windowsClient Windows Client Master Checklist

Tip: Do the Forensics Questions before hardening. Many answers (a suspicious file's timestamp, a specific user's last logon, a weird registry value) can be erased by your own hardening work — e.g., deleting the malicious user before you've recorded their name, or wiping event logs before you've read the entry the question is asking about.

Tip: Take a "before" and "after" screenshot of the scoring report each session — this helps you see exactly which category(ies) changed and reverse-engineer what you fixed vs. broke.

• Get-ComputerInfo, Get-HotFix, and Get-Service are useful quick first looks that don't change anything on the system yet — safe to run immediately.

• If the README is a physical printout or a locked/read-only file, you can still grab a digital copy of anything on-disk from PowerShell to paste into your notes without retyping it:

Get-Content "C:\Users\Public\Desktop\README.txt" -ErrorAction SilentlyContinue
Get-ChildItem -Path "$env:USERPROFILE\Desktop","C:\Users\Public\Desktop" -Filter "*.txt","*.rtf","*.docx" -ErrorAction SilentlyContinue

• Check whoami /all early — it shows your current username, SID, group memberships, and privileges in one shot, which is useful both for confirming you're logged in as the account you think you are, and as a baseline to compare against later if you suspect your own session got tampered with.

whoami /all

• Note the current date/time and timezone (Get-Date, or the clock in the taskbar) against what you'd expect — a wildly wrong system clock can itself be a scored vulnerability and will also make event log timestamps confusing later when you're doing forensics.

• If your team has more than one person on this box, agree on a simple "claim" system before splitting up sections (e.g., a shared notes doc with initials next to each section) — working the same section twice wastes time, and working conflicting sections simultaneously (e.g., one person disables a service another person just re-enabled) wastes more.

Snapshot Checkpoint — take one right now, before anything else: CyberPatriot images almost always run as a local virtual machine (VirtualBox, VMware, or Hyper-V), and that hypervisor's snapshot feature is your real safety net — separate from, and more powerful than, Windows' own System Restore mentioned above. Take a full snapshot before you change a single setting: VirtualBox = Machine → Take Snapshot; VMware Workstation/Player = VM → Snapshot → Take Snapshot; Hyper-V = right-click the VM in Hyper-V Manager → Checkpoint. If you only take one snapshot all round, make it this one — it can undo a mistake even if Windows itself won't boot or log in anymore.

# Who's logged on / logon history without touching anything
query user
Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4624 or EventID=4625)]]" -MaxEvents 50 |
    Select TimeCreated, Id, Message

# List all local accounts and last logon (answers "how many accounts / who logged on last")
Get-LocalUser | Select Name, Enabled, LastLogon

# File count / size questions
Get-ChildItem -Path C:\Users -Recurse -Include *.mp3,*.mp4,*.avi,*.mkv -ErrorAction SilentlyContinue | Measure-Object

# Ownership / permissions on a specific file or folder
icacls "C:\path\to\file_or_folder"
Get-Acl "C:\path\to\file_or_folder" | Format-List

Tip: If a forensics question asks about something you're about to fix (a malicious user, a bad registry key, a rogue file), answer the question first, or at minimum copy the exact name/path/value into your notes before remediating.

Tip: "Number of administrator accounts," "number of user accounts," and "which services are running" are extremely common forensic-style asks — the commands in Section 3 and Section 9 answer these directly and quickly.

Answer forensics questions using facts you can verify with a command shown above — don't guess. If unsure, re-run the command rather than trusting a earlier note that may now be stale.

• For "which files were recently modified/created" style questions, sort by timestamp instead of scrolling folders by eye:

Get-ChildItem -Path C:\Users -Recurse -File -ErrorAction SilentlyContinue |
    Sort-Object LastWriteTime -Descending | Select-Object -First 25 FullName, LastWriteTime

• For "what is this file's hash / can you prove it's the same file" style questions, generate a hash rather than eyeballing size/name:

Get-FileHash -Algorithm SHA256 "C:\path\to\file.exe"

• For "what did this user open/run recently" style questions, Windows keeps Most-Recently-Used (MRU) lists per user — useful even if the file itself has since been deleted:

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs" -ErrorAction SilentlyContinue
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Recent" -ErrorAction SilentlyContinue | Select Name, LastWriteTime

• For "how many programs are installed" style questions, count rather than scroll-and-tally in Control Panel:

(Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue | Where-Object DisplayName).Count

• For network-configuration questions ("what's this machine's IP/MAC/DNS server"), ipconfig /all gives everything in one place rather than hunting through several GUI panes:

ipconfig /all

Tip: If a question's answer depends on something you might change later (an IP address, a running process, a registry value), take the habit of writing the exact command output into your notes verbatim rather than paraphrasing — a paraphrase like "it was some Python thing" is much less useful when you go to fill in the answer sheet than a copy-pasted process name and path.

A recurring forensics pattern — a real CyberPatriot practice round included a message on the desktop encoded in base64 — is a text file, filename, or note that isn't in plain English because it's been encoded or lightly "encrypted." Recognize the pattern first, then decode:

# Base64 decode — works fully offline, no internet needed
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("SGVsbG8gV29ybGQh"))

# Base64 decode from/to a file using certutil (built into every Windows install, no PowerShell needed)
certutil -decode input.b64 output.txt

# Base64 ENCODE (useful if a question asks you to encode an answer, not just decode one)
[System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("plain text here"))

# Hex decode
-join (("48656c6c6f20576f726c6421") -split '(?<=\G..)(?!$)' | ForEach-Object { [char][Convert]::ToInt32($_,16) })

# ROT13 decode (self-inverse — running it again re-encodes)
function Decode-Rot13($s) {
    -join ($s.ToCharArray() | ForEach-Object {
        if ($_ -cmatch '[a-z]') { [char]((([int][char]$_ - 97 + 13) % 26) + 97) }
        elseif ($_ -cmatch '[A-Z]') { [char]((([int][char]$_ - 65 + 13) % 26) + 65) }
        else { $_ }
    })
}
Decode-Rot13 "Uryyb Jbeyq"

• Where to look for encoded content: desktop .txt/.docx files with odd names, a suspiciously long "comment" or "description" field, image file metadata/EXIF (Get-ItemProperty won't show this — use the file's Properties → Details tab in Explorer), browser bookmarks/saved pages, and recently-modified files (see the timestamp-sort command above).
• Steganography (data hidden inside an image) is rarer but does show up — a loose tell is an image file that's unusually large for what it visually shows. Check Properties → Details for hidden metadata first; dedicated stego-detection tools generally aren't pre-installed and may not be available if the round is offline, so don't sink much time here unless a question explicitly points at a specific image.
• If you're not sure which encoding you're looking at, try base64 first — it's by far the most common in practice, and a failed decode attempt is instant feedback that you're looking at something else.

• Open Start → type lusrmgr.msc (or via Start → Run → MMC → File → Add/Remove Snap-in → Local Users and Groups on editions without lusrmgr.msc, e.g. Home editions).
• Under Users, cross-reference every listed account against the README's authorized list.
  • Never delete an account you're unsure about — disable it instead. Deleted local accounts (and their SIDs/profile data) generally cannot be un-deleted.
  • Disable any account not listed as authorized (right-click → Disable Account).
  • Set/confirm a strong password on every account that should remain enabled.
  • Confirm the Guest account is disabled.
  • Rename the built-in Administrator account unless you are currently logged on as it — if you rename the account you're using, you may lock yourself out mid-session on some builds. If the README specifically says to leave it named "Administrator," follow the README.
• Under Groups, open Administrators and confirm membership matches exactly what the README authorizes. Remove (don't delete the underlying account — just remove group membership) any unauthorized member from the Administrators group.
• Check other privileged/interesting groups too: Remote Desktop Users, Backup Operators, Power Users.

Tip: net user and Get-LocalUser sometimes disagree with what Control Panel shows for accounts hidden from the welcome/login screen via the registry SpecialAccounts\UserList key. Always trust the command-line/registry truth over the GUI login screen.

# Reveal accounts hidden from the Windows logon screen
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" -ErrorAction SilentlyContinue

• Check net accounts to see the currently active password/lockout policy in one shot — useful both for forensics questions and for verifying your policy changes actually applied:

net accounts

• Compare Get-LocalUser output against the SAM registry hive count if you suspect an account is being hidden from normal enumeration (rare, but seen in harder images):

Get-ChildItem "HKLM:\SAM\SAM\Domains\Account\Users\Names" -ErrorAction SilentlyContinue

This key is normally locked down to SYSTEM; if you can't read it as Administrator, that itself can be a forensics-question answer ("why can't you view this key").

• Double- and triple-check before deleting: if you truly must recreate a required user because it was wrongly deleted, use net user <name> <password> /add and re-add to the correct groups — but understand the new SID means file ownership/permissions tied to the old account are gone. Prevention (disable, don't delete) is far better than recovery.

