Unit 2: Windows Security, User Management, and Networking - Subjective Questions

A Windows user account is an identity that allows a person or service to sign in to Windows and access permitted resources. Each account is associated with a unique Security Identifier (SID).

• Administrator account: Can install software, modify system settings, manage users, and access protected resources. It should be used only for administrative work.
• Standard user account: Can run applications and change personal settings but cannot normally make system-wide changes.
• Guest account: Provides limited temporary access. It is disabled by default on modern Windows systems because it can introduce security risks.
• Service account: Used by applications or Windows services to run background processes.
• Microsoft account: A cloud-connected account that supports synchronization and Microsoft services.
• Local account: Exists only on a specific computer.
• Domain account: Centrally managed through Active Directory and usable across authorized domain resources.

Following the principle of least privilege, users should normally work with standard accounts and elevate privileges only when necessary.

Windows users and groups can be managed through Settings, Control Panel, Computer Management, command-line tools, PowerShell, or Active Directory tools in a domain.

Common local commands include:

• net user to list or manage user accounts.
• net localgroup to list or manage local groups.
• lusrmgr.msc to open Local Users and Groups on supported editions.

A group is a collection of accounts that can be assigned common rights and permissions. Examples include Administrators, Users, Remote Desktop Users, and Backup Operators.

Group-based administration is preferred because it:

• Assigns permissions consistently to many users.
• Reduces repetitive administrative work.
• Simplifies onboarding and removal of users.
• Makes access reviews and audits easier.
• Reduces errors caused by assigning permissions directly to individuals.

A good practice is to place users into role-based groups and assign permissions to those groups.

Authentication verifies that a user or device is who it claims to be. Windows supports several authentication methods:

• Password: A secret character sequence. It is widely supported but vulnerable to guessing, phishing, reuse, and credential theft.
• Windows Hello PIN: A device-bound credential protected by the Trusted Platform Module where available. Unlike a normal password, it is not directly transmitted to a remote server.
• Biometrics: Fingerprint or facial recognition through Windows Hello. It is convenient and tied to supported hardware.
• Smart card: A physical card containing cryptographic credentials. It offers strong authentication but requires card readers and certificate infrastructure.
• Multifactor authentication: Combines two or more factors, such as something the user knows, has, or is.

Multifactor authentication provides stronger protection because stealing one factor is not normally enough to gain access. Secure environments should also enforce account lockout, strong credential policies, and phishing-resistant authentication where possible.

An Access Control List (ACL) is a list of Access Control Entries attached to a securable Windows object, such as a file, folder, registry key, or shared resource. Each entry identifies a security principal and specifies permissions or auditing rules.

• Discretionary Access Control List (DACL): Determines who is allowed or denied access to an object. For example, it may allow a group to read a folder while denying another account permission to modify it.
• System Access Control List (SACL): Specifies which access attempts should be audited. It can record successful access, failed access, or both in the Security event log.

An Access Control Entry may contain:

• A user or group SID.
• An allow, deny, or audit rule.
• A set of permissions.
• Inheritance settings.

If an object has no DACL, access may be unrestricted. If it has an empty DACL, access is denied to everyone.

NTFS permissions control access to files and folders stored on an NTFS volume. Standard permissions include Full control, Modify, Read and execute, List folder contents, Read, and Write.

Important rules include:

• Permissions may be assigned to users or groups.
• A user normally receives the combined allowed permissions of all groups to which the user belongs.
• An explicit Deny generally overrides an Allow for the same permission.
• Explicit permissions normally take precedence over inherited permissions.
• Child files and folders can inherit permissions from their parent folder.
• Inheritance can be disabled, after which inherited entries may be converted into explicit entries or removed.

Effective access also depends on ownership, privileges, group membership, and share permissions when the resource is accessed over a network. Administrators can inspect permissions through the Security tab and use Advanced Security Settings to evaluate effective access.

NTFS permissions apply to local and network access on an NTFS volume. Share permissions apply only when a folder is accessed through an SMB network share.

Share permissions commonly include:

• Read: View files and run programs.
• Change: Read, create, modify, and delete content.
• Full Control: Includes Change and permission-management capabilities at the share level.

When a user accesses a shared folder over the network, both share and NTFS permissions are evaluated. The effective result is the most restrictive combination of the two permission sets. For example, if share permissions allow Change but NTFS permissions allow only Read, the user receives Read access.

A common administration model is to keep share permissions broad for authenticated users and enforce detailed access through NTFS permissions. Access should be tested using the identity of the intended user.

These built-in tools provide different layers of Windows security:

• Microsoft Defender Antivirus: Detects, blocks, quarantines, and removes malware. It supports real-time protection, scheduled scanning, signature updates, and cloud-delivered protection.
• User Account Control (UAC): Requires approval or administrator credentials before a process performs privileged system changes. It reduces the chance that applications silently gain administrative rights.
• Windows Defender Firewall: Filters inbound and outbound network traffic according to rules. It supports Domain, Private, and Public network profiles.

