Week 2.

1 - Create User Accounts

Introduction

In this lab, you will create and modify user accounts in Windows.

Part 1: Creating a New Local User Account

Part 2: Reviewing User Account Properties

Part 3: Modifying Local User Accounts

Required Resources

• A Windows PC

Instructions

Part 1: Creating a New Local User Account

Step 1: Open the User Account Tool.

a. Log on to the Windows PC with an Administrator account. The account

CyberOpsUser is used in this example.
b. Click Start > search Control Panel. Select User Accounts in the Small
icons view. To change the view, select Small icons in the View by drop down
list.

Step 2: Create a user account.

a. In the User Accounts window, click Manage another account.

b. In the Manage Accounts window, click Add a new user in PC settings.

c. In the Settings window, click Add someone else to this PC.
d. In the How will this person sign in? window, click I don't have this
person's sign-in information.
e. In the Let's create your account window opens, click Add a user without a
Microsoft account.
 f. In the Create an account for this PC window, provide the necessary
information to create the new user account named User1. Click Next to
create the new user account.

What type of user account did you just create?

A local account with no administrative rights

g. Attempt to log into the newly created user account. It should be successful.
h. Navigate to C:Users folder. Right-click the User1 folder and
select Properties, and then the Security tab.

Which groups or users have full control of this folder?

Groups: SYSTEM, Administrators Users: User1

i. Open the folder that belongs to CyberOpsUser. Right-click the folder and click
the Properties tab.

Were you able to access the folder? Explain.

You do not have permission to access this folder.

j. Log out of User1 account. Log back in as CyberOpsUser.

k. Navigate to C:Users folder. Right-click the folder and select Properties. Click
the Security tab.

Which groups or users have full control of this folder?

Groups: SYSTEM, Administrators Users: CyberOpsUser

Part 2: Reviewing User Account Properties

a. Click Start > Search for Control Panel > Select Administrative Tools >
Select Computer Management.
b. Select Local Users and Groups. Click the Users folder.

c. Right-click User1 and select Properties.

d. Click the Member Of tab.
Which group is User1 is a member of?
Users

e. Right-click the account CyberOpsUser and select Properties.

Which group is this user a member of?

Users and Administrators

Part 3: Modifying Local User Accounts

Step 1: Change the account type.

a. Navigate to the Control Panel and select User Accounts. Click Manage
another account. Select User1.
b. In the Change an Account window, click the User1 account. Click Change
the account type.
c. Select the Administrator radio button. Click Change Account Type.
d. Now the account User1 has administrative rights.
e. Navigate to Control Panel > Administrative Tools > Computer
Management. Click Local Users and Groups > Users.
f. Right-click User1 and select Properties. Click Member Of tab.

Which groups does User1 belong to?

Administrators and Users

g. Select Administrators and click Remove to remove User1 from the

Administrative group. Click OK to continue.

Step 2: Delete the account.

a. To delete the account, right-click User1 and select Delete.

b. Click OK to confirm the deletion.

What is another way to delete a user account?

Control Panel > User Accounts > Manage another account > Select User1 > Delete
the account
Reflection Questions

1. Why is it important to protect all accounts with strong passwords?

No password or a weak password can allow access from almost anyone to steal
data, or use the computer for unauthorized purposes.
2. Why would you create a user with Standard privileges?
The Standard User cannot compromise the security of the computer or the privacy of
other users.
Week 2.2 - Using Windows PowerShell
Objectives

The objective of the lab is to explore some of the functions of PowerShell.

Part 1: Access PowerShell console.

Part 2: Explore Command Prompt and PowerShell commands.

Part 3: Explore cmdlets.

Part 4: Explore the netstat command using PowerShell.

Part 5: Empty recycle bin using PowerShell.

Background / Scenario

PowerShell is a powerful automation tool. It is both a command console and a

scripting language. In this lab, you will use the console to execute some of the
commands that are available in both the command prompt and PowerShell.
PowerShell also has functions that can create scripts to automate tasks and work
together with the Windows Operating System.

Required Resources

• 1 Windows PC with PowerShell installed and internet access

Instructions

Part 1: Access PowerShell console.

a. Click Start. Search and select powershell.

b. Click Start. Search and select command prompt.

Part 2: Explore Command Prompt and PowerShell commands.

a. Enter dir at the prompt in both windows.

What are the outputs to the dir command?

Both windows provide a list of subdirectories and files, and associated information
like type, file size, date and time of last write. In PowerShell, the attributes/modes are
also shown.

b. Try another command that you have used in the command prompt, such
as ping, cd, and ipconfig.
What are the results?
The output in both windows are similar.

Part 3: Explore cmdlets.

a. PowerShell commands, cmdlets, are constructed in the form of verb-

noun string. To identify the PowerShell command to list the subdirectories and
files in a directory, enter Get-Alias dir at the PowerShell prompt.

PS C:UsersCyberOpsUser> Get-Alias dir

CommandTypeNameVersionSource
----------------------------
Aliasdir -> Get-ChildItem
What is the PowerShell command for dir?
Get-ChildItem

b. For more detailed information about cmdlets, perform an internet search

for Microsoft powershell cmdlets.
c. Close the Command Prompt window when done.

Part 4: Explore the netstat command using PowerShell.

a. At the PowerShell prompt, enter netstat -h to see the options available for
the netstat command.
PS C:UsersCyberOpsUser> netstat -h

Displays protocol statistics and current TCP/IP network connections.

NETSTAT [-a] [-b] [-e] [-f] [-n] [-o] [-p proto] [-r] [-s] [-x] [-t] [interval]
-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or listening port. In some
cases well-known executables host multiple independent components, and in these cases the
sequence of components involved in creating the connection or listening port is displayed. In
this case the executable name is in [] at the bottom, on top is the component it called, and so
forth until TCP/IP was reached. Note that this option can be time-consuming and will fail
unless you have sufficient permissions.
<some output omitted>
b. To display the routing table with the active routes, enter netstat -r at the
prompt.

PS C:UsersCyberOpsUser> netstat -r
=======================================================================
====
Interface List
3...08 00 27 a0 c3 53 ......Intel(R) PRO/1000 MT Desktop Adapter
10...08 00 27 26 c1 78 ......Intel(R) PRO/1000 MT Desktop Adapter #2
1...........................Software Loopback Interface 1
=======================================================================
====
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
[Link] [Link] [Link] [Link] 25
[Link] [Link] On-link [Link] 331
[Link] [Link] On-link [Link] 331
[Link] [Link] On-link [Link] 331
169.254.0. [Link] On-link [Link] 281
[Link] [Link] On-link [Link] 281
[Link] [Link] On-link [Link] 281
[Link] [Link] On-link [Link] 281
[Link] [Link] On-link [Link] 281
[Link] [Link] On-link [Link] 281
[Link] [Link] On-link [Link] 331
[Link] [Link] On-link [Link] 281
[Link] [Link] On-link [Link] 281
[Link] [Link] On-link [Link] 331
[Link] [Link] On-link [Link] 281
[Link] [Link] On-link [Link] 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table

===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 331 ::1/128 On-link
3 281 fe80::/64 On-link
10 281 fe80::/64 On-link
10 281 fe80::408b:14a4:7b64:b597/128 On-link
3 281 fe80::dd67:9e98:9ce0:51e/128 On-link
1 331 ff00::/8 On-link
3 281 ff00::/8 On-link
10 281 ff00::/8 On-link

===========================================================================
Persistent Routes:
None

What is the IPv4 gateway?

Answers will vary. The gateway is [Link] in this example.
 c. Open and run a second PowerShell with elevated privileges. Click Start.
Search for PowerShell and right-click Windows PowerShell and select Run as
administrator. Click Yes to allow this app to make changes to your device.

d. The netstat command can also display the processes associated with the
active TCP connections. Enter the netstat -abno at the prompt.

PS C:Windowssystem32> netstat -abno

Active Connections
Proto Local Address Local Address Local Address PID
TCP [Link]:135 [Link]:0 LISTENING 756
RpcSs
[[Link]]
TCP [Link]:445 [Link]:0 LISTENING 4
Can not obtain ownership information
TCP [Link]:49664 [Link]:0 LISTENING 444
Can not obtain ownership information
TCP [Link]:49665 [Link]:0 LISTENING 440
Schedule
[[Link]]
TCP [Link]:49666 [Link]:0 LISTENING 304
EventLog
[[Link]]
TCP [Link]:49667 [Link]:0 LISTENING 1856
[[Link]]
TCP [Link]:49668 [Link]:0 LISTENING 544
<some output omitted>

e. Open the Task Manager. Navigate to the Details tab. Click the PID heading
so the PID are in order.
f. Select one of the PIDs from the results of netstat -abno. PID 756 is used in
this example.
 g. Locate the selected PID in the Task Manager. Right-click the selected PID in
the Task Manager to open the Properties dialog box for more information.