• Check for accounts where the password is set to never expire — a common lingering-access trick, especially on an account that also has no lockout/complexity applied to it:

Get-LocalUser | Select Name, Enabled, PasswordExpires, PasswordLastSet
Get-CimInstance Win32_UserAccount | Where-Object { $_.PasswordExpires -eq $false } | Select Name, Disabled

• List every local group, not just Administrators — a vulnerable image can plant an unauthorized account in a less-obvious group (Backup Operators and Power Users both carry real privileges most competitors forget to check):

Get-LocalGroup
net localgroup

foreach ($g in (Get-LocalGroup).Name) { Write-Host "`n== $g ==" ; Get-LocalGroupMember -Group $g -ErrorAction SilentlyContinue }

• On Windows 10/11, netplwiz (Start → Run → netplwiz) is a faster GUI alternative to lusrmgr.msc for a quick pass on account list + group membership + "require password to log on," if the full Local Users and Groups snap-in feels slow to navigate.

• Verify a rename or password change actually stuck by reading it back immediately rather than assuming the dialog box succeeding means it worked:

Get-LocalUser | Select Name, Enabled, PasswordLastSet

Snapshot Checkpoint: You're about to start mass-editing Local Security Policy (Sections 4–6) using secpol.msc and secedit import/export. A bad secedit import or an overly aggressive lockout/rights change can lock accounts out or break logon entirely, and it's not always obvious which line caused it. Take a fresh snapshot now if you don't already have one from the last few minutes — it's much faster than troubleshooting a locked-out box afterward.

• secpol.msc → Security Settings → Account Policies → Password Policy — set each value above.
• Account Policies → Account Lockout Policy — set each value above.

• Step 1 — check current policy. This is read-only and safe to run any time:

net accounts

The secedit export/edit/import pattern below does the same job as the GUI method above, but scripted — useful if you're applying the same values across multiple machines, or just prefer text-editing to clicking through dialogs. It's four distinct steps; don't skip the "verify" step at the end.

• Step 2 — export the current policy to a text file. This creates C:\secpol.cfg, a plain-text snapshot of every current Local Security Policy setting:

secedit /export /cfg C:\secpol.cfg

• Step 3 — edit the exported file. Open C:\secpol.cfg in Notepad, find the [System Access] section, and change (or add, if missing) these specific lines to the values below — leave every other line in the file untouched:

MinimumPasswordAge = 1
MaximumPasswordAge = 30
MinimumPasswordLength = 14
PasswordComplexity = 1
PasswordHistorySize = 24
LockoutBadCount = 5
ResetLockoutCount = 15
LockoutDuration = 30
RequireLogonToChangePassword = 1

Save the file when done. Expected result: Notepad saves without complaint; the file still opens and looks like normal .ini-style text. If it fails: If Notepad refuses to save citing "Access is denied," you edited a copy outside your own write permissions (e.g. C:\ root with a restrictive image) — save as a copy to C:\Users\Public\ instead and use that path in Step 4. If a line you need (e.g. PasswordHistorySize) simply doesn't exist in the exported file, add it as a new line under [System Access] exactly as shown — secedit accepts added lines as long as they're valid keys in the right section.

• Step 4 — re-import the edited file to apply it. This is the step that actually changes the running system's policy:

secedit /configure /db C:\Windows\security\local.sdb /cfg C:\secpol.cfg /areas SECURITYPOLICY

• Step 5 — verify it took effect. Re-run net accounts and confirm the numbers match what you just set — secedit fails silently on a malformed line, so this step isn't optional:

net accounts

Prefer to skip manual Notepad editing? The block below automates Steps 2–4 as one script — same net effect, no Notepad required:

secedit /export /cfg C:\secpol.cfg
(Get-Content C:\secpol.cfg) | ForEach-Object {
    if ($_ -match "MinimumPasswordAge")            { "MinimumPasswordAge = 1" }
    elseif ($_ -match "MaximumPasswordAge")        { "MaximumPasswordAge = 30" }
    elseif ($_ -match "MinimumPasswordLength")     { "MinimumPasswordLength = 14" }
    elseif ($_ -match "PasswordComplexity")        { "PasswordComplexity = 1" }
    elseif ($_ -match "PasswordHistorySize")       { "PasswordHistorySize = 24" }
    elseif ($_ -match "LockoutBadCount")           { "LockoutBadCount = 5" }
    elseif ($_ -match "ResetLockoutCount")         { "ResetLockoutCount = 15" }
    elseif ($_ -match "LockoutDuration")           { "LockoutDuration = 30" }
    elseif ($_ -match "RequireLogonToChangePassword") { "RequireLogonToChangePassword = 1" }
    else { $_ }
} | Set-Content C:\secpol.cfg
secedit /configure /db C:\Windows\security\local.sdb /cfg C:\secpol.cfg /areas SECURITYPOLICY
net accounts

Tip: Password Policy and Account Lockout Policy are among the most reliably scored, highest-yield items in CyberPatriot — they're simple checkboxes/numbers for the engine to verify and are almost always tested. Do this section early and don't skip it.

Tip: After using secedit, immediately re-run net accounts to confirm the values actually took — secedit import syntax errors fail silently in some Windows builds.

• "Limit local account use of blank passwords to console logon only" should be Enabled — check under Security Options (Section 6).
• If a user has no password and can't have one set for scenario reasons, that specific policy interaction is a classic trap — verify with net user <name> that Password Required is Yes.

CIS Benchmark cross-reference: The value ranges in the table above align closely with the CIS Microsoft Windows 10/11 Benchmark, Level 1 guidance for Account Policies — the published CIS baseline uses the same shape (password history in the 20s, minimum length around 14 characters, complexity enabled, lockout threshold in the low single digits). If you have access to the free CIS Benchmark PDF (published by the Center for Internet Security), it's a legitimate, citable source if a judge or mentor asks where a specific number came from, rather than "a checklist said so."

• CIS Level 1 also calls out "Store passwords using reversible encryption" (must be Disabled — already reflected in the table above) as a setting worth double-checking specifically; it's easy to overlook because it defaults correctly on most images, but a vulnerable image may have flipped it.

• If secpol.msc won't open or its Account Policies node looks empty/greyed-out (seen occasionally on Home editions or oddly-configured images), fall back to the net accounts command-line method above — it reads and can partially set the same underlying policy without the snap-in.

• Double-check the policy actually applies locally and isn't being silently overridden by a domain GPO if this machine is domain-joined — gpresult /r (or the fuller /z dump discussed in Section 24) will show whether "Local Group Policy" or a domain policy actually won for each setting.

• Each individual user account also has its own per-account password flags that override the domain-wide/local policy for that one account — worth a quick sanity check if one specific account seems immune to your policy changes:

Get-CimInstance Win32_UserAccount | Select Name, PasswordRequired, PasswordChangeable, PasswordExpires

• Set every audit category to Success and Failure unless the README says otherwise. This is explicitly called out in the source checklist as a category worth extra attention.

:: Enable auditing on every legacy category, success+failure
auditpol /set /category:"Account Logon" /success:enable /failure:enable
auditpol /set /category:"Account Management" /success:enable /failure:enable
auditpol /set /category:"Detailed Tracking" /success:enable /failure:enable
auditpol /set /category:"DS Access" /success:enable /failure:enable
auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
auditpol /set /category:"Object Access" /success:enable /failure:enable
auditpol /set /category:"Policy Change" /success:enable /failure:enable
auditpol /set /category:"Privilege Use" /success:enable /failure:enable
auditpol /set /category:"System" /success:enable /failure:enable

:: Or, blanket enable everything at once
auditpol /set /category:* /success:enable /failure:enable

# Review current audit policy state
auditpol /get /category:*

Recommended baseline (adjust to README; the general rule is: sensitive rights go to Administrators only, and dangerous rights should be assigned to No One unless specifically required):

Do not remove built-in NETWORK SERVICE / LOCAL SERVICE from rights they hold by default, even if the field appears to show "No One" as your target value — that guidance applies to user accounts, not the built-in service identities. Removing those breaks core OS functionality.

Tip (high yield): Watch for SeRemoteInteractiveLogonRight (Allow log on through RDS) and SeDenyRemoteInteractiveLogonRight — these directly gate who can RDP in, and vulnerable images commonly add an unauthorized account here.

Tip: SeDebugPrivilege and SeTakeOwnershipPrivilege granted to a non-admin standard user is a classic privilege-escalation plant — check these first if a forensics question mentions "elevated privileges" or "unusual access."

CIS Benchmark cross-reference: CIS's Advanced Audit Policy Configuration guidance (a more granular replacement for the legacy 9-category Audit Policy used above) recommends specific Success/Failure settings per subcategory rather than one blanket "enable everything" — some subcategories are recommended Failure-only specifically to cut down on log noise. The blanket auditpol /set /category:* /success:enable /failure:enable command in this section is a reasonable, safe superset for a competition round, but if you have time, opening secpol.msc → Advanced Audit Policy Configuration and reviewing the roughly 50 individual subcategories against the CIS per-subcategory table is a legitimate "extra credit" pass.

• CIS Level 1 User Rights Assignment guidance also explicitly calls out adding Guest to the "Deny access to this computer from the network," "Deny log on as a batch job," "Deny log on as a service," and "Deny log on locally" rights (not just leaving them at "No One") — an enabled Guest account with logon rights left unrestricted is a classic combination vulnerability. Cross-check this if your image has the Guest account enabled for any reason.

• Audit MPSSVC Rule-Level Policy Change — a CIS Level 1 Advanced Audit Policy subcategory that's easy to overlook because it's not one of the "big" categories, but it specifically logs changes to Windows Firewall rules (MPSSVC is the firewall service). Since firewall tampering is one of the most common things a scenario plants, having this enabled means you get a log trail if a rule gets silently added/removed after your initial pass:

  cmd

  Copy

  auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:enable /failure:enable
  

  Expected result:The command was successfully executed.
  If it fails:"The subcategory name is unrecognized" — the exact wording is version-sensitive; run auditpol /list /subcategory:"Policy Change" to see the exact subcategory names this build recognizes and copy the spelling verbatim (quotes and all).

• auditpol /get /category:* is hard to read as a wall of console text — add /r for CSV-formatted output, which pastes cleanly into a spreadsheet or notes doc if you want to review all ~50 subcategories at once:

auditpol /get /category:* /r

• Back up your audit policy configuration once you've got it the way you want, so a later mistake (or a teammate accidentally re-running an old command) doesn't quietly undo your work:

auditpol /backup /file:C:\auditpolicy_backup.csv
:: To restore later if needed:
auditpol /restore /file:C:\auditpolicy_backup.csv

• If you'd rather review Audit Policy visually instead of parsing command output, secpol.msc → Security Settings → Advanced Audit Policy Configuration → System Audit Policies shows every subcategory with checkboxes for Success/Failure — a good option when double-checking a specific category rather than dumping everything.

Tip (high yield): Network access: Do not allow anonymous enumeration of SAM accounts (and shares) and LAN Manager authentication level are frequently included in scored checklists because they map directly to well-known enumeration/relay attacks — prioritize these.

Tip: Many of these Security Options can also be read/set via the registry directly if secpol.msc is being uncooperative (e.g., missing snap-in on Home editions) — search HKLM:\SYSTEM\CurrentControlSet\Control\Lsa for LAN Manager/anonymous-access values, and HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System for UAC/logon values.

# Restrict anonymous access / null sessions
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RestrictAnonymous" -Value 1 -Type DWord
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RestrictAnonymousSAM" -Value 1 -Type DWord
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "EveryoneIncludesAnonymous" -Value 0 -Type DWord
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name "RestrictNullSessAccess" -Value 1 -Type DWord

CIS Benchmark cross-reference: This entire Security Options table (accounts, audit, devices, interactive logon, network access/security, UAC) is essentially a client-focused subset of CIS Microsoft Windows 10/11 Benchmark, Level 1, "Security Options." If you want to verify a value against an authoritative published source rather than this document, that's the section to open.

• CIS Level 1 also recommends "Network security: Minimum session security for NTLM SSP based (including secure RPC) clients" and the matching "...servers" setting both be set to Require NTLMv2 session security, Require 128-bit encryption — a natural companion to the LAN Manager authentication level setting already in the table above.

• Level 2 (worth trying if you have time and it doesn't break required functionality): CIS Level 2 recommends "Network access: Restrict clients allowed to make remote calls to SAM" be limited to Administrators. This is stricter than Level 1 and can break legitimate remote-administration tooling if your scenario relies on any — test carefully before depending on it for points.

• secedit /export /cfg C:\secopts.cfg /areas SECURITYPOLICY dumps every Security Options value as plain text in one shot — much faster to skim (or grep with Select-String) than clicking through ~50 individual dialog boxes in secpol.msc one at a time when you just want to verify current state.

• gpresult /z dumps the full effective policy actually applied to this machine and user — every Computer and User Configuration setting currently in force, from whatever combination of local policy, any GPOs, and any registry-level tampering produced it. Run it as a final verification pass after you've made your changes:

  powershell

  Copy

  gpresult /z > C:\gpresult_after.txt
  

  Expected result:Creates a large text file (often several thousand lines) with COMPUTER SETTINGS and USER SETTINGS sections, each listing the winning GPO/local policy source and every applied setting value.
  If it fails:

  • "Access is denied" needs elevation.
  • If the file seems suspiciously short or missing whole sections, the account you're running it as may lack rights to read some policy data — run from an elevated Administrator prompt, not just any admin-group console.
  • gpresult /z can take 10-30+ seconds on domain-joined machines; it isn't hung, just slow. This is useful two ways: (1) it confirms your own hardening actually took effect (rather than trusting that clicking "Apply" in secpol.msc worked), and (2) it can surface policy-based sabotage you haven't found yet — a setting showing up in the effective result that you never configured and that isn't in this checklist is worth investigating.

• "Network security: LAN Manager authentication level" has a direct registry equivalent if you'd rather script it than click through the dropdown — the value 5 corresponds to "Send NTLMv2 response only, refuse LM & NTLM" (the recommended setting in the table above):

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "LmCompatibilityLevel" -Value 5 -Type DWord

• "Network access: Do not allow anonymous enumeration of SAM accounts (and shares)" corresponds to RestrictAnonymous at the registry level: 0 = allow (bad, vulnerable default on some old images), 1 = don't allow enumeration of SAM accounts, 2 = don't allow enumeration of SAM accounts and shares (strictest, matches "and shares" in the policy name). Cross-check the live value if the secpol.msc GUI setting doesn't seem to be sticking:

Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RestrictAnonymous" -ErrorAction SilentlyContinue

1. Open wf.msc (Windows Firewall with Advanced Security) directly, or via MMC → Add/Remove Snap-ins → Windows Firewall with Advanced Security.
2. On the home page, click Windows Firewall Properties. This one dialog has three tabs — Domain Profile, Private Profile, Public Profile — and you need to repeat the same four checks on each of the three tabs (Windows applies a different firewall configuration depending on which network type you're connected to, so all three need to be correct, not just the one currently active):
   • Firewall state dropdown: On. (This is the master switch for that profile — everything else is irrelevant if this is off.)
   • Inbound connections: Block (the default). (This is what actually stops unsolicited incoming traffic.)
   • Outbound connections: Allow (the default, unless README says otherwise). (Blocking outbound by default tends to break required functionality unless the scenario specifically calls for it — don't flip this without a reason.)
   • Click the Settings button (if reviewing notification behavior) and the Logging section's Customize button: set Log dropped packets = Yes, Log successful connections = Yes, and raise the log size limit (e.g., 4096–16384 KB). (This is what gives you evidence later if a forensics question asks about blocked/allowed connections.)
3. Click OK to close the Properties dialog once all three tabs are done.
4. Back on the main window, click Inbound Rules in the left pane and scan the list for anything related to: Telnet, netcat/nc/Ncat, File and Printer Sharing (unless required), Remote Assistance, Remote Desktop (unless required), SNMP, SMTP, or any other rule that shouldn't be allowing traffic in. Disable (don't delete) anything unauthorized you find.
5. Click Outbound Rules and repeat the same review if the scenario calls for outbound restriction — this is less commonly needed than inbound review, but worth a glance.

# Flush DNS cache (source checklists call this out explicitly)
ipconfig /flushdns

# Find listening ports and tie them back to a process (kill malicious listeners)
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Get-Process -Id <PID>

netstat -ano

Tip: Cross-reference every listening PID against Task Manager's Details tab (or Get-Process). Standard Windows processes you'll see repeatedly: System, svchost.exe, lsass.exe, services.exe, wininit.exe, spoolsv.exe. Anything unfamiliar tied to a listening port deserves a closer look — check its Get-Process -Id <PID> | Select Path and verify the digital signature.

# Check code-signing on a suspicious binary (built into Windows, no download needed)
Get-AuthenticodeSignature "C:\path\to\suspect.exe"

• Check the hosts file for unauthorized DNS redirection — a classic hidden-persistence trick:

Get-Content C:\Windows\System32\drivers\etc\hosts | Where-Object { $_ -notlike "#*" -and $_.Trim() -ne "" }

• Check for hidden port-forwarding/proxy rules and rogue static routes:

netsh interface portproxy show all
route print

• Disable legacy/insecure name resolution protocols that firewall rules alone don't stop:

New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name "EnableMulticast" -Value 0 -Type DWord

Tip: Never leave the firewall "off" while you work through the rest of the checklist "for convenience," then forget to turn it back on. Enable it early — it doesn't block your own admin activity in almost all CyberPatriot scenarios.

CIS Benchmark cross-reference: The three-profile (Domain/Private/Public), state-on/inbound-block/outbound-allow, log-everything approach in this section matches CIS Microsoft Windows 10/11 Benchmark, Level 1, "Windows Defender Firewall with Advanced Security" guidance directly.

• CIS Level 1 specifies a minimum firewall log file size per profile (commonly cited around 16,384 KB) — if your logging size limit is left at Windows' tiny default, bump it up; a log that rotates too fast loses evidence you might need for forensics questions.

• If the firewall configuration looks like it's been tampered with in a way that's hard to untangle rule-by-rule, resetting to Windows defaults and re-applying only what you need is often faster than auditing dozens of custom rules one at a time:

netsh advfirewall reset

This restores default rules and profile settings — re-run your profile state/logging configuration afterward, since the reset also clears those.

• Once you're happy with the firewall configuration, export it so you have a known-good backup you can restore from without redoing everything by hand:

netsh advfirewall export "C:\firewall_backup.wfw"
:: To restore later:
netsh advfirewall import "C:\firewall_backup.wfw"

• Custom rules added outside the normal "allow an app through the firewall" flow often lack a DisplayGroup (the category an app-installed rule normally belongs to) — filtering for that is a quick way to surface manually-added rules that might be planted:

Get-NetFirewallRule | Where-Object { -not $_.DisplayGroup -and $_.Enabled -eq "True" } | Select DisplayName, Direction, Action

• Quick GUI-free status check without opening wf.msc at all — useful for a fast sanity check mid-round:

netsh advfirewall show allprofiles

These are large, slow scans — start each one and keep working on other checklist sections while it runs rather than sitting and watching the progress bar. Do them in whatever order lets you multitask best; a common pattern is to kick off Malwarebytes first (it's usually the slowest), work on accounts/firewall/services while it runs, then handle CCleaner and Spybot's faster passes.

Malwarebytes (free edition — anti-malware scanner)

1. Download from the official site, malwarebytes.com → Free Download. Don't use a mirror or search-result link you're not sure about.
2. Run the installer. When it offers a Premium trial, uncheck/decline it — the free scan-and-remove functionality is everything you need, and accepting the trial just adds nag prompts.
3. Let it launch after install. If it offers to update its detection database and you have internet, accept — an out-of-date scanner catches less.
4. Click Scan and choose the most thorough option offered — labeled Full Scan in older versions, or just the default Scan button (which runs a full Threat Scan) in newer ones. Avoid "Quick Scan" if a more thorough option exists.
5. Wait for it to finish (can take 10-30+ minutes) — go work on other sections.
6. When it's done, review the results list, make sure everything found is selected, and click Quarantine/Remove Selected.
7. Restart if it prompts you to, once you're at a natural stopping point.

CCleaner (free edition — junk/registry cleaner)

1. Download from the official site, ccleaner.com. During install, watch for and decline any bundled extra software/toolbar offers in the installer.
2. Open CCleaner. Go to the Cleaner (or Custom Clean, depending on version) tab.
3. If prompted "Intelligently scan for cookies to keep," choose No — keep the pass simple and fast.
4. Click Analyze, review what it found, then click Run Cleaner to clear temp/junk files.
5. Switch to the Registry tab → Scan for Issues.
6. Click Fix Selected Issues — it will offer to back up the change to a .reg file first. Accept this (click Yes) so you have a rollback path if fixing an entry breaks something.
7. Click through and fix all listed issues.

Spybot – Search & Destroy (free "Home Use" edition — anti-spyware scanner)

1. Download from the official site, safer-networking.org, selecting the free Home Use edition.
2. During installation, if you're offered an install-type choice, pick the more advanced/thorough option (older versions phrase this as "I want more control, more feedback, and more responsibility") rather than the minimal default — this enables the fuller scan capability.
3. After install, if prompted, check "Open Start Center" and "Check for new malware signatures," then click Finish.
4. Before scanning, go to the Update tab and update definitions if internet is available.
5. From the Start Center, run a System Scan.
6. Let it complete (can be slow), review flagged items, select them, and remove/fix.

After running any/all of the above:

• Re-check the scoring report. These tools sometimes flag or remove things unrelated to actual scoring criteria, and can occasionally interfere with a required program — don't let an AV tool uninstall or quarantine anything the README says is required. If something required goes missing after a scan, that's the first place to look.
• Uninstall the cleaning tools themselves at the end if the scenario doesn't call for them to remain installed — leaving Malwarebytes/CCleaner/Spybot installed generally isn't a problem, but check your competition's specific guidance on staged/installed third-party tools.

Sysinternals Suite (Process Explorer, Autoruns, TCPView, Sigcheck) — portable, no installer needed If internet access is available and permitted: download the ZIP directly from Microsoft's official Sysinternals page (learn.microsoft.com/sysinternals → Downloads → Sysinternals Suite), extract it anywhere (e.g., C:\Tools\Sysinternals), and run the executables directly — no installation step, they're portable EXEs:

• Process Explorer (procexp64.exe) — a far more detailed Task Manager replacement; right-click any process → Check VirusTotal (needs internet) or view its full path, loaded DLLs, and digital signature at a glance.
• Autoruns (autoruns64.exe) — shows every autostart location Windows has (Run keys, services, scheduled tasks, IFEO, WMI subscriptions, and more) in one tabbed view — the single best tool for the persistence-hunting work in Section 22, when available.
• TCPView (tcpview.exe) — live GUI view of every network connection and the process behind it, a GUI alternative to netstat -ano.
• As covered earlier in this section: don't build your primary strategy around these being available, since a scoring image is frequently offline — but if your competition's rules allow pre-staging tools before the round starts, having a copy ready to go is a legitimate time-saver.

• Control Panel → Programs → Uninstall a Program. Review every entry.
  • Uninstall anything not required by the README (games, P2P/torrent clients, cracking/keygen tools, remote-access tools not authorized, hacking tools, old vulnerable software versions).
  • Do not uninstall required software, browsers, runtimes (.NET, Visual C++ redistributables — these are dependencies for other software), or anything explicitly listed as authorized.
  • If uninstall fails with "access denied" or "in use," find and end the locking process in Task Manager (Details tab), then retry.
• Some software hides itself from the visible Uninstall list but leaves registry traces. Check both 64-bit and 32-bit uninstall keys:

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
    Select DisplayName, DisplayVersion, Publisher, UninstallString | Where-Object { $_.DisplayName }

Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
    Select DisplayName, DisplayVersion, Publisher, UninstallString | Where-Object { $_.DisplayName }

# Alternative enumeration (can be slow / triggers reconfig side effects on some systems — use read-only listing, avoid calling .Uninstall() unless you mean it)
Get-CimInstance -ClassName Win32_Product | Select Name, Version, Vendor

Caution: Win32_Product enumeration is known to trigger Windows Installer consistency-checking as a side effect on some systems (can be slow and, rarely, reconfigure/repair installed MSI packages). Prefer the registry Uninstall key query above for a safer read-only listing; use Win32_Product mainly when you specifically need .Uninstall() scripting against an MSI-based app.

A very common technique across CyberPatriot rounds: an exclusion gets added to Windows Defender's real-time scanning — an entire drive letter, a broad user-profile folder, or a specific "hiding spot" like C:\Users\Public — so that anything sitting there is silently never scanned. This is easy to miss because Defender otherwise still shows as "on" and "protecting" in the Security app; the exclusion list is a separate, less visible setting.

• Check every exclusion category — path, file extension, and process are all separate lists, so check all three:

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-MpPreference | Select-Object -ExpandProperty ExclusionExtension
Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess

• Treat any of the following as a red flag worth removing:
  • An exclusion pointing at an entire drive letter (C:\, D:\)
  • An exclusion pointing at a whole user profile folder (C:\Users\<name>\) rather than one specific, justifiable application subfolder
  • An exclusion pointing at Downloads, Temp, AppData\Roaming, or another common malware-drop location
  • A file-extension exclusion that's unusually broad (.exe, .dll, .*) rather than something narrow and clearly justified
• Remove any confirmed-bad exclusion:

Remove-MpPreference -ExclusionPath "C:\Users\Public"
Remove-MpPreference -ExclusionExtension ".exe"
Remove-MpPreference -ExclusionProcess "suspicious.exe"

• Re-run a scan after removing exclusions — anything that was hiding behind them will only get caught on the next scan, not retroactively:

Start-MpScan -ScanType QuickScan
# Or for a more thorough (slower) pass:
Start-MpScan -ScanType FullScan

Tip: Exclusions can also be enforced via Administrative Templates/Group Policy registry keys instead of the live Get-MpPreference settings — if Get-MpPreference shows nothing but you still suspect exclusions, also check HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths (and the ...\Extensions / ...\Processes siblings), since GPO-set exclusions can be layered on separately from what the Security app shows you.

Tip: Get-Process | Sort-Object CPU -Descending and Get-Process | Sort-Object WS -Descending (working set/memory) can surface a resource-hungry malicious process you'd otherwise miss by just eyeballing Task Manager.

Get-Process | Sort-Object CPU -Descending | Select-Object -First 15 Name, Id, CPU, Path

Tip: Sysinternals tools (Process Explorer, Autoruns, TCPView, Sigcheck) are excellent for malware hunting but are not pre-installed on stock Windows and typically cannot be downloaded mid-competition if the scoring image has no internet access. If your team is allowed to stage tools before the round (check your competition's rules), pre-stage a portable copy; otherwise rely on the built-in PowerShell/CMD equivalents throughout this document (Get-Process, Get-CimInstance Win32_StartupCommand, Get-AuthenticodeSignature, registry Run-key queries, etc.) which ship with every Windows install.

• Sweep for prohibited files — media, hacking tools, cracks — in common user-writable locations:

Get-ChildItem -Path C:\Users -Recurse -Include *.mp3,*.mp4,*.avi,*.mkv,*.wav,*.mov -ErrorAction SilentlyContinue |
    Select FullName, Length | Format-Table -AutoSize

Get-ChildItem -Path C:\Users\Public, C:\ProgramData, C:\Windows\Temp -Recurse `
    -Include *.mp3,*.mp4,*.avi,*.exe,*.bat,*.vbs,*.ps1 -ErrorAction SilentlyContinue

• Common CyberPatriot "prohibited items" to search for by name/keyword: nmap, Wireshark, Metasploit, Cain and Abel, netcat/nc/ncat, John the Ripper, keyloggers, LOIC/HOIC, uTorrent/BitTorrent/qBittorrent, any game titles (Steam, Minecraft, etc. unless authorized), cracking/keygen tools, TeamViewer/AnyDesk/remote-access software not authorized by README.

Get-ChildItem -Path "C:\","C:\Program Files","C:\Program Files (x86)","C:\Users" -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match "nmap|wireshark|metasploit|cain|netcat|ncat|keygen|crack|nc\.exe|torrent" } |
    Select FullName

• Check for hidden secondary data streams (a way to hide payloads inside an otherwise normal file) — an advanced technique worth a quick sweep in user-writable folders:

Get-ChildItem -Path C:\Users -Recurse -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' }

• Run the built-in System File Checker / DISM if you suspect core OS files were tampered with (safe, offline-capable):

sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

Tip: DISM /RestoreHealth needs a source of clean files; if it fails offline due to no WSUS/internet source, that's expected on an air-gapped scoring VM — sfc /scannow alone still checks and repairs from the local component store when possible.

CIS Benchmark cross-reference: Beyond the AV/cleaner tools above, CIS Level 1 has a dedicated "Windows Defender Antivirus" / "Microsoft Defender Antivirus" Administrative Templates block worth checking: real-time protection must stay on, cloud-delivered protection and automatic sample submission should be enabled, and PUA (Potentially Unwanted Application) protection should be set to Block. Check under gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus (exact path name varies slightly by Windows version) rather than assuming defaults are fine on a vulnerable image.

# Quick check of current Defender configuration without changing anything
Get-MpPreference | Select DisableRealtimeMonitoring, MAPSReporting, SubmitSamplesConsent, PUAProtection
Get-MpComputerStatus | Select AntivirusEnabled, RealTimeProtectionEnabled, AntispywareEnabled

• Two more CIS Level 1 Defender settings that live outside the basic on/off toggle and are easy to miss: Network Protection (blocks connections to known-malicious sites/IPs at the network level — separate from browser-based SmartScreen) and e-mail scanning (scans email attachments/content, off by default):

  powershell

  Copy

  Set-MpPreference -EnableNetworkProtection Enabled
  Set-MpPreference -DisableEmailScanning $false
  

  Expected result:

  • Silent on success.
  • Verify with Get-MpPreference | Select EnableNetworkProtection, DisableEmailScanning.
  If it fails:

  • "The operation requires elevation" needs an Administrator PowerShell session.
  • Network Protection needs Defender's real-time protection already enabled to function — if it doesn't seem to be blocking anything, confirm real-time protection status first (checked in the query just above this bullet).

• Check signature freshness — a Defender that's "on" but running on ancient virus definitions is barely better than no AV at all, and is an easy thing to overlook since the app doesn't loudly warn you:

Get-MpComputerStatus | Select AntivirusSignatureLastUpdated, AntivirusSignatureAge, AntispywareSignatureAge

If internet access is available, force an update: Update-MpSignature. Expected result: AntivirusSignatureAge in days — low single digits is healthy. If it fails: A large age (weeks/months) on an offline image is expected and often unfixable without internet — note it rather than looping on Update-MpSignature, which will just time out if there's genuinely no connectivity. Update-MpSignature failing with a network error confirms no internet rather than indicating a broken command.

• Check Defender's own detection history — if it already caught and quarantined something, that's often the fastest way to find out what the "planted malware" for this round actually was, without doing a from-scratch file sweep:

Get-MpThreatDetection
Get-MpThreat

• If a forensics question gives you a known-bad file hash to search for, compare it directly instead of relying on Defender to have already caught it:

Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue |
    Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue |
    Where-Object { $_.Hash -eq "PUT_KNOWN_BAD_HASH_HERE" }

This is a slow, whole-disk operation — narrow the -Path to a specific folder if you have any idea where to look first.

The service table above traces back to an older Windows 7/8-era baseline and misses several services that ship on modern Windows 10/11 images and are explicitly called out in the current CIS Windows Benchmark:

• OpenSSH Server (sshd) — (L1) should be uninstalled/disabled unless explicitly required. This is an optional Windows feature (Settings → Apps → Optional Features) that, once enabled, opens a full SSH remote-access path into the box — a real and easily-missed backdoor since competitors instinctively check RDP but often forget Windows ships its own SSH server option.
  powershell

  Copy

  Get-WindowsCapability -Online | Where-Object Name -like "OpenSSH.Server*"
  Get-Service sshd -ErrorAction SilentlyContinue
  # If present and not required:
  Stop-Service sshd; Set-Service sshd -StartupType Disabled
  Remove-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
  

• Windows Subsystem for Linux (LxssManager) — (L1) should be disabled unless required. WSL gives a full Linux userland running alongside Windows, which is both a legitimate attack-surface expansion and a way to run Linux tools that Windows-only security tooling won't see.
  powershell

  Copy

  Get-Service LxssManager -ErrorAction SilentlyContinue
  Set-Service LxssManager -StartupType Disabled -ErrorAction SilentlyContinue
  

  Expected result: Get-Service shows current status if WSL/LxssManager is installed, or nothing (suppressed error) if it isn't — most client images won't have it at all. Set-Service is silent on success. If it fails: No error mode given the suppression flag; absence is the common case and means this bullet is a no-op, not a failure.

A recurring planted-vulnerability pattern: a malicious service is given a name deliberately similar to a real Windows service — a fake variant of svchost, a near-duplicate of a legitimate service's display name with a typo, or a service with a vague, self-referential description (e.g. "Provides service functionality" that doesn't actually describe anything). At a glance in services.msc these blend right in with the ~150 legitimate entries.

• Pull name, display name, executable path, and the account it runs as all together, so you can eyeball inconsistencies in one table instead of clicking into each service's Properties individually:

Get-CimInstance Win32_Service | Select-Object Name, DisplayName, PathName, StartName | Sort-Object Name

• Cross-reference the executable path against where it should be — genuine core Windows services run from C:\Windows\System32\ (or occasionally C:\Windows\SysWOW64\), not from a user profile, AppData, ProgramData, or a temp folder:

Get-CimInstance Win32_Service | Where-Object { $_.PathName -and $_.PathName -notmatch '^"?C:\\Windows\\(System32|SysWOW64)' -and $_.PathName -notmatch '^"?C:\\Program Files' } |
    Select-Object Name, DisplayName, PathName, StartName

This will also catch legitimately-installed third-party services (antivirus, VMware Tools, printer drivers) — the point isn't that every result is bad, it's that this list is now small enough to actually review by eye instead of scrolling past 150 entries. Expected result: A shorter list than the full table — mostly legitimate third-party software as the callout notes. If it fails: No error mode; a hit running from AppData, a temp folder, or C:\Users\Public (rather than a recognizable Program Files subfolder for known software) is the pattern actually worth chasing.

• Check the digital signature on anything that looks even slightly off — a real Microsoft service binary will show a valid Microsoft signature:

Get-AuthenticodeSignature "C:\Windows\System32\suspicious_svc.exe" | Select Status, SignerCertificate

• Services running under an unusual account are worth a second look — most legitimate services run as LocalSystem, NT AUTHORITY\LocalService, NT AUTHORITY\NetworkService, or a proper NT SERVICE\<name> virtual account, not as a specific named user (especially not an Administrator account):

Get-CimInstance Win32_Service | Where-Object { $_.StartName -and $_.StartName -notmatch 'LocalSystem|NT AUTHORITY|NT SERVICE' } |
    Select-Object Name, DisplayName, StartName

Tip: For any service you don't recognize, right-click → Properties → check the Path to Executable. Type that path into Get-AuthenticodeSignature or just navigate to the folder in Explorer (don't double-click it) and check the file's Properties → Digital Signatures tab. An unsigned binary running as a "service" in a weird folder (C:\Users\...\AppData instead of C:\Windows\System32 or C:\Program Files\...) is a strong malware indicator.

