconfigurations in the registry and tasks
Credentials
- Credentials left on disk: answer files and scripts
- Making local admin passwords unique with LAPS
- Credential protections: LSA protection and Credential Guard
- Risky user rights: SeImpersonate, SeBackup and others
- Short task: find and remove exposed credentials on the server
Detection
- Monitoring privilege changes with Sysmon
- Advanced audit policy settings
- Capstone: audit and close the privilege paths on a Windows server
Practice labs
- Find and fix an unquoted service path: Find a service with an unquoted path containing spaces, quote it and confirm the service starts.
- Audit service permissions: who can change them: Find a service a standard user can reconfigure, fix its permissions and confirm the change is refused.
- Fix write permissions on service program files: Find two service binaries or folders writable by unprivileged users, fix the permissions and re-audit.
- Audit and disable the AlwaysInstallElevated policy: Check the values in both hives, disable the policy and confirm the values are gone.
- Find and remove risky registry key permissions: Find write permission for standard users on service and startup keys and fix it.
- Audit scheduled tasks and startup items: Find a high-privilege task calling a writable script and a suspicious startup item, fix them and report.
- Find and remove credentials left on disk: Find plaintext passwords in setup answer files and scripts, clean them and change the affected password.
- Make local admin passwords unique with LAPS: Enable LAPS on lab machines and confirm the password rotates and only the authorised group can read it.
- Enable LSA protection and narrow risky user rights: Enable LSA protection, remove rights like SeImpersonate and SeBackup from accounts that do not need them and verify the policy.
- Monitor privilege changes with Sysmon: Install Sysmon with the lab config, generate a service-creation event and find the record.
- Complete advanced audit policy settings: Enable auditing for group membership, service installs and privilege use and confirm events reach the log.
- Audit and close privilege paths on a Windows server: Close service, registry, task and credential findings on Mercanköşk Otelcilik's server and report with detection evidence.
- Run an automated privilege audit on a Windows server and triage it: Sort the local audit script's output into service, registry, task and credential sections and pick the top five tasks.
- Verify the automated audit's findings by hand: Check permissions and configuration of five findings by hand, separate real ones from false alarms and record evidence.
- Re-audit after fixes and write a closure report: Repeat the audit for fixed findings on Kuzeyyıldızı Kargo's server, assign what remains to owners and report.
About this course
You audit and close service, registry and scheduled-task permissions, unquoted paths, credentials left on disk and risky user rights on Windows, roll out LAPS and credential protections, and monitor with Sysmon and the audit policy.
What you will learn
- Services
- Registry and tasks
- Credentials
- Detection
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.