7/21/26, 6:47 AM Module3_labs - HackMD
The windows operating system
Create user account
Part 1 creating new local user account
Step1 : open user account tool
Open control panel and select Change user account in User account or simple
go to Setting and search User account
Step2 : Create user account
Click manage another account then Add a new user in PC settings
[Link] 1/22
7/21/26, 6:47 AM Module3_labs - HackMD
Select Add someone else to this PC then i don't have this person's sign-in
infomation and add new user without a Microsoft account
[Link] 2/22
7/21/26, 6:47 AM Module3_labs - HackMD
Enter username and password(optional) then this is result:
[Link] 3/22
7/21/26, 6:47 AM Module3_labs - HackMD
The new user account have been created but its just an Standard user, So to
change to adminstrator, just click that account and change account type
Login to that user and check the C:\Users then open folder belong to base
user but you can't enter that folder due to permission
[Link] 4/22
7/21/26, 6:47 AM Module3_labs - HackMD
But to access this folder, just run with admin
Part 2: Reviewing user account properties
Click Start > Search for Control Panel > Select Administrative Tools > Select
Computer
Management
[Link] 5/22
7/21/26, 6:47 AM Module3_labs - HackMD
Select Local Users and Groups. Click the Users folder
Click the new user account with right click and select properties
[Link] 6/22
7/21/26, 6:47 AM Module3_labs - HackMD
As you can see this user type is administrator and users(because i change
account type to administrator in previous part)
Part 3: Modifying Local user Accounts
Step 1: Change account type(already done)
Navigate to the Control Panel and select User Accounts. Click Manage
another account. Select
User1.
In the Change an Account window, click the User1 account. Click Change
the account type.
Select the Administrator radio button. Click Change Account Type.
Now the account User1 has administrative rights.
Navigate to Control Panel > Administrative Tools > Computer
Management. Click Local Users and
Groups> Users.
Right-click User1 and select Properties. Click Member Of tab.
Step 2 Delete account
To delete the account, right-click User1and select Delete
Click OK to confirm the deletion
Another way to delete account is using powershell with this command:
Get-LocalUser # get list of users
Remove-LocalUser -Name "name_users"
Side Question:
Why is it important to protect all accounts with strong passwords?
-> because of attacker can using brute force to enter user account and
doing malicious action.
[Link] 7/22
7/21/26, 6:47 AM Module3_labs - HackMD
Why would you create a user with Standard privileges?
-> To prevent new user access to privilege files of other user and reduce
risk, threat to doing suspicious action
Using windows powershell
Part 1: Access PowerShell console
Click Start. Search and select powershell.
Click Start. Search and select command prompt
[Link] 8/22
7/21/26, 6:47 AM Module3_labs - HackMD
Part 2: Explore Command Prompt and PowerShell commands
Enter dir(review directory) at the prompt in both windows
Try another command that you have used in the command prompt, such
as ping, cd, and ipconfig.
ipconfig
[Link] 9/22
7/21/26, 6:47 AM Module3_labs - HackMD
ping
Part 3: Explore cmdlets
cmdlets is a lightweight, built-in command used in the PowerShell scripting
and automation environment.
For example, dir command is the alias of Get-ChildItem so that dir command
list all direcories or file inside pressent working directory
Part 4 : Explore the netstat command using PowerShell.
At the PowerShell prompt, enter netstat -h to see the options available for
the netstat command
PS C:\Users\CyberOpsUser> netstat -h
Displays protocol statistics and current TCP/IP network connections.
NETSTAT [-a] [-b] [-e] [-f] [-n] [-o] [-p proto] [-r] [-s] [-x] [-t] [interval
-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or listening
In some cases well-known executables host multiple independent components, and
these cases the sequence of components involved in creating the connection or
listening port is displayed. In this case the executable name is in [] at the
on top is the component it called, and so forth until TCP/IP was reached. Note
this option can be time-consuming and will fail unless you have sufficient
permissions.
<some output omitted>
[Link] 10/22
7/21/26, 6:47 AM Module3_labs - HackMD
To display the routing table with the active routes, enter netstat -r at the
prompt
PS C:\Users\Hack3> netstat -r
===========================================================================
Interface List
5...00 0c 29 d7 31 54 ......Intel(R) 82574L Gigabit Network Connection
1...........................Software Loopback Interface 1
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
[Link] [Link] [Link] [Link] 25
[Link] [Link] On-link [Link] 331
[Link] [Link] On-link [Link] 331
[Link] [Link] On-link [Link] 331
[Link] [Link] On-link [Link] 281
[Link] [Link] On-link [Link] 281
[Link] [Link] On-link [Link] 281
[Link] [Link] On-link [Link] 331
[Link] [Link] On-link [Link] 281
[Link] [Link] On-link [Link] 331
[Link] [Link] On-link [Link] 281
===========================================================================
Persistent Routes:
None
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 331 ::1/128 On-link
5 281 fe80::/64 On-link
5 281 fe80::9917:d2c1:711a:1b3/128
On-link
1 331 ff00::/8 On-link
5 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
Some command have to use higher privilege to run. So, using powershell in
administator can solve that problem
[Link] 11/22
7/21/26, 6:47 AM Module3_labs - HackMD
PS C:\Users\Hack3> netstat -abno
The requested operation requires elevation.
Open and run a second PowerShell with elevated privileges. Click Start.
Search for PowerShell and right-click Windows PowerShell and select Run
as administrator
PS C:\Windows\system32> netstat -abno
Active Connections
Proto Local Address Foreign Address State PID
TCP [Link]:135 [Link]:0 LISTENING 908
RpcSs
[[Link]]
TCP [Link]:445 [Link]:0 LISTENING 4
Can not obtain ownership information
TCP [Link]:5040 [Link]:0 LISTENING 4344
CDPSvc
[[Link]]
TCP [Link]:7680 [Link]:0 LISTENING 7008
Can not obtain ownership information
TCP [Link]:8834 [Link]:0 LISTENING 3468
[[Link]]
TCP [Link]:49664 [Link]:0 LISTENING 676
[[Link]]
TCP [Link]:49665 [Link]:0 LISTENING 520
...
Open the Task Manager. Navigate to the Details tab. Click the PID heading
so the PID are in order
Select one of the PIDs from the results of netstat -abno. PID 756 is used in
this example
Locate the selected PID in the Task Manager. Right-click the selected PID
in the Task Manager to open
[Link] 12/22
7/21/26, 6:47 AM Module3_labs - HackMD
the Properties dialog box for more information.
Part 5: Empty recycle bin using PowerShell
Open the Recycle Bin. Verify that there are items that can be deleted
permanently from your PC. If not,
restore those files
[Link] 13/22
7/21/26, 6:47 AM Module3_labs - HackMD
Using clear-recyclebin command or simple using GUI to empty recycle
bin
PS C:\Users\Hack3> clear-recyclebin
Confirm
Are you sure you want to perform this action?
Performing the operation "Clear-RecycleBin" on target "All of the contents of
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default
[Link] 14/22
7/21/26, 6:47 AM Module3_labs - HackMD
After clear
Windows task manager
Part 1: Working in the Processes tab
Open a command prompt and a web browser.
Microsoft Edge is used in this lab; however, any web browser will work.
Just substitute your browser
name whenever you see Microsoft Edge.
Right-click the Task bar to open Task Manager. Another way to open the
Task Manager is to press Ctrl-Alt-Delete to access the Windows Security
screen and select Task Manager.
[Link] 15/22
7/21/26, 6:47 AM Module3_labs - HackMD
Click More details to see all the processes that are listed in the Processes
tab.
[Link] 16/22
7/21/26, 6:47 AM Module3_labs - HackMD
Expand the Windows Command Processor heading.
Right-click Console Window Host and select Properties
Location file name : C:\Windows\System32\[Link]
[Link] 17/22
7/21/26, 6:47 AM Module3_labs - HackMD
Close the command prompt window
After close, this service still in window process but not working and not
using resource
Click the Memory heading. Click the Memory heading a second time and it
sort list of process
Right-click on the Memory heading, and then select Resource values >
Memory > Percents. This make memory header colum change to show
percentage value that computer are used to do all process in this
computer
To terminate the process, right click to the name process then end task.
All task relating to this task will terminate too
Part 2: Working in the Services tab
In the Task Manager window, click the Services tab. Use the scroll bar on
the right side of the Services
window to view all the services listed.
[Link] 18/22
7/21/26, 6:47 AM Module3_labs - HackMD
These service is windows service need to use to run app/process so if we
terminate some of this service, the process will not work stably
[Link] 19/22
7/21/26, 6:47 AM Module3_labs - HackMD
Part 3: Working in the Performance tab
In the Task Manager window, click the Performance tab.
This will review number of processes using in this computer, CPU threads
using,…
[Link] 20/22
7/21/26, 6:47 AM Module3_labs - HackMD
Click the Memory in the left panel of the Performance tab
Total physical memory (MB) is the number of memory that computer
have(arcoding to the RAM memory).
Available physical memory is number of memory left that not used by OS.
[Link] 21/22
7/21/26, 6:47 AM Module3_labs - HackMD
Click the Ethernet Chart in the left panel of the Performance tab
Link speed is the speed that network response to internet
Click Open Resource Monitor to open the Resource Monitor utility from the
Performance tab in Task
Manager
Sumary: task manager show all process that user,OS using. Moreover, it
review all resource that computer use to do all process
Monitor and manage system resources in windows
[Link] 22/22