Get-CimInstance Win32_Service | Select Name, DisplayName, State, StartMode, PathName | Sort-Object State -Descending

• Services with StartMode = Auto but currently State = Stopped are worth a glance — that mismatch can mean the service crashed, was manually stopped after being tampered with, or is misconfigured in a way that's itself the vulnerability being scored:

Get-CimInstance Win32_Service | Where-Object { $_.StartMode -eq "Auto" -and $_.State -eq "Stopped" } | Select Name, DisplayName, PathName

• Hunt for unquoted service path vulnerabilities — a classic privilege-escalation flaw where a service path with spaces and no quotes lets an attacker plant an executable earlier in the path:

Get-CimInstance Win32_Service | Where-Object { $_.PathName -notlike '"*' -and $_.PathName -like '* *' } |
    Select-Object Name, PathName

Tip: A blank/missing service Description field is unusual for genuine Microsoft services — the original checklist author's rule of thumb ("Microsoft is meticulous about descriptions; a missing one is suspicious") is a reasonable heuristic, not a guarantee. Verify with signature checks too.

CIS Benchmark note: Unlike the Account/Audit/Security Options sections above, the CIS Windows Benchmark does not publish a comprehensive "which services should be on/off" table like the one in this section — service hardening of this kind is more of a general security-hygiene practice (closer to Microsoft's own Security Compliance Toolkit baselines) than a specific CIS control. Don't expect to find a 1:1 citation for every row in the Services table above; treat that table as community-sourced practical guidance rather than a CIS-derived standard.

• Windows 7/8: msconfig → Startup tab.
• Windows 8.1/10/11: Task Manager → Startup tab (or Startup Apps in Settings on Win11).
• Only expected/required items should remain enabled — e.g., legitimate virtualization tools if this is itself a VM guest, an authorized antivirus, or software explicitly required by the README. Disable everything else.
• For anything suspicious, note its name and file path, research it, and remove/uninstall the underlying program if it's confirmed unwanted (see Section 8).

• Startup entries also live in the registry Run keys — check all of these, not just msconfig/Task Manager's view (some malware writes directly to the registry and doesn't always surface cleanly in the GUI):

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*" -ErrorAction SilentlyContinue
Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run*" -ErrorAction SilentlyContinue
Get-ItemProperty "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*" -ErrorAction SilentlyContinue

• Also check the Startup folders directly (shortcuts placed here run at logon without needing a registry entry):

Get-ChildItem "C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
Get-ChildItem "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"

Tip: Anything referencing nc.exe, netcat, ncat, bfk, telnet, or an obfuscated/base64-looking command line in a Run key is an immediate red flag — remove the registry value (Remove-ItemProperty) and delete the referenced file.

• Don't stop at Run — check the related RunOnce and RunOnceEx keys too. These are meant for one-time setup tasks that self-delete after running, but malware sometimes (ab)uses them the same way as Run for a slightly less obvious persistence spot:

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" -ErrorAction SilentlyContinue
Get-ItemProperty "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" -ErrorAction SilentlyContinue

• Typing shell:startup or shell:common startup directly into the File Explorer address bar jumps straight to the current user's or all-users' Startup folder — a faster GUI alternative to typing out the full AppData\Roaming\... path from Section 10's command-line method.

• If a Startup folder shortcut (.lnk file) looks legitimate by name but you want to confirm what it actually launches, check its Properties → Shortcut tab → Target field, or read it via PowerShell — a shortcut's displayed icon/name can be completely disconnected from what it really points to:

$sh = New-Object -ComObject WScript.Shell
$sh.CreateShortcut("C:\Users\Public\Desktop\SomeShortcut.lnk").TargetPath

• See Section 22 for deeper persistence hunting (Winlogon hijacks, IFEO debugger hijacks, AppInit_DLLs, WMI event subscriptions) that goes beyond what msconfig/Task Manager will ever show you.

Tip: If the scoring VM has no internet access, Windows Update literally cannot download anything — don't burn time repeatedly clicking "Check for updates." Confirm connectivity first (Test-NetConnection, or just try a browser) and move on to other sections if updates truly aren't reachable. Many CyberPatriot images intentionally have some updates missing that cannot be resolved without internet, and partial credit for "Automatic Updates enabled" as a setting is still worth doing regardless of whether updates can download.

Test-NetConnection -ComputerName 8.8.8.8 -InformationLevel Detailed

• Verify Windows Update the service is running/Automatic (see Section 9) — a disabled Windows Update service is sometimes the actual vulnerability being scored, independent of whether updates can download.

• Windows 10/11 also uses a separate Update Orchestrator Service (UsoSvc) alongside the classic Windows Update service — check both, since disabling just one can leave updates silently non-functional even though "Windows Update" itself shows as running:

Get-Service -Name wuauserv, UsoSvc | Select Name, DisplayName, Status, StartType

• If "Check for updates" in the Settings app seems stuck or unresponsive, UsoClient StartScan triggers the same scan from the command line and sometimes un-sticks a hung GUI check:

UsoClient StartScan

• A pending update that needs a reboot to finish applying can itself look like "updates aren't working" — check for a pending-reboot flag before assuming something's broken:

Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending"
Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired"

• Review Windows Update's own event log for install failures or blocked updates instead of guessing why an update didn't apply:

Get-WinEvent -LogName "Microsoft-Windows-WindowsUpdateClient/Operational" -MaxEvents 30 -ErrorAction SilentlyContinue |
    Select TimeCreated, Id, Message

Snapshot Checkpoint: Installing updates can trigger a reboot, and a reboot is exactly when an earlier broken change (bad service, bad UAC/RDP setting) surfaces as a hard lockout you can't easily fix while offline. Snapshot before you kick off updates or restart, so a bad reboot doesn't strand you.

• Control Panel → System and Security → Action Center → Change User Account Control settings.
• Move the slider to the top ("Always notify") and click OK (not just close the window — closing without OK discards the change).

Tip: EnableLUA = 0 (UAC fully off) is a very common planted vulnerability — always verify it's 1. A machine with UAC disabled will also silently let a lot of the "run as administrator" prompts you'd normally expect just not happen, which is itself a clue something's off if you notice it.

Tip: ConsentPromptBehaviorAdmin values: 0 = elevate without prompting (bad), 2 = prompt for consent on secure desktop (recommended default), 5 = prompt for consent for non-Windows binaries. Verify it isn't 0.

CIS Benchmark cross-reference: Every registry value set in this section maps 1:1 to a named CIS Microsoft Windows 10/11 Benchmark, Level 1 "User Account Control:" Security Option (Admin Approval Mode, elevation prompt behavior for admins/standard users, detect app installations, secure desktop prompting, virtualize file/registry writes) — see the full list already in Section 6's table.

• A closely related CIS Level 1 control worth checking alongside UAC: Windows Installer → "Always install with elevated privileges" should be Disabled. If it's Enabled (for both the Computer Configuration and User Configuration versions of the setting), any user — including a standard, non-admin account — can install an MSI package with full SYSTEM privileges, which is a direct and well-known privilege-escalation path that UAC alone won't stop.

# Check both halves of the "Always install with elevated privileges" setting (both must exist and be 0/absent to be safe)
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer" -Name "AlwaysInstallElevated" -ErrorAction SilentlyContinue
Get-ItemProperty "HKCU:\SOFTWARE\Policies\Microsoft\Windows\Installer" -Name "AlwaysInstallElevated" -ErrorAction SilentlyContinue

• There's a fifth, easy-to-miss UAC registry value: FilterAdministratorToken controls whether Admin Approval Mode applies to the built-in Administrator account specifically (separate from EnableLUA, which controls UAC for everyone else). If this is 0, the built-in Administrator account silently runs with full, un-prompted elevation even with UAC otherwise on:

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "FilterAdministratorToken" -Value 1 -Type DWord

• If the Control Panel slider feels unreliable or is missing on your build, secpol.msc → Local Policies → Security Options has the same UAC settings as named policies (see Section 6) — a more direct path if the Action Center GUI is being uncooperative.

• Verify all the values actually took, in one readable pass, rather than trusting that each Set-ItemProperty command silently succeeding means the setting is correct:

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" |
    Select EnableLUA, ConsentPromptBehaviorAdmin, PromptOnSecureDesktop, FilterAdministratorToken

net share

• For every share not required, delete it:

net share <sharename> /delete

• Shares ending in $ are hidden administrative/default shares — IPC$, C$, ADMIN$ are default Windows shares and IPC$ regenerates on reboot regardless. Only remove non-default, unauthorized shares unless the README explicitly says to strip default admin shares too (this can break some legitimate remote administration).

Get-SmbShare
Get-SmbShare | Where-Object { $_.Name -notlike "*$" }
Remove-SmbShare -Name "ShareName" -Force

• Also check share-level permissions on anything that must remain shared — make sure Everyone: Full Control isn't set on a share that should be restricted:

Get-SmbShareAccess -Name "ShareName"

Tip: shrpubw (Share a Folder Wizard) is a fast GUI alternative for creating a properly permissioned share if the README requires you to create one for a specific business reason — don't just use "Everyone/Full Control" defaults.

• Harden SMB itself, not just individual shares:

Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force

SMBv1 is obsolete and vulnerable (EternalBlue/WannaCry-class exploits) — disabling it is safe on essentially every modern image and is a strong, low-risk point-scoring action.

• Another CIS Level 1 SMB control worth setting alongside SMB1 removal: LanmanWorkstation → "Enable insecure guest logons" should be Disabled. When enabled, this setting lets the SMB client silently fall back to unauthenticated guest access against a remote share instead of failing — a subtle vulnerability that has nothing to do with your own shares, but with how this machine connects to others.

Set-SmbClientConfiguration -EnableInsecureGuestLogons $false -Force

Snapshot Checkpoint: The next section disables Remote Desktop and Remote Assistance. If you are currently connected to this machine over RDP rather than sitting at its console, disabling RDP here can disconnect you and lock you out of your own session. Confirm you have local/console access (or another authorized admin who does) before proceeding, and take a snapshot first regardless — this is one of the easiest ways to accidentally strand your own team mid-round.

• Right-click This PC/My Computer → Properties → Remote settings (or Advanced System Settings → Remote tab).
• Uncheck Allow Remote Assistance connections to this computer.
• Set Remote Desktop to Don't allow connections to this computer — unless the README explicitly requires RDP access for a stated user/reason, in which case use the most restrictive allowed option (e.g., "Allow connections only from computers running Remote Desktop with Network Level Authentication").
• Apply, OK.

CIS Benchmark cross-reference: The full Remote Desktop Services Administrative Templates block in Section 24's appendix (Do not allow drive/COM port/LPT port/smart card redirection, Always prompt for a password, Require secure RPC communication, Require user authentication with NLA, Set client connection encryption level: High) is drawn directly from CIS Microsoft Windows 10/11 Benchmark, Level 1 RDS guidance — if RDP is required by your scenario, that block is the fastest way to harden it without disabling it outright.

Tip: If RDP is required by the README, verify who's allowed in via the Remote Desktop Users group (see Section 3) — an unauthorized member there is a classic vulnerability even when RDP itself is legitimately needed.

• Check for third-party remote access tools too (TeamViewer, AnyDesk, VNC, LogMeIn, Chrome Remote Desktop) — these bypass Windows' own RDP controls entirely and are common "unauthorized remote access" plants. Uninstall unless authorized.

Get-Process | Where-Object { $_.ProcessName -match "teamviewer|anydesk|vnc|logmein" }
Get-Service | Where-Object { $_.DisplayName -match "TeamViewer|VNC|AnyDesk" }

• Control Panel → view by Small Icons → System → Advanced system settings → Performance section → Settings → Data Execution Prevention tab.
• Select Turn on DEP for all programs and services except those I select, and leave the exceptions list empty unless a required program genuinely needs an exception (rare, and should be justified by the README).

Tip: Set-ProcessMitigation -System changes are broad and generally low-risk on a client workstation, making this a good "extra credit" action once the core checklist is done — but always test that required line-of-business software still launches afterward, especially older/legacy applications the README might call out.

Tip: RunAsPPL (LSA Protection) requires a reboot to take effect, and on older builds/some drivers can cause compatibility issues — apply it, but budget time to verify the box still boots and logs in cleanly afterward before moving on.

Tip: WDigest, Safe DLL Search Mode, and Early Launch Antimalware policy are all CIS Level 1 controls that are easy to miss because they don't show up in a typical GUI walkthrough — they're registry-only settings. All three are low-risk to apply (no reboot required for the first two; Early Launch Antimalware policy takes effect on next boot).

• Open IE → Tools → Internet Options.
• General tab: set homepage to a neutral page (e.g., about:blank or a scenario-approved page — don't assume google.com is always correct if the README specifies something else).
• General → Browsing History → Settings: choose Never on the "Check for newer versions of stored pages" option, and enable Delete browsing history on exit.
• Security tab: raise the security level for each zone toward High.
• Privacy tab: raise to Block All Cookies (or the strictest level that doesn't break required functionality).
• Content tab: clear SSL state.
• Content → AutoComplete Settings: uncheck all boxes, then clear AutoComplete history and check Manage Passwords is empty.
• Apply, OK. Repeat similarly (best effort, exact steps vary) for any other installed browser (Chrome, Firefox, Edge).

• Prefer setting browser security via Group Policy ADMX templates / registry policy keys so settings can't be casually changed back through the UI, rather than only clicking through in-browser settings.

# Example: disable Firefox's built-in password manager via policy
New-Item -Path "HKLM:\SOFTWARE\Policies\Mozilla\Firefox" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Mozilla\Firefox" -Name "OfferToSaveLogins" -Value 0 -Type DWord

Tip: Saved credentials/autofill data in any browser is a common scored item — check Settings → Passwords (Chrome/Edge) and about:logins (Firefox) and clear anything that shouldn't be stored, especially on a shared/kiosk-style scenario machine.

• Clear Windows' own saved credentials (Control Panel → User Accounts → Manage your credentials) — remove everything under both Windows Credentials and Web Credentials unless the README says a saved credential is required.

cmdkey /list
cmdkey /delete:<TargetName>

Tip: Set each browser to auto-update if internet access allows — outdated browser versions are a common "missing updates" style vulnerability distinct from Windows Update itself.

Tip: "Require a password on wakeup" is a simple, high-confidence checkbox-style item — quick and reliable points, do it early.

Tip: Before deleting any flagged file, double check it isn't referenced by a forensics question ("what is the name of the largest media file on this system?") — screenshot/record first, delete second.

Tip: Renamed file extensions are a known trick (virus.exe renamed to virus.jpg.exe or virus.txt) — when in doubt, check actual file type/magic bytes rather than trusting the extension:

Get-Item "C:\path\to\suspicious.jpg" | Select Name, Extension, Length
# Or open in a hex-capable tool / check file signature bytes manually if truly suspicious

• Disable Autorun/AutoPlay globally — a classic vector for "prohibited/malicious content auto-launching from removable media":

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun" -Value 255 -Type DWord
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Name "NoAutoplayfornonVolume" -Value 1 -Type DWord

• Control Panel → Programs and Features → Turn Windows features on or off (or optionalfeatures.exe directly).
• Disable (unless required by README):
  • Games
  • Internet Information Services (IIS) and IIS Hostable Web Core
  • Media Features (if scenario disallows media playback)
  • Print and Document Services (unless printing required)
  • SNMP
  • Telnet Client / Telnet Server
  • TFTP Client
  • XPS Services / XPS Viewer
• Be careful with Windows PowerShell — the historical source checklist lists it as something to disable, but doing so removes your own ability to run most commands in this document. Only disable PowerShell if the README explicitly requires it and you're finished using it, or use PowerShell 2.0-engine-removal-style hardening (removing the legacy v2 engine, Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2) instead of removing PowerShell entirely.

Tip: If World Wide Web Publishing Service shows up running (see Services), that means IIS is installed — treat it the same as any other unauthorized server role on a client workstation and disable the feature entirely unless the README specifically calls for a web server role.

Tip: Removable-media/USB storage can be blocked entirely at the driver level if the scenario calls for locking down physical data-exfiltration vectors:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\USBSTOR" -Name "Start" -Value 4 -Type DWord

Value 4 disables the USB mass-storage driver from starting; 3 restores default (manual start, i.e. normal USB drive functionality). Don't apply this if the competition needs you to transfer files via USB.

• Open taskschd.msc (Task Scheduler).
• Browse the Task Scheduler Library, expanding all folders (don't just check the root).
• Review every non-Microsoft task, and any Microsoft-path task that looks off (unexpected trigger, unexpected action/binary). Disable or delete unauthorized tasks.

Tip: Malicious scheduled tasks are one of the most common persistence mechanisms used in vulnerable CyberPatriot images — always check the task's Actions tab for what program/script it actually runs, not just its name (a task can be named "Adobe Update Check" and run something else entirely).

Get-ScheduledTask -TaskName "SuspiciousTaskName" | Select -ExpandProperty Actions

• To disable a confirmed-bad task without breaking a required trigger pattern you might want to reference later, disable it rather than deleting outright (mirrors the "disable, don't delete" philosophy from account management):

Disable-ScheduledTask -TaskName "SuspiciousTaskName" -TaskPath "\"

A famous technique: redirect the debugger for an accessibility tool (sethc.exe, utilman.exe, osk.exe, magnify.exe, narrator.exe, displayswitch.exe) to cmd.exe, giving SYSTEM-level shell access from the logon screen.

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*" -ErrorAction SilentlyContinue |
    Select-Object PSChildName, Debugger

• If any Debugger value points to cmd.exe, powershell.exe, or anything other than the tool's own expected behavior, delete that Debugger value/key immediately. Expected result: Remove-ItemProperty -Path "HKLM:\SOFTWARE\...\Image File Execution Options\sethc.exe" -Name "Debugger" (or delete the whole subkey with Remove-Item) — silent on success. If it fails: "Access is denied" without elevation. After removal, test by pressing Shift 5 times at the logon screen (not while logged in) to confirm Sticky Keys launches normally instead of a command prompt.

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" | Select-Object Shell, Userinit

• Expected defaults: Shell = explorer.exe, Userinit = C:\Windows\system32\userinit.exe, (note the trailing comma is normal). Anything else appended or substituted is a persistence/hijack indicator — restore the defaults.