They are complementary rather than interchangeable. Antivirus addresses malicious files and behavior, UAC controls privilege elevation, and the firewall limits network communication. Effective protection also requires patching, least privilege, secure configuration, and regular monitoring.

Windows Firewall uses three network profiles:

• Domain: Applied when the computer authenticates to its Active Directory domain.
• Private: Applied to trusted networks such as an approved home or office network.
• Public: Applied to untrusted networks and normally uses the most restrictive settings.

Firewall rules can filter traffic by direction, protocol, local or remote port, application, service, address, interface, user, and profile.

To allow a required service safely, an administrator should:

1. Identify the exact executable, protocol, port, direction, and network endpoints required.
2. Create a narrowly scoped allow rule.
3. Apply it only to the necessary profiles.
4. Restrict remote addresses where possible.
5. Avoid disabling the firewall globally.
6. Test the application and inspect firewall logs.
7. Document and periodically review the rule.

The objective is to provide required connectivity while minimizing exposed services.

The main IPv4 configuration values serve different purposes:

• IP address: Identifies a network interface on an IP network.
• Subnet mask: Determines which part of the IPv4 address represents the network and which part represents the host.
• Default gateway: A router used to reach destinations outside the local subnet.
• DNS server: Resolves host names, such as server.example.com, into IP addresses.

For example, a host configured as 192.168.1.25 with mask 255.255.255.0 treats addresses in 192.168.1.0/24 as local. Traffic for another network is normally sent to the default gateway.

The command ipconfig /all displays detailed interface configuration. Useful diagnostic commands also include ping, tracert, nslookup, and Get-NetIPConfiguration.

Dynamic Host Configuration Protocol (DHCP) automatically supplies network settings such as an IP address, subnet mask, default gateway, DNS servers, and lease duration.

The initial IPv4 lease process is commonly described as DORA:

1. Discover: The client broadcasts a request to locate DHCP servers.
2. Offer: A DHCP server offers an available address and configuration.
3. Request: The client requests the offered address.
4. Acknowledge: The server confirms the lease and provides the final settings.

A lease is temporary, so the client attempts to renew it before expiration. Windows commands include ipconfig /release to release an IPv4 lease and ipconfig /renew to request one.

If DHCP fails, Windows may assign an Automatic Private IP Address in the 169.254.0.0/16 range. Such an address usually indicates that the client could not contact a DHCP server.

DNS is the standard hierarchical naming system used to resolve fully qualified domain names to IP addresses. It supports modern Internet, Active Directory, and enterprise networking.

NetBIOS is an older Windows networking interface associated with short computer names and legacy name-resolution methods. NetBIOS over TCP/IP may use broadcasts, a WINS server, or cached information.

Key differences include:

• DNS uses hierarchical names such as host.example.com; NetBIOS names are generally short, flat names.
• DNS typically uses port 53; NetBIOS services historically use ports 137, 138, and 139.
• DNS scales across large and routed networks; broadcast-based NetBIOS resolution does not scale well.
• Modern SMB can operate directly over TCP port 445 without NetBIOS.

Legacy NetBIOS support should be disabled when it is unnecessary because it expands the attack surface and can enable spoofing or information disclosure.

Server Message Block (SMB) is a network protocol used by Windows for file sharing, printer sharing, named pipes, and access to other shared resources.

Important points include:

• Modern SMB normally uses TCP port 445.
• Older SMB over NetBIOS may use TCP port 139 and related NetBIOS ports.
• Users access resources through UNC paths such as \\SERVER01\Finance.
• Access depends on authentication plus share and NTFS permissions.
• Windows commonly uses Kerberos in a domain or may fall back to NTLM in some situations.

Security risks include weak permissions, exposed administrative shares, credential theft, relay attacks, unpatched vulnerabilities, and insecure legacy SMB versions. Administrators should disable SMBv1, apply security updates, restrict port 445, use SMB signing or encryption where appropriate, enforce least privilege, and monitor share access.

A shared resource allows authorized network users to access a folder, printer, or other service. A folder can be shared through File Explorer, Computer Management, PowerShell, or the net share command.

Secure management involves:

• Giving the share a clear and controlled name.
• Assigning access to security groups instead of individual users where practical.
• Configuring both share and NTFS permissions.
• Applying the principle of least privilege.
• Avoiding broad permissions such as Full Control for Everyone.
• Reviewing active sessions and open files through Shared Folders in Computer Management.
• Removing obsolete shares and permissions.
• Auditing access to sensitive data.
• Restricting SMB traffic with firewall rules.

Administrative shares such as C$ and ADMIN$ are intended for authorized administration and should not be exposed to untrusted networks.

Remote Desktop Protocol (RDP) provides an interactive graphical session on a remote Windows computer. PsExec, part of Microsoft Sysinternals, starts processes or commands on local or remote systems, typically using administrative access and Windows networking services.

Comparison:

• RDP is suitable for graphical administration; PsExec is suitable for command execution and automation.
• RDP commonly uses TCP and UDP port 3389; PsExec commonly depends on SMB access, administrative shares, and service-control mechanisms.
• RDP creates a user session; PsExec may create a temporary service to launch a process.

