Windows security basics: accounts, UAC, Defender
You get to know a Windows computer’s security settings from scratch and learn to check local accounts, UAC, Microsoft Defender, the firewall and updates.
Level 101 · 14 lessons · 18 practice labs
Lessons
Accounts and privileges
- The Windows security model: users, groups, SIDs and access tokens
- Local accounts and the Administrators group
- User Account Control (UAC): why you shouldn’t always be admin
- NTFS permissions and icacls
- Short task: find unneeded admin accounts and make them standard users
Built-in protection
- Microsoft Defender Antivirus: scans, real-time protection, history
- Querying Defender status with PowerShell: Get-MpComputerStatus
- Windows Firewall: profiles and rules
- Checking Windows Update and patch status
- Short task: find the Defender protection that was switched off and turn it back on
Auditing
- Event Viewer: reading the Security log
- Logon events: 4624 and 4625
- Reviewing installed software and startup programs
- Capstone: run a security check on a Windows laptop
Practice labs
- Turn unneeded admin accounts into standard users: List the local Administrators group, remove two accounts whose job does not need it and show the result.
- Find a hidden local admin account: Use PowerShell to find an account that is in Administrators but hidden from the user list, and disable it.
- Find that UAC was turned off and turn it back on: Check the UAC values in the registry, restore the disabled setting and show the admin approval prompt returns.
- Remove the Everyone write permission on a shared folder: Read the folder permissions with icacls, remove Everyone write and show only the accounting group can write.
- Find a subfolder permission opened up by inheritance: Spot a broad inherited permission, break inheritance, set the correct rights and prove the result with icacls.
- Find the disabled real-time protection and turn it on: Detect the disabled protection with Get-MpComputerStatus, turn it back on and query the status again.
- Remove a suspicious exclusion added to Defender: Find the Downloads folder in the exclusion list, remove it and show the test file is now caught.
- Work out what happened from Defender’s history: Review threat history and the event log and list which file was caught when and under which user.
- Turn on the disabled Windows Firewall profile: Check the three profiles, enable the disabled one and show inbound connections are blocked by default.
- Narrow the rule that allows RDP from anywhere: Limit the RDP rule’s remote address scope to the management network and show a connection from elsewhere fails.
- Find password guessing in 4625 records: Count failed logons in the Security log and identify the top source and the targeted account.
- Find a user’s last logon time: Filter the user’s 4624 records in the Security log and note the time and type of the last logon.
- Catch the successful logon that follows the failures: Find the 4624 from the same source after a run of 4625s and record its logon type and time.
- Secure the built-in Administrator account and replace it with a named one: Find from the event log where the built-in account is used, move that work to a named admin account, disable the built-in one and show no service broke.
- Prove who can really do what on the accounting folder: Combine share and NTFS permissions to work out the effective access of three users, remove the excess right and confirm it with the effective access tool.
- Find the local firewall rule overridden by Group Policy: Work out why a port that looks closed locally stays open by examining policy-sourced rules, and record the profile, rule source and fix.
- Read the UAC level on this machine: Find the UAC setting in the registry and Control Panel and state which level it is at.
- Find what turned UAC off and stop it happening again: Find from event logs and policy results who or which script changed the setting, fix it with Group Policy and show a local change is reverted.
About this course
You get to know a Windows computer’s security settings from scratch and learn to check local accounts, UAC, Microsoft Defender, the firewall and updates.
What you will learn
- Accounts and privileges
- Built-in protection
- Auditing
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.