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" -Name "AppInit_DLLs" -ErrorAction SilentlyContinue
Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Session Manager\AppCertDlls" -ErrorAction SilentlyContinue

• These should normally be empty/absent. If populated with an unfamiliar DLL path, that DLL is being force-loaded into every process (or every process calling CreateProcess, for AppCertDlls) — investigate and clear it:

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" -Name "LoadAppInit_DLLs" -Value 0 -Type DWord
Set-ItemProperty -Path "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows" -Name "LoadAppInit_DLLs" -Value 0 -Type DWord

A recurring, low-tech CyberPatriot technique: the scenario (or a "malicious insider") disables Task Manager, cmd.exe, or Control Panel for the current user via raw registry policy keys — without a corresponding Group Policy Object, so it won't show up when you check gpresult. This matters because a locked Task Manager or cmd.exe is usually hiding a bigger problem: if you can't open Task Manager, you can't see the malicious process; if cmd.exe is blocked, some of your own remediation commands may silently fail.

# 1. Check the three classic "lock the admin out of their own tools" keys
Get-ItemProperty "HKCU:\Software\Policies\Microsoft\Windows\System" -Name "DisableCMD" -ErrorAction SilentlyContinue
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "DisableTaskMgr" -ErrorAction SilentlyContinue
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoControlPanel" -ErrorAction SilentlyContinue

• If any of these keys exist and are set to 1 (or 2 for DisableCMD, which also blocks .bat/.cmd scripts), that tool has been deliberately sabotaged for the current user. Remove or zero them out:

# 2. Remove/zero each one that was found set
Remove-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\System" -Name "DisableCMD" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "DisableTaskMgr" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoControlPanel" -ErrorAction SilentlyContinue

• These are per-user (HKCU) keys, so if there are multiple user profiles on the box, repeat the check for each one by loading their hive (reg load) or checking HKEY_USERS\<SID>\... instead of just your own logged-in profile's HKCU.

Get-CimInstance -Namespace root\subscription -ClassName __EventConsumer
Get-CimInstance -Namespace root\subscription -ClassName __EventFilter
Get-CimInstance -Namespace root\subscription -ClassName __FilterToConsumerBinding

• These allow malware to execute on a trigger (e.g., "every time a process named X starts") without any file or Run-key ever appearing — this is an advanced technique but worth a quick look on a harder image or if a forensics question hints at "no obvious startup entry found."

Tip: This class of persistence (IFEO, Winlogon, AppInit_DLLs, WMI subscriptions) is rare in beginner-level CyberPatriot images but shows up more in advanced/high-scoring rounds. If your team has already done the "obvious" checklist items and the score seems capped, this section is where to look next.

Tip: Environment variables can also be abused for persistence/injection — a quick sanity check:

Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"

• Reset system folder permissions if you suspect a rootkit modified ACLs on core Windows directories (use cautiously — this is a broad, slow operation):

icacls "C:\Windows\System32" /reset /T /C /Q

• Open eventvwr.msc.
• Review Windows Logs → Security for logon failures (Event ID 4625), new user creation (4720), account enabled/disabled (4722/4725), group membership changes (4728/4732/4756), and any other anomalies relevant to forensics questions.
• Review Windows Logs → System and Application for service failures, driver issues, or crash patterns.
• Increase log size / set retention so logs aren't silently overwritten before you can review them (Properties on each log → increase Maximum log size, set "Overwrite events as needed" or "Archive the log when full").

Set-ExecutionPolicy -ExecutionPolicy Restricted -Scope LocalMachine -Force

New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1 -Type DWord

Caution: Setting the PowerShell execution policy to Restricted will block your own future .ps1 scripts from running (though inline commands typed directly into the console still work). If you plan to keep using PowerShell scripts during the round, use RemoteSigned instead, or apply Restricted only as your very last step before moving on.

Tip: Never clear the event logs to "clean things up" — that destroys forensic evidence you may still need for scoring questions, and log-tampering itself is sometimes a scored/penalized action.

Tip: wevtutil qe Security /c:1 /rd:true /f:text (or the Get-WinEvent equivalents above) let you pull specific recent entries fast without opening the heavier Event Viewer GUI — useful under time pressure.

CIS Benchmark cross-reference: CIS Level 1 recommends sizing the four core Event Logs well beyond Windows' small defaults — commonly cited figures are roughly 32,768 KB or larger for the Application, Setup, and System logs, and a much larger 196,608 KB or larger for the Security log specifically (it fills up fastest once full auditing is on). If you're not certain of the exact current CIS figure, erring generously large is safe and low-risk — the goal is simply "don't silently lose evidence to log rotation."

Based on general CyberPatriot community experience, these categories come up often enough to prioritize within the huge Administrative Templates tree. Many of them are also explicit CIS Microsoft Windows 10/11 Benchmark, Level 1 controls, noted below where that's the case — Level 1 means "broad-compatibility hardening," generally safe to apply on a competition image without breaking required functionality.

Treat this curated table as a starting point, not an exhaustive guarantee — CyberPatriot does not publish an official scoring rubric, so "commonly tested" here is drawn from general community experience with these categories historically appearing across many practice/competition images, not a promise about any specific round. The CIS Level 1 annotations are based on well-established, widely-cited CIS Windows Benchmark categories; exact setting names/paths can shift slightly between Windows 10 and 11 builds, so verify the live control in gpedit.msc matches the description if it looks off.

CIS Level 2 controls are stricter than Level 1 and are meant for higher-security environments — they carry more risk of breaking legitimate functionality (remote administration tooling, cross-device features, peripherals), so apply them only after the rest of this document is done and you've confirmed they don't conflict with anything the README requires.

These are genuinely optional "extra credit" — a CyberPatriot image can score well without any of them, and a few (Clipboard sync, RPC restrictions) have real potential to interfere with a scenario that expects those features to work. Test after applying, don't just set-and-forget.

The table below is preserved from the original "Ultimate Windows Checklist" GPO reference for completeness. It is organized by the same category structure as gpedit.msc. Treat "Not configured" values as leave alone / lowest priority — they represent the source checklist's judgment that the setting didn't need to deviate from default. This is the exhaustive appendix; work through the rest of this document first, then use this if you have time remaining and want to squeeze out additional hardening.

Control Panel

Network — BITS

Network — Branch Cache

Network — DNS Client

Network — Lanman Server / Link-Layer Topology Discovery / Peer-to-Peer

Network — Network Connections (Windows Firewall legacy policy)

Network — Offline Files

Network — SNMP / SSL / TCP-IP / Windows Connect Now

Network — Printers

System — Credentials Delegation

System — Device Installation

System — Disk NV Cache / Disk Quotas

System — Distributed COM / Driver Installation / Enhanced Storage

System — File System / Group Policy Processing

System — Internet Communication Management

System — iSCSI / Kerberos / Locale Services

System — Logon / Power Management

System — Remote Assistance / RPC / Removable Storage / Scripts

System — Troubleshooting, User Profiles, Windows File Protection

Windows Components — AutoPlay, Backup, Biometrics

Windows Components — BitLocker Drive Encryption

Windows Components — Credential UI, Desktop Gadgets, DWM

Windows Components — Event Log Service

Windows Components — Game Explorer / HomeGroup

Windows Components — Internet Explorer (selected high-value entries)

Windows Components — Location and Sensors, NetMeeting, Parental Controls

Windows Components — Remote Desktop Services (full block)

Windows Components — RSS Feeds, Search, Security Center

Windows Components — Sound Recorder, Tablet PC, Task Scheduler

Windows Components — Windows Calendar, Color System, Customer Experience

Windows Components — Windows Defender

Windows Components — Windows Error Reporting

Windows Components — Windows Explorer, Installer, Logon Options

Windows Components — Windows Media, Messenger, Mobility Center, Remote Management

Windows Components — Windows SideShow, System Resource Manager, Windows Update

This appendix intentionally preserves the source document's structure and values for reference completeness. Some entries reflect Windows 7/Server 2008-era terminology (e.g., specific Windows Media Center or Tablet PC options) that may not exist on Windows 10/11 images — skip anything not present on your target OS rather than trying to force it.

Tip: gpresult /h C:\gpreport.html generates a full HTML report of currently applied Group Policy settings — a fast way to sanity-check what's actually in effect after you make changes, and a good source for answering forensics questions about current policy state.

gpresult /h C:\gpreport.html
gpupdate /force

Tip: On Windows Home editions without gpedit.msc, many of the same registry-backed policies can still be set directly via Set-ItemProperty under HKLM:\SOFTWARE\Policies\... and HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\... — the GPO editor is just a GUI for registry values in most cases. Search for the specific policy name plus "registry key" if you need the exact path and are on a Home SKU.

Tip: If you want an authoritative source to cross-check this whole section against (rather than just this document), look up the free CIS Microsoft Windows 10/11 Benchmark, published by the Center for Internet Security. It's organized in the same Level 1/Level 2 structure referenced throughout this section, is free to download after a quick registration, and is a legitimate, citable standard if a mentor, judge, or teammate asks "where did this setting come from?"