Windows Baseline
Know the Windows hardening checklist — read and plan on $LAB_HOST only.
Visual · windows_baseline
Windows baseline literacy. $LAB_HOST only. Original Cyberlium.
A baseline is a named minimum — not a reason to RDP into someone else's PC.
Windows baselines cover OS version support, unnecessary services, remote access posture, and audit policy awareness. Defenders compare live config to CIS or vendor guidance on machines they administer. Cyberlium teaches checklist literacy on $LAB_HOST — your lab VM or personal workstation. You will NOT export Group Policy to a employer domain without ticket, harden a library PC, or 'fix' a classmate's gaming rig. Next: Updates and Firewall.
1. Baseline categories defenders inventory
Support lifecycle: is the build still patched? Services: what listens that you do not need? Remote access: is RDP exposed? Auditing: are security events configured to log?
On $LAB_HOST, read before you change — document current state in notes like a blue-team assessment on owned assets.
Command guide
Try these commands — Baseline categories defenders inventory
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CIS Windows benchmarks — https://www.cisecurity.org/cis-benchmarks Microsoft security baseline — https://learn.microsoft.com/en-us/windows/security/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
systeminfo 2>/dev/null | grep -iE 'OS Name|OS Version|System Type' | head -5 || uname -a ss -tulpn 2>/dev/null | head -8 || echo 'Run Get-ComputerInfo on YOUR Windows lab VM'
═══ WINDOWS ═══
Command — copy this
Get-ComputerInfo | Select-Object OsName, OsBuildNumber, WindowsVersion
Get-Service | Where-Object {$_.Status -eq 'Running'} | Select-Object -First 10 Name, StatusPrimary tools to practice this lesson: powershell, systeminfo. Reference sites: CIS Windows benchmarks (https://www.cisecurity.org/cis-benchmarks); Microsoft security baseline (https://learn.microsoft.com/en-us/windows/security/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Checklists are maps, not weapons
CIS benchmarks and Microsoft security baselines describe desired state. Applying them requires change windows, backups, and rollback on hosts you own.
Copy-pasting hardening scripts from forums onto stranger machines is misuse — not defense homework.
3. Lab boundary on $LAB_HOST
Verify hostname matches $LAB_HOST before opening Local Security Policy or PowerShell as admin. Snapshot the VM first.
Ship: baseline category table for $LAB_HOST only. Next: Updates and Firewall.
4. What you ship: Windows baseline category note for $LAB_HOST
Document OS build, services snapshot, remote access posture on YOUR host. No stranger RDP. chmod 600.
5. What you record before the next lesson
Date. $LAB_HOST OS version. Baseline categories noted. NEVER classmate/employer hosts. File t16-m02-l01-windows-baseline.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Run hardening scripts on a classmate's PC over TeamViewer. Apply CIS GPO to employer AD without change ticket.
- Right: Inventory baseline categories on $LAB_HOST. Next: Updates and Firewall.
Mission: baseline inventory on YOUR Windows host
1) Record OS version and hostname ($LAB_HOST). 2) List three baseline categories and current state (read-only). 3) Snapshot VM if applicable. Never harden hosts you do not own.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor how to read `winver` and service list — not how to harden a dorm PC.
APPLY: A Windows baseline primarily describes:
APPLY: True or False: You may apply hardening GPO to an employer domain without a change ticket.
APPLY: Before changing policy on $LAB_HOST you should:
Updates and Firewall
Part of Defensive Security Basics with AI — Windows Hardening Literacy.
Accounts Hygiene
Part of Defensive Security Basics with AI — Windows Hardening Literacy.
Windows Lab
Part of Defensive Security Basics with AI — Windows Hardening Literacy.