Security precautions include:

• Permit access only to authorized administrators.
• Use strong authentication and Network Level Authentication for RDP.
• Require multifactor authentication through an approved remote-access gateway where possible.
• Restrict access using firewalls, VPNs, and network segmentation.
• Avoid exposing RDP or SMB directly to the Internet.
• Monitor remote logons, service creation, and administrative-share activity.
• Use PsExec only with explicit authorization because attackers also misuse it for lateral movement.

Microsoft Management Console (MMC) is a framework that hosts administrative snap-ins. Administrators can create custom consoles containing tools such as Event Viewer, Device Manager, Certificates, and Computer Management.

Services.msc is an MMC-based console for managing Windows services. It can display service status, startup type, dependencies, and logon accounts. Services may be started, stopped, paused, or restarted when permissions allow.

Group Policy Editor manages policy-based configuration:

• gpedit.msc edits Local Group Policy on supported Windows editions.
• Domain Group Policy is centrally managed through Active Directory tools.
• Policies can configure security settings, scripts, firewall rules, auditing, software behavior, and user restrictions.

These tools should be run with appropriate privileges, and significant changes should be documented and tested before broad deployment.

Windows records operating system, application, and security activity as events. Event Viewer can be opened with eventvwr.msc.

Major logs include:

• Application: Events generated by applications and software components.
• Security: Logon, account-management, privilege-use, and audit events when auditing is enabled.
• System: Events from drivers, services, and operating system components.
• Setup: Installation and configuration events.
• Forwarded Events: Events collected from other computers.

Each event may contain a timestamp, provider, event ID, severity, user, computer, and detailed data. During incident analysis, an analyst should establish a time range, filter relevant event IDs, correlate events across logs, verify time zones, and preserve exported logs. Useful evidence may include failed logons, new services, scheduled tasks, account changes, process creation, and log clearing. A single event should be interpreted in context rather than treated as proof by itself.

Audit policies define which security-related activities Windows records in the Security event log. They can audit successful attempts, failed attempts, or both.

Useful categories include:

• Logon and account logon: Tracks local or domain authentication activity.
• Account management: Records creation, deletion, enabling, disabling, and modification of accounts and groups.
• Object access: Audits access to configured files, folders, registry keys, or shares.
• Policy change: Records changes to security and audit policies.
• Privilege use: Tracks selected uses of sensitive privileges.
• Process creation: Records newly created processes and can optionally include command-line data.
• System events: Records important security subsystem activity.

Administrators must balance visibility, privacy, performance, and log volume. Audit settings should be based on risk, logs should be sized and retained appropriately, and centralized collection should be used where practical.

A scheduled task runs a program, script, or command when a trigger occurs. Triggers can include a specific time, system startup, user logon, idle state, or an event-log entry.

Legitimate uses include:

• Running backups and maintenance jobs.
• Installing updates.
• Producing reports.
• Starting scripts after logon or startup.

Tasks contain actions, triggers, conditions, settings, and a security context. They can be managed through Task Scheduler, schtasks, or PowerShell.

During an investigation, analysts should examine:

• Unfamiliar task names or unusual folder locations.
• Recently created or modified tasks.
• Actions that launch scripts, interpreters, or programs from user-writable paths.
• Tasks running with high privileges.
• Suspicious triggers and hidden settings.
• Task Scheduler operational logs and related process-creation events.

Scheduled tasks are useful for automation but can also be abused for persistence or repeated execution.

Startup items are programs, scripts, services, or tasks configured to run automatically during boot or user logon.

Common startup locations include:

• Per-user and all-users Startup folders.
• Registry Run and RunOnce keys.
• Windows services.
• Scheduled tasks triggered at startup or logon.
• Group Policy logon and startup scripts.
• Winlogon and other advanced autostart locations.

They can be reviewed using Task Manager, Settings, Services, Task Scheduler, Registry Editor, PowerShell, or the Microsoft Sysinternals Autoruns tool.

Analysts should check the file path, publisher, digital signature, creation time, command-line arguments, user context, and related events. An unknown startup entry should not be deleted immediately; it should first be documented and validated because legitimate drivers and security tools also use automatic startup.

These native commands provide a quick view of identity, networking, connections, and processes:

• whoami: Displays the current user. whoami /groups lists group memberships, while whoami /priv lists assigned privileges.
• ipconfig: Displays interface addresses and basic configuration. ipconfig /all adds DHCP, DNS, MAC address, and lease details. ipconfig /displaydns shows the DNS resolver cache.
• netstat: Displays network connections and listening ports. netstat -ano includes numerical addresses and process identifiers, allowing connections to be correlated with processes.
• tasklist: Lists running processes and their PIDs. tasklist /svc shows services associated with processes, and filters can narrow the output.

A basic investigation may use netstat -ano to identify a suspicious connection and then compare its PID with tasklist. Findings should be recorded with timestamps, interpreted in context, and followed by deeper authorized analysis when necessary.