Unit 2: Windows Security, User Management, and Networking

I. Security and Administration Foundations

Windows security is based on identifying users and devices, authenticating them, assigning permissions, reducing unnecessary privilege, and recording important activity. These controls apply to standalone computers, workgroups, and centrally managed Active Directory domains.

• Identity: Each user, group, computer, and service security principal is represented internally by a Security Identifier (SID).
• Authentication: Credentials or cryptographic evidence establish that a user or device is who it claims to be.
• Authorization: Access control entries determine what an authenticated security principal may do.
• Least privilege: Users and processes should receive only the rights required for their duties.
• Defense in depth: Defender, UAC, Firewall, permissions, auditing, and updates provide overlapping protection.
• Accountability: Event logs and audit policies create records for troubleshooting and incident analysis.
• Administrative scope: Local settings affect one computer; domain Group Policy can manage many computers centrally.

II. Identity and Authentication — Establishing Who May Use Windows

A. User accounts and group management

User accounts identify individual users, while groups simplify the assignment of permissions and administrative rights.

• Local accounts: Stored in the local Security Accounts Manager database and valid primarily on that computer; list them with net user.
• Domain accounts: Stored in Active Directory and centrally managed by domain controllers.
• Microsoft accounts: Cloud-linked accounts commonly used on personal Windows devices for synchronization and Microsoft services.
• Built-in accounts: Windows includes accounts such as Administrator and Guest; the Guest account is normally disabled.
• Groups: Permissions assigned to a group apply to its members, reducing repeated account-level configuration.
  • Administrators members have extensive local control.
  • Users members receive standard interactive access.
  • Remote Desktop Users members may receive RDP logon rights.
• Management tools: Use Settings, Control Panel, lusrmgr.msc, PowerShell, or commands such as:

Get-LocalUser
Get-LocalGroupMember -Group "Administrators"
Add-LocalGroupMember -Group "Remote Desktop Users" -Member "Analyst"

• Account hygiene: Disable unused accounts, rename or protect privileged accounts, require suitable passwords, and avoid everyday use of administrator accounts.

B. Authentication methods

Authentication validates identity before Windows creates a logon session and access token.

• Passwords: A memorized secret; security depends on length, uniqueness, protected storage, and resistance to guessing.
• Windows Hello: Uses a device-bound PIN or biometrics such as fingerprint and facial recognition; the PIN is tied to that device.
• Security keys and smart cards: Use cryptographic credentials, often protected by a PIN, to resist password theft.
• Multifactor authentication: Combines different factor types: knowledge, possession, and inherence.
• Kerberos: Preferred domain authentication protocol; a Key Distribution Center issues time-limited tickets without repeatedly sending the password.
• NTLM: Challenge-response authentication retained for compatibility; it is generally less desirable than Kerberos.
• Logon types: Interactive, network, service, batch, and remote-interactive logons create different security contexts.
• Access token: After successful logon, Windows constructs a token containing the user SID, group SIDs, privileges, and integrity level.

III. Authorization — Controlling Access to Windows Objects

A. Permissions and access control (ACLs, NTFS permissions)

Windows authorizes access by comparing a process token with the access control list attached to an object.

• Security descriptor: Stores an object’s owner and its discretionary and system access control lists.
• DACL: Contains Access Control Entries that allow or deny rights to users and groups; a missing DACL can permit unrestricted access, while an empty DACL permits none.
• SACL: Specifies which successful or failed access attempts should be audited.
• NTFS permissions: Common file and folder rights include Full control, Modify, Read and execute, Read, and Write.
• Inheritance: Child objects normally inherit entries from their parent folder, producing consistent directory-tree permissions.
• Effective access: Windows evaluates user and group entries together; explicit deny entries generally override conflicting allows.
• Ownership: Owners can normally modify an object’s permissions even when ordinary access is restricted.
• Least privilege: Grant rights to groups rather than individuals and avoid broad entries such as Everyone: Full Control.
• Inspection: icacls displays or changes NTFS permissions:

icacls C:\Data
icacls C:\Data /grant Analysts:(OI)(CI)M

Here, M means Modify, OI applies inheritance to files, and CI applies it to subdirectories.

IV. Host Protection — Built-In Defensive Controls

A. Built-in security tools (Windows Defender, UAC, Firewall)

Windows combines malware prevention, privilege control, and traffic filtering to reduce compromise.

• Microsoft Defender Antivirus: Provides real-time scanning, signatures, behavior monitoring, quarantine, and scheduled scans.
• Defender updates: Security intelligence and platform updates should remain current; outdated signatures reduce detection effectiveness.
• UAC: User Account Control requests consent or administrator credentials when a process requires elevation.
  • Standard users provide administrative credentials.
  • Administrators normally approve a consent prompt.
• UAC limitation: It reduces silent elevation but is not a complete security boundary or substitute for least privilege.
• Windows Defender Firewall: Applies stateful inbound and outbound rules by program, port, protocol, address, and profile.
• Network profiles: Domain, Private, and Public profiles permit different rules; Public should normally be most restrictive.
• Administration: Use Windows Security, wf.msc, or PowerShell:

Get-MpComputerStatus
Get-NetFirewallProfile
Get-NetFirewallRule -Enabled True

V. Windows Network Services — Addressing, Naming, and Communication

A. Windows networking basics: IP configuration, DNS, DHCP, NetBIOS, and SMB protocol

Windows networking depends on correct addressing, name resolution, configuration services, and application protocols.

• IP configuration: An IPv4 host needs an address, subnet mask, and usually a default gateway and DNS server.
  • 192.168.1.25/24 identifies the host; /24 corresponds to 255.255.255.0.
  • The default gateway routes traffic beyond the local subnet.
• DNS: Resolves names such as server.example.local into IP addresses; inspect configuration with ipconfig /all and query with nslookup.
• DHCP: Automatically leases addresses and options through the DORA sequence: Discover, Offer, Request, Acknowledge.
• APIPA: If DHCP fails, Windows may self-assign an IPv4 address in 169.254.0.0/16, which usually indicates limited connectivity.
• NetBIOS: A legacy naming and session technology used by older Windows networks; modern environments generally prefer DNS.
• SMB: Server Message Block provides file, printer, and named-pipe access, normally over TCP port 445.
• Security: Prefer current SMB versions, disable obsolete SMBv1, restrict port 445, and use SMB signing or encryption where required.

ipconfig /all
nslookup fileserver
net use \\fileserver\reports

VI. Resource Sharing — Providing Controlled Network Access

A. Shared resources management

Shared resources allow authorized network users to access folders and printers through UNC paths.

• UNC path: Uses the form \\server\share\folder, independent of a mapped drive letter.
• Share creation: Create shares through folder properties, Computer Management, net share, or PowerShell.
• Share permissions: Control network access using Read, Change, or Full Control.
• Combined permissions: For SMB access to an NTFS volume, both share and NTFS permissions apply; the most restrictive effective result governs access.
• Administrative shares: Shares such as C$ and ADMIN$ support remote administration and normally require administrative credentials.
• Sessions and files: Computer Management can display connected users, open files, and active shares.
• Safer design: Assign access to groups, expose only required folders, avoid anonymous access, and audit sensitive shares.

VII. Remote Administration — Interactive and Command-Based Control

A. Remote access tools (RDP, PsExec)

Remote administration tools extend control across the network but create valuable attack paths that require strict protection.

1. RDP:

   • Purpose: Remote Desktop Protocol provides an interactive graphical session, normally using TCP and UDP port 3389.
   • Controls: Enable Network Level Authentication, restrict permitted users, require strong authentication, and limit exposure through firewalls or a VPN.
   • Client: Launch the Windows client with mstsc.

2. PsExec:

   • Purpose: Microsoft Sysinternals PsExec starts processes on local or remote systems and is not installed with Windows by default.
   • Operation: Remote use typically depends on administrative credentials, SMB connectivity, and service creation.
   • Risk: Administrators use it legitimately, but attackers may use the same behavior for lateral movement.

psexec \\PC23 -u DOMAIN\Admin cmd.exe

VIII. Administrative Consoles — Managing System Configuration

A. Windows administrative tools (MMC, Services.msc, Group Policy Editor)

Windows administrative consoles provide structured interfaces for configuring computers, services, users, and policies.

• MMC: Microsoft Management Console hosts snap-ins such as Event Viewer, Certificates, Disk Management, and Local Users and Groups.
• Custom consoles: Running mmc allows an administrator to combine selected snap-ins into a saved console.
• Services.msc: Displays installed services, current state, startup type, dependencies, and logon account.
• Service startup types: Automatic, Automatic (Delayed Start), Manual, and Disabled determine when a service may start.
• Service security: Unquoted paths, weak executable permissions, or excessive service accounts can create privilege-escalation risks.
• Group Policy Editor: gpedit.msc configures local Computer Configuration and User Configuration policies; it is unavailable in some Home editions.
• Domain policy: Active Directory Group Policy Objects centrally enforce settings across sites, domains, and organizational units.

IX. Logging and Auditing — Recording Security-Relevant Activity

A. Introduction to Windows Event Logs for incident analysis

Windows Event Logs provide timestamped evidence about authentication, applications, services, and operating-system activity.

• Core logs: Event Viewer exposes Application, Security, System, Setup, and Forwarded Events.
• Security log: Records events enabled by audit policy, such as logons, account changes, and process creation.
• Useful event IDs: 4624 indicates successful logon, 4625 failed logon, and 4688 process creation when corresponding auditing is enabled.
• Event fields: Analyze timestamp, provider, event ID, account, logon type, computer, source address, and process details together.
• Correlation: A single event rarely proves an incident; compare related events across hosts and preserve timezone context.
• Native tools: Use eventvwr.msc, wevtutil, or PowerShell:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20

B. Basic audit policies

Audit policies select which security events Windows records and whether successful attempts, failed attempts, or both are logged.

• Categories: Common categories include Logon/Logoff, Account Management, Object Access, Policy Change, Privilege Use, and Process Tracking.
• Advanced audit policy: Provides granular subcategories, such as Audit Process Creation or Audit File System.
• Object auditing: Requires both an enabled Object Access policy and suitable SACL entries on the target object.
• Balance: Excessive auditing creates noise and storage pressure; insufficient auditing leaves investigative gaps.
• Configuration: Review settings with:

auditpol /get /category:*

• Retention: Size logs appropriately, protect access, centralize important events, and prevent routine overwriting from destroying evidence.

X. Automatic Execution — Scheduled and Startup Programs

A. Scheduled tasks

Scheduled tasks launch programs in response to time schedules, user activity, startup, logon, or recorded events.

• Components: A task contains triggers, actions, conditions, settings, and a security context.
• Management: Use Task Scheduler, taskschd.msc, schtasks, or PowerShell scheduled-task cmdlets.
• Privileges: Tasks may run whether a user is logged on and may request highest available privileges.
• Security relevance: Unexpected executables, hidden tasks, unusual accounts, or writable action paths can indicate persistence or misconfiguration.
• Enumeration:

schtasks /query /fo LIST /v

B. Startup items

Startup items run automatically during boot or user logon and therefore affect performance, reliability, and security.

• Common locations: Startup folders, registry Run keys, services, scheduled tasks, and Winlogon-related settings.
• Registry keys: Frequently inspected locations include HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the equivalent HKLM path.
• Management: Task Manager’s Startup apps page shows status and startup impact for common entries.
• Analysis: Check publisher, executable path, signature, command-line arguments, and whether ordinary users can modify the file.
• Caution: An unfamiliar entry is not automatically malicious; validate its origin before disabling or deleting it.

XI. Native Enumeration — Establishing System and Network Context

A. Basic enumeration and reconnaissance using native tools (whoami, netstat, ipconfig, tasklist)

Native commands quickly establish identity, network state, connections, and running processes without additional software.

• whoami: Displays the current identity; /all adds SIDs, groups, privileges, and integrity information.
• ipconfig: Shows interface addressing; /all includes DHCP, DNS, gateway, and MAC address details.
• netstat: Lists connections and listening ports; -a shows all endpoints, -n avoids name resolution, and -o includes process IDs.
• tasklist: Lists processes, PIDs, session information, and memory usage; /svc maps many services to their hosting processes.
• Correlation: Match a suspicious netstat -ano PID to tasklist /fi "PID eq 4321" to identify the associated process.
• Operational use: Administrators use these commands for troubleshooting and incident triage; attackers may use the same commands for discovery.

whoami /all
ipconfig /all
netstat -ano
tasklist /svc