What information can you get from the Details tab and the Properties dialog box for
your selected PID?
PID 756 is associated with [Link] process. The user for this process is
NETWORK SERVICE and it is using 4132K of memory.

Part 5: Empty recycle bin using PowerShell.

PowerShell commands can simplify management of a large computer network. For

example, if you wanted to implement a new security solution on all servers in the
network you could use a PowerShell command or PowerShell commands to simplify
actions that would take multiple steps to execute using Windows graphical desktop
tools.

a. Open the Recycle Bin. Verify that there are items that can be deleted
permanently from your PC. If not, restore those files.
b. If there are no files in the Recycle Bin, create a few files, such as text file
using Notepad, and place them into the Recycle Bin.
c. In a PowerShell console, enter clear-recyclebin at the prompt.

PS C:UsersCyberOpsUser> clear-recyclebin

Confirm
Are you sure you want to perform this action?
Performing the operation "Clear-RecycleBin" on target "All of the contents of the Recycle Bin".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): y
What happened to the files in the Recycle Bin?
The files in the Recycle Bin are deleted permanently.

Reflection Question

PowerShell was developed for task automation and configuration management.

Using the internet, research commands that you could use to simplify your tasks as a
security analyst. Record your findings.
Answers will vary.
Week 2.3 - Windows Task Manager
Objectives

In this lab, you will explore Task Manager and manage processes from within Task
Manager.

Part 1: Working in the Processes tab

Part 2: Working in the Services tab

Part 3: Working in the Performance tab

Background / Scenario

The Task Manager is a system monitor program that provides information about the
processes and programs running on a computer. It also allows the termination of
processes and programs and modification of process priority.

Required Resources

• A Windows PC with internet access

Instructions

Part 1: Working in the Processes tab

a. Open a command prompt and a web browser.

Microsoft Edge is used in this lab; however, any web browser will work. Just
substitute your browser name whenever you see Microsoft Edge.
b. Right-click the Task bar to open Task Manager. Another way to open the
Task Manager is to press Ctrl-Alt-Delete to access the Windows Security
screen and select Task Manager.
c. Click More details to see all the processes that are listed in the Processes
tab.
d. Expand the Windows Command Processor heading.

What is listed under this heading?

Command Prompt

e. There are three categories of processes listed in the Processes tab: Apps,
Background processes, and Windows processes.
o The Apps are the applications that you have opened, such as Microsoft
Edge, Task Manager, and Windows Command Processor, as shown in
the figure above. Other applications that are opened by the users, such
as web browsers and email clients, will also be listed here.
o The Background processes are executed in the background by
applications that are currently open.
 o The Windows processes are not shown in the figure. Scroll down to
view them on your Windows PC. Windows processes are Microsoft
Windows services that run in the background.

Some of the background processes or Windows processes may be

associated with foreground processes. For example, if you open a command
prompt window, the Console Window Host process will be started in the
Windows process section, as shown below.

f. Right-click Console Window Host and select Properties.

What is the location of this filename and location of this process?

The associated filename is [Link] and it is located in the
C:\Windows\System32 folder.

g. Close the command prompt window.

What happens to Windows Command Processor and Console Window Host when
the command prompt window is closed?
The associated processes have ended and are no longer listed in the Task Manager.

h. Click the Memory heading. Click the Memory heading a second time.

What effect does this have on the columns?

Clicking the Memory heading causes the processes to be sorted by the amount of
memory each process is using. Each time you click the Memory heading, it reverses
the order (largest to smallest, then smallest to largest).

i. Right-click on the Memory heading, and then select Resource

values > Memory > Percents.
What affect does this have on the Memory column?
The column now displays memory usage in percentage values.
How could this be useful?
Displaying processes in this way can assist an administrator in determining what
services may be causing memory issues by showing how much available memory is
being used by each service.

j. In the Task Manager, click the Name heading.

k. Double-click the Microsoft Edge.

What happens?
A new web browser window becomes activated and the Task Manager is minimized.

l. Return to the Task Manager and right-click Microsoft Edge. Select End task.

What happens to the web browser windows?

All Microsoft Edge windows are closed.

Part 2: Working in the Services tab

In the Task Manager window, click the Services tab. Use the scroll bar on the right
side of the Services window to view all the services listed.

What statuses are listed?

Stopped and Running.

Part 3: Working in the Performance tab

a. In the Task Manager window, click the Performance tab.

How many threads are running?

Answers may vary. The example displays 1271.
How many processes are running?
Answers may vary. The example displays 104.

b. Click the Memory in the left panel of the Performance tab.

What is the total physical memory (MB)?
Answers may vary. The example shows 4GB (above memory chart on right).
What is the available physical memory (MB)?
Answers may vary. The example displays 2.5 GB.
How much physical memory (MB) is being used by the computer?
Answers may vary. The example displays 1.4 GB.

c. Click the Ethernet Chart in the left panel of the Performance tab.
What is the link speed?
Answers may vary. The example shows that it is a Ethernet Connection.
What is the IPv4 address of the PC?
Answers may vary. The example shows [Link].

d. Click Open Resource Monitor to open the Resource Monitor utility from the
Performance tab in Task Manager.

Reflection Question

Why is it important for an administrator to understand how to work within the Task
Manager?
Answers may vary. The Task Manager can be a valuable tool for an administrator
when troubleshooting problems with a Windows PC. It provides information about
CPU, memory, disk, and network usage. It also provides a way to end tasks or
cancel processes.
Week 2.4 - Monitor and Manage System Resources
in Windows
Objectives

In this lab, you will use administrative tools to monitor and manage Windows system
resources.

Part 1: Starting and Stopping the Routing and Remote Access service

Part 2: Working in the Computer Management Utility

Part 3: Configuring Administrative Tools

Recommened Resource

• A Windows PC with internet access

Instructions

Part 1: Starting and Stopping the Routing and Remote Access service

You will explore what happens when a service is stopped and then started. In this
part, you will use routing and remote access service as the example service. This
service allows the local device to become a router or a remote access server.

a. Navigate to the Control Panel > Click Network and Sharing Center.
Note: If your Control Panel is set to View by: Category, change it to View
by: Large icons or View by: Small icons. This lab assumes that you are
using one of these settings.

b. Click Change adapter settings in the left pane. Reduce the size of
the Network Connections window and leave it open.
c. Navigate to the Administrative Tools. (Navigate to the Control Panel >
Click Administrative Tools)
d. In the Administrative Tools window, double-click the Performance
Monitor icon.
 e. In the Performance Monitor window, make sure Performance
Monitor under Monitoring Tool heading in the left pane is highlighted. Click
the Freeze Display icon (pause button) to stop the recording.
f. Right-click the graph and select Clear to clear the graph. Leave this window
open.

g. Navigate to the Administrative Tools and select Services.

h. Expand the width of the Services window so you have a clear view of the
content. Scroll down in the right pane until you see the service Routing and
Remote Access. Double-click Routing and Remote Access.

i. In the Routing and Remote Access Properties (Local Computer) window

opens. In the Startup type drop-down field, select Manual and then
click Apply.

The Start button is now active. Do NOT click the Start button yet. Leave this window
open.
j. Navigate to Performance Monitor window. Click the Unfreeze Display icon
to start the recording.
k. Click the Routing and Remote Access Properties (Local
Computer) window. To start the service, click Start. A window with a
progress bar opens.
l. The Routing and Remote Access Properties (Local Computer) window
now shows the Stop and Pause button active. Leave this window open.
 m. Navigate to Network Connections window. Press the function key F5 to
refresh the content.

What changes appear in the window after starting the Routing and Remote
Access service?
An Incoming Connections icon is now displayed.

n. Navigate to Routing and Remote Access Properties (Local

Computer) window and click Stop. Note: If Stop is greyed out,
click Apply and change the service status.
o. Navigate to Network Connections window.

What changes appear in the right pane after stopping the Routing and Remote
Access service?
The Incoming Connections icon is no longer displayed.

p. Navigate to Performance Monitor window and click the Freeze Display icon
to stop the recording.
Which Counter is being recorded the most in the graph (hint: look at the graph color
and Counter color)?
%Processor Time.

q. Click the Change graph type drop-down menu, select Report.

r. The display changes to report view.

What values are displayed by the counter?

Answers may vary. Processor Information % Processor Time: 2.804

s. Click the Routing and Remote Access Properties (Local

Computer) window. In the Startup type field, select Disabled and click OK.

t. Click the Services window.

What is the Status and Startup Type for Routing and Remote Access?
Status is blank and Startup Type is Disabled.

u. Click the Performance Monitor window. Click the Unfreeze Display icon to
start the recording.
v. Close all open windows you opened during Step 1 of this lab.

Part 2: Working in the Computer Management Utility

The Computer Management is used to manage a local or remote computer. The

tools in this utility are grouped into three categories: system tools, storage, and
services and applications.

a. Click Control Panel > Administrative Tools. Select Computer Management.

b. In the Computer Management window, expand the three categories by
clicking on the arrow next to System Tools.
c. Click the arrow next to Event Viewer then click the arrow next to Windows
Logs. Select System.
 d. The Event Properties window opens for the first event. Click the down
arrow key to locate an event for Routing and Remote Access. You should
find four events that describe the order for starting and stopping the Routing
and Remote Access service.

What are the descriptions for each of the four events?

Answers will vary.

e. Close all open windows.

Part 3: Configuring Administrative Tools

For the rest of this lab, you will configure Advanced Administrative Tool features and
monitor how this affects the computer.

a. Click Control Panel > Administrative Tools > Performance Monitor. The
Performance Monitor window opens. Expand Data Collector Sets. Right-
click User Defined, and select New > Data Collector Set.

b. The Create new Data Collector Set window opens. In the Name field,
type Memory Logs. Select the Create manually (Advanced) radio button,
and click Next.
c. In the What type of data do you want to include? window, check
the Performance counter box then click Next.
d. In the Which performance counters would you like to log? window,
click Add.
e. From the list of available counters, locate and expand Memory.
Select Available MBytes and click Add>>.
f. You should see the Available MBytes counter added in the right pane.
Click OK.
g. Set the Sample interval field to 4 seconds. Click Next.

h. In the Where would you like the data to be saved? screen, click Browse.
i. In the Browse For Folder window , select your (C:) drive which is Local Disk
(C:). Select PerfLogs and click OK.
 j. The Where would you like the data to be saved? window opens with the
directory information that you selected in the previous step. Click Next.
k. In the Create the data collector set? screen, click Finish.
l. Expand User Defined and select Memory Logs. Right-click Data
Collector01 and select Properties.

m. In the DataCollector01 Properties window, change the Log format: field

to Comma Separated.

n. Click the File tab.

What is the full path name to the example file?

Answers may vary. In this example:C:\PerfLogs\DESKTOP-NDFE14H_20170514-
000001\[Link]

o. Click OK.
p. Select the Memory Logs icon in the left pane of the Performance
Monitor window. Click the green arrow icon to start the data collection set.
Notice a green arrow is placed on top of the Memory Logs icon.
 q. To force the computer to use some of the available memory, open and close a
browser.
r. Click the black square icon to stop the data collection set.

What change do you notice for the Memory Logs icon?

The green arrow has been removed from the icon.

s. Click Start > Computer,and click drive C: > PerfLogs. Locate the folder that
starts with your PC’s name followed by a timestamp, DESKTOP-
NDFE14H_20170514-000001 in the example. Double-click the folder to open
it, and then double-click the [Link] file. If prompted, click
Continue to permit access to the folder.

Note: If the Windows cannot open the file: message is displayed, select the radio
button Select a program from a list of installed programs > OK > Notepad > OK.
What does the column farthest to the right show?
Available memory in MBytes.

t. Close the [Link] file and the window with the PerfLogs folder.
u. Select the Performance Monitor window. Right-click Memory
Logs > Delete.

v. The Performance Monitor > Confirm Delete window opens. Click Yes.
w. Open drive C: > PerfLogs folder. Right-click on the folder that was created to
hold the Memory log file, then click Delete.
x. The Delete Folder window opens. Click Yes.
y. Close all open windows.