Windows Lab
Baseline readout pack on $LAB_HOST — updates, firewall, accounts; literacy file only.
Visual · windows_lab
Lab: Windows hardening readout pack. $LAB_HOST only. Original Cyberlium.
One host. Three readouts. Evidence before any change window.
Lessons 2-1 through 2-3 covered baseline categories, updates/firewall, and accounts. This lab ships a combined readout: OS version, last patch, firewall profile, local users — all from $LAB_HOST. Optional: one allowed change with snapshot if the brief permits. No RDP to strangers. No employer GPO. Next: Quiz — Windows Hardening Literacy.
1. Lab contract: verify host, then read
Confirm hostname is $LAB_HOST. Snapshot VM. Run read-only inventory: winver, update status, firewall profile, local users.
Write findings to $HOME/cyberlium-lab/t16-m02-l04-windows-lab.txt before any optional change.
Command guide
Try these commands — Lab contract: verify host, then read
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Windows hardening — https://learn.microsoft.com/en-us/windows/security/ CIS Controls — https://www.cisecurity.org/controls
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
ss -tulpn 2>/dev/null | head -10 || echo 'Cross-platform: compare with Windows netstat on YOUR VM'
═══ WINDOWS ═══
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object -First 15 LocalAddress, LocalPort, OwningProcess Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled
Primary tools to practice this lesson: powershell, netstat. Reference sites: Windows hardening (https://learn.microsoft.com/en-us/windows/security/); CIS Controls (https://www.cisecurity.org/controls). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Optional single change with rollback
If brief allows: disable one unnecessary service or add one inbound deny rule on $LAB_HOST — with snapshot and revert steps documented.
Never batch-apply forum hardening scripts to classmate machines.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Linux Hardening Literacy.
4. What you ship: Windows hardening readout for $LAB_HOST
OS, patch, firewall, accounts readout. Optional one change with snapshot. No stranger RDP. chmod 600.
5. What you record before the next lesson
Date. Readout sections complete. $LAB_HOST verified. File t16-m02-l04-windows-lab.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Skip hostname check and harden wrong PC. Export readout from employer server without ticket.
- Right: Combined readout on $LAB_HOST. chmod 600. Next: Quiz — Windows Hardening Literacy.
Mission: Windows hardening evidence pack
1) Verify $LAB_HOST. 2) Complete baseline, update, firewall, account readouts. 3) Optional one change with snapshot. 4) chmod 600. Never target stranger Windows hosts.
Stuck? Ask Cyberlium AI Mentor
Read-only inventory is valid lab completion — change is optional unless brief requires it.
APPLY: This lab requires:
APPLY: True or False: Snapshot before optional hardening change on $LAB_HOST.
APPLY: Employer production server without ticket: