Integrated Report
Executive Summary
This integrated report consolidates the uploaded Windows Security Policy and Event Viewer
notes into a single, actionable document. It includes extracted policy controls, monitoring
guidance for key Event IDs, a risk register summary, mappings between monitoring and controls,
and recommended next steps.
1. Windows Security Policy (Extracted)
• Password Policy: Minimum length 12; complexity (uppercase, lowercase, numbers, special
characters); expiration: change every 30 days; prevent reuse of last 5 passwords. (source:
Windows Security Policy).
• Account Lockout Policy: Threshold — lock account after 3 invalid login attempts; Lockout
Duration — 5 minutes; Reset counter — 5 minutes.
• Logging & Auditing: Enable logon/logoff auditing (success & failure), account management
auditing, policy change auditing, object access auditing; retain logs at least 90 days; forward logs
to centralized SIEM.
• Patch Management: Apply critical patches within 7 days; perform monthly maintenance;
ensure antivirus/endpoint protection active and updated.
• Enforcement: Compliance mandatory; non-compliance may lead to account suspension or
disciplinary action.
2. Risk Register (Summary)
Below is a concise risk register aligned to the uploaded policy controls.
Risk ID Description Likelihood Impact Mitigation
R1 Weak passwords High High Enforce
→ unauthorized password policy,
access require MFA
R2 Multiple failed Medium High Account lockout
logins / brute after 3 failed
force attempts;
monitor Event
ID 4625
R3 Insufficient Medium High Enable auditing
logging / and forward logs
monitoring to SIEM; retain
90 days
R4 Shared accounts Medium Medium Enforce unique
/ lack of accounts, RBAC,
accountability periodic audits
R5 Unpatched High High Apply patches
vulnerabilities within SLA,
exploited deploy EDR,
network
segmentation
3. Event Viewer Monitoring (From uploaded notes)
Key events to monitor:
• Multiple Failed Login Attempts — Event ID 4625/4740 (failed logon / account lockout).
Repeated failed logins may indicate brute-force attempts; create SIEM rules to alert on spikes.
• Successful Admin Login — Event ID 4624. Monitor for admin logins outside normal hours or
from unusual source IPs.
• New User Account Created — Event ID 4720. Review for unauthorized account creation which
could be a persistence/backdoor vector.
Recommended monitoring rules / alerts:
• Brute force detection: alert when >5 failed logins (4625) for same account or source IP within
10 minutes.
• Admin login anomaly: alert on 4624 for admin accounts outside business hours or from new
source IPs; correlate with 4672 (special privileges).
• Unauthorized account creation: alert on 4720 when created by non-admin or outside change
window.
4. Mapping: Controls ↔ Monitoring ↔ Remediation
Finding Relevant Control Monitoring Signal Immediate
Remediation
Weak password Password Policy, 4625 spikes; Force password
found MFA repeated successful reset, enable MFA,
logins after review access logs
compromise
Brute force activity Account Lockout Multiple 4625/4740 Block offending IPs,
Policy events increase lockout
threshold
temporarily,
investigate source
Unauthorized Account Event 4720 Disable account,
account creation Management investigate creator,
Auditing forensic snapshot of
host
5. Recommendations & Next Steps
• Forward Windows Security logs to centralized SIEM and implement the monitoring rules listed
above.
• Enforce the Windows Security Policy controls (passwords, lockout, auditing) across domain-
joined systems.
• Schedule internal pentest to validate controls and detection capability; use mapping in section
4 to ensure tests generate detectable signals.
• Perform regular reviews of risk register and update mitigations based on pentest findings.