Skip to content

WindowsChecklist.md

Latest commit

 

History

History
159 lines (126 loc) · 6.42 KB

WindowsChecklist.md

File metadata and controls

159 lines (126 loc) · 6.42 KB
Raw

CyberPatriot Windows/Windows Server Checklist

Caution

ALWAYS CHECK YOUR README BEFORE DOING ANYTHING HERE. I AM NOT RESPONSIBLE FOR IF YOU MESS UP YOUR VM.

Important

This was made during CyberPatriot XVII, this could be depricated, could not be, I would not know. I have not checked if this checklist applies correctly or not, and will not be updating accordingly.

Note

On Windows Server, you can instantly close out of Server Manager, you do not need it, everything can be done via core Windows apps.

Navigation


Cyberpatriot Specific:

Check for Suspicious Users
Answer Forensics Questions

Basic Security:

Delete any unauthorized Software
Remove any Unauthorized Users
Check Firewall Status
Updating
Setting Automatic Updates

Advanced Security:

Password Policy
Account Lockout Policy
Auditing
Removing Access to this computer in the network from everyone
Disabling Services
Checking For Suspicious Files
Check for any Unusual Processes

Check for Suspicious Users

I recommend setting up a text file with all the users, and admins. Finding admins that shouldn't be admins will award you points!

Answer your forensics Questions

There are several examples of what you can have. They can all differ. I will not provide help here.

Basic Security

Delete Any Unauthorized Software

You can do this by going to:
Control Panel -> Programs and Features -> Uninstall a Program -> [Program]

Remove any Unauthorized Users

Tip

When asked if you want to delete the users files, you can choose not to if you so want, as if you remove the wrong user, you can re-add them for your penalty to be reverted.

Check your users and see which ones are not authorized. Remove them via:
Control Panel > User Accounts > User Accounts > Manage Another User > [User] > Remove this User
Also, check for the Guest acount. If it is active, deactivate it.

Check Firewall Status

You can check this via:
Control Panel -> System and Security -> Windows Defender Firewall
If this is off, then turn it on via Turn Windows Defender Firewall on or off

Updating

Caution

Check your README, this could be something you shouldn't be doing.

Please only run updates when you have the downtime to, or have nothing left to do.

Setting Automatic Updates

Caution

Check your README, this could be something you shouldn't be doing.

Make sure you are ready for a possible auto-update with this, or that you have updated already.
To turn this on, go to:
Setings -> Update & Security -> Advanced Options -> Update Automatically

Advanced Security

Password Policy

Important

This uses the Local Security Policy Editor. Use the Local Security Policy Editor by: Control Panel -> Administrative Tools -> Local Security Policy or Win + R -> secpol.msc

Set the following in Account Policies -> Password Policy:

  • Enforce Password History: 5
  • Maximum Pasword Age: 30
  • Minimum Password Age 25
  • Password must meet complexity requirement: Enable
  • Store password using reversible encryption: Disable

Account Lockout Policy

Important

This uses the Local Security Policy Editor. Use the Local Security Policy Editor by: Control Panel -> Administrative Tools -> Local Security Policy or Win + R -> secpol.msc

Set the following in Account Policies -> Password Policy:

  • Account lockout duration: 30
  • Account lockout threshold: 5
  • Reset account lockout counter after: 30

Auditing

Important

This uses the Local Security Policy Editor. Use the Local Security Policy Editor by: Control Panel -> Administrative Tools -> Local Security Policy or Win + R -> secpol.msc

Set the following in Local Policies -> Audit Policy:

  • Account Logon Events (Windows & Server)
  • Account Management (Windows & Server)
  • Directory Service Access (Server only)
  • Logon Events (Windows & Server)
  • Object Access (Server only)
  • Policy Change (Windows & Server)
  • Privilege Use (Server only)
  • Process Tracking (Windows & Server)
  • System Events (Windows & Server)

Removing access to this computer in the network from everyone

Important

This uses the Local Security Policy Editor. Use the Local Security Policy Editor by: Control Panel -> Administrative Tools -> Local Security Policy or Win + R -> secpol.msc

Set the following in Local Policies -> User Rights Assignment:

  • Access this computer from the network: Remove "Everyone"

Disabling Services

You can access your services by going to:
Control Panel -> Administrative Services -> Services or by just searching: Services, and opening the app with 2 cogs.

You should do the following if applicable:

  • IIS: Stop and Disable
  • Any RDP App unless specified by README: Stop and Disable
  • Remote Desktop Help Session Manager: Stop and Disable
  • Remote Registry: Stop and Disable
  • Routing and Remote Access: Stop and Disable
  • Simple File Sharing: Stop and Disable
  • SSD Discovery Service: Stop and Disable
  • Telnet: Stop and Disable
  • FTP: Stop and Disable (CHECK YOUR README, FTP MIGHT BE NEEDED!)
  • Universal Plug and Play Device Host: Stop and Disable
  • Windows Messenger Service: Stop and Disable

Checking for Suspicious Files:

Look in the 3 directories listed to see if anything suspicious is in there, if so, DO RESEARCH FIRST then delete it if nothing comes up that is either a. good, or b. important

  • C:\Windows\System
  • C:\Windows\System32
  • C:\Program Files\

Check for any Unusual Processes:

Tip

Process Explorer (Also known as ProcExp), a tool in Sysinternals, is very handy for this, as some apps do not check for Process Explorer, but they check for Task Manager. Get it Here

Look for any suspicious processes or any "nc" or "NetCat" Processes.
If you think a process is suspicious, use Process Library to check if its a windows process or not.