◇ OpenCyber Academy
Technologist · Chapter 5 · English

Chapter 5 — Windows administration basics

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Windows administration basics

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Central management"]
  N2["5.2 Security baselines"]
  N3["5.3 Reading the result"]
  N4["5.4 Local accounts"]
  N5["Checking firewall state"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Central management"]
  N2["5.2 Security baselines"]
  N3["5.3 Reading the result"]
  N4["5.4 Local accounts"]
  N5["Checking firewall state"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Central management]
    |
    v
[5.2 Security baselines]
    |
    v
[5.3 Reading the result]
    |
    v
[5.4 Local accounts]
    |
    v
[Checking firewall state]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) manage Windows devices centrally; (2) use group policy or management tools; (3) read security settings.

5.1 Central management

Configuring ninety laptops one by one is impossible to keep consistent. The trust's laptops are joined to the directory and managed through group policy, with newer settings delivered by a cloud management service. Policies apply settings such as password rules, screen lock and firewall state to all laptops in a group.

Group policy applies when a laptop is on the school network or connected to the directory, while the cloud management service reaches laptops wherever they are online. Tomás learns which settings come from each, because a setting defined in both places with different values produces confusing results. Dev's rule is that new settings go only into the cloud management service.

5.2 Security baselines

Microsoft publishes security baselines: recommended settings for each Windows version. The CIS Benchmarks offer a similar, independently reviewed list. Both can be imported as starting points. Dev already applies some settings, but nobody has compared them with a baseline.

A baseline is useful only when someone compares it with what laptops actually have, and that comparison has never been done at the trust. Tomás treats the Microsoft and CIS lists as menus rather than orders: the trust will pick the settings that matter most, record which source each came from, and leave the rest for later rounds. Importing every recommended setting at once on ninety laptops would also break classroom software nobody had tested.

5.3 Reading the result

Tomás uses the built-in report of resulting settings on a laptop to see which policies applied. This shows, for example, that the screen lock is set to thirty minutes, while the CIS Benchmark suggests fifteen or less. He records each difference rather than changing anything.

The report also shows which policy set each value, so Tomás can tell a central setting from one changed locally on the laptop. For the screen lock, the thirty-minute value comes from an old group policy object that nobody had reviewed since it was created. He writes the policy name next to the difference, because that is where Dev will make the change.

5.4 Local accounts

Windows laptops each have a built-in local administrator account. If every laptop has the same password for it, one leaked password opens them all. Microsoft's Local Administrator Password Solution, LAPS, sets a unique random password on each machine and stores it in the directory, readable only by authorised staff.

Tomás checks whether LAPS is deployed and finds it is not yet, so every laptop built from the trust's image still shares one local administrator password. He records this as a single finding with ninety laptops affected rather than as ninety findings, because one central change fixes all of them. LAPS later becomes one of the fifteen settings in the laptop baseline.

Checking firewall state

Windows Defender Firewall has three profiles: domain, private and public. Laptops use the domain profile at school and the public profile in cafés, hotels and other untrusted networks. Tomás checks the profile states on his sample of laptops and finds that on two the public profile is switched off, probably changed while troubleshooting a home printer and never reverted. These are exactly the laptops that would be most exposed when a teacher works from a café. He records both for the baseline work rather than changing them himself, and notes that a central policy would prevent the setting being switched off locally in future.

Worked example

Tomás compares twelve settings on one laptop with the CIS Benchmark and finds four differences: screen lock timeout, guest account state, SMBv1 client and the PowerShell logging setting.

Synthetic case. Settings are synthetic.

Errors and limits

Applying a full baseline at once can break classroom software; differences are recorded first and changes piloted later.

Exercises

Synthesis

Central management and published baselines make Windows settings consistent and measurable.

Continue studying — chapter 05 of 30

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →