Accounts Hygiene
Local users, admin separation, and password policy — on $LAB_HOST only.
Visual · windows_accounts_hygiene
Accounts hygiene literacy. $LAB_HOST only. Original Cyberlium.
Shared admin on every account is how one phish owns the box — clean accounts on YOUR lab first.
Account hygiene means least privilege: separate admin from daily use, disable unused accounts, enforce lockout and password policy where appropriate. Defenders audit local users and group membership on owned hosts. Cyberlium teaches reading Get-LocalUser and net localgroup on $LAB_HOST — not resetting passwords on classmates or creating backdoor accounts on employer servers. Next: Windows Lab.
1. Least privilege on the desktop
Daily work as standard user; elevate only for changes. Document which accounts exist on $LAB_HOST and whether any should be disabled.
Defenders alert on new local admins and stale accounts — you practice the inventory habit first.
Command guide
Try these commands — Least privilege on the desktop
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CIS Windows benchmarks — https://www.cisecurity.org/cis-benchmarks Microsoft accounts — https://learn.microsoft.com/en-us/windows/security/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
grep -i allowed "$HOME/cyberlium-lab/t16-defense/roe.txt" 2>/dev/null || ss -tulpn 2>/dev/null | head -5
═══ WINDOWS ═══
Command — copy this
Get-LocalUser | Select-Object Name, Enabled, PasswordRequired | Format-Table Get-LocalGroupMember -Group Administrators -ErrorAction SilentlyContinue | Select-Object Name
Primary tools to practice this lesson: powershell, grep. Reference sites: CIS Windows benchmarks (https://www.cisecurity.org/cis-benchmarks); Microsoft accounts (https://learn.microsoft.com/en-us/windows/security/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Password and lockout policy literacy
Local Security Policy or GPO sets minimum length, complexity, and lockout thresholds. Read current values on $LAB_HOST before proposing changes.
Never 'test' lockout by hammering a classmate's login — that is denial of service, not hygiene.
3. No stranger credential games
Creating hidden admin accounts on lab is for learning detection on $LAB_HOST you revert — not persistence on real targets.
Ship: local user table for $LAB_HOST. Next: Windows Lab.
4. What you ship: local account inventory for $LAB_HOST
List local users and admin group members. Note password policy readout. No stranger credential changes. chmod 600.
5. What you record before the next lesson
Date. Local users on $LAB_HOST. Administrators group members. File t16-m02-l03-windows-accounts.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Add yourself as admin on a classmate's PC. Run password spray against dorm accounts 'to test lockout.'
- Right: Inventory accounts on $LAB_HOST. Next: Windows Lab.
Mission: account hygiene inventory
1) List local users on $LAB_HOST (read-only). 2) Note who is in Administrators. 3) Read password policy settings. Never modify stranger credentials.
Stuck? Ask Cyberlium AI Mentor
Separate admin account on personal PC is a lifelong habit — lab is where you document it.
APPLY: Account hygiene primarily means:
APPLY: True or False: Password spraying dorm accounts is Cyberlium homework.
APPLY: On $LAB_HOST you document Administrators membership to: