windowsClient Windows Client Beginner Guide

Windows is a multi-user operating system, and unauthorized user accounts (accounts nobody on your team recognizes, or old test/guest accounts) are one of the most common vulnerabilities in a CyberPatriot image. An account with no password, or an account with more access than it needs (like being an Administrator when it shouldn't be), is an easy way for an attacker to get into a system.

• Open the Start menu, type lusrmgr.msc, and press Enter. (If that doesn't open — some Windows Home editions don't have it — type mmc, then go to File → Add/Remove Snap-in and add Local Users and Groups.)
• Click on Users. You'll see a list of every account on the computer.
• Compare this list against what the README said should exist.
  • For any account that shouldn't be there: right-click it → Properties → check the Account is disabled box. Click OK. Do not delete it — just disable it.
  • Find the Guest account specifically and make sure it's disabled the same way. Guest accounts are almost never supposed to be enabled.
  • For every account that should remain, right-click → Set Password and give it a strong password (mix of upper/lowercase letters, numbers, and symbols, at least 8-14 characters).
• Click on Groups, then double-click Administrators. This shows every account that has full control over the computer.
  • Remove (double-click Administrators → select the account → Remove) anyone who is in this group but shouldn't be, according to the README. This does not delete their account — it just takes away their admin powers.

Why "disable, don't delete" matters so much here: if you delete a required account by mistake, you usually cannot get it back the same way — a newly re-created account has a different internal ID, so any of its old file permissions and settings are gone. Disabling is instantly reversible.

If you're comfortable with the Command Prompt, this shows the same information faster:

net user
net localgroup administrators

Even with the right accounts, a weak password policy (like allowing 1-character passwords, or never locking an account out after failed login attempts) makes it easy for someone to guess their way in. CyberPatriot almost always checks this.

• Open the Start menu, type secpol.msc, and press Enter. (This is the Local Security Policy tool.)
• In the left pane, go to Account Policies → Password Policy. Set:
  • Minimum password length: 8-14 characters (higher is safer)
  • Password must meet complexity requirements: Enabled
  • Maximum password age: 30 days (not 0/"never")
  • Enforce password history: a number like 10-24 (this stops people from reusing the same old password)
• Go to Account Policies → Account Lockout Policy. Set:
  • Account lockout threshold: 3-5 invalid attempts (this is how many wrong passwords are allowed before the account locks)
  • Account lockout duration and Reset account lockout counter after: 15-30 minutes

Follow the README's exact numbers if it gives any — this section is just reasonable defaults, not an official rule.

Why this matters (in one sentence): a strong password policy makes password-guessing attacks impractical, which is exactly the kind of "vulnerability" CyberPatriot's scoring engine looks for.

The firewall controls what network traffic is allowed in and out of the computer. If it's off, or set to allow all incoming connections, the computer is much easier to attack over the network.

• Open the Start menu, type wf.msc, and press Enter. (This opens Windows Firