Cyberstudy
Supplementary — not from your PDF Beginner ~30 min

Record a Windows security baseline

Check the built-in protections on your own Windows PC with PowerShell and Windows Security, and write down a baseline you can compare against later.

Environment

Your own Windows 10/11 PC. Some commands need PowerShell run as Administrator.

Before you start

  • Read Endpoint Protection (p.259), Endpoint Configuration (p.262) and Disk and File Encryption (p.70).

You will

  • Check antimalware, firewall, encryption and update status
  • Record a baseline

Steps

  1. 1

    Antimalware: Get-MpComputerStatus | Select AMServiceEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated.

  2. 2

    Firewall: Get-NetFirewallProfile | Select Name, Enabled, DefaultInboundAction.

  3. 3

    Disk encryption (admin): manage-bde -status C:, or check Settings → Privacy & security → Device encryption.

  4. 4

    Local administrators: Get-LocalGroupMember Administrators. Is your everyday account an admin?

  5. 5

    Updates: open Settings → Windows Update and note the last successful update date.

  6. 6

    Put the results in a table: control, expected value, actual value, action needed.

  7. 7

    Fix one gap, for example by using a standard account for daily work, and note it.

Check your understanding

  • ?Why is daily use of a non-admin account an example of least privilege?
  • ?Which control here protects data if the laptop is stolen?
  • ?How would an EDR product go beyond what Defender's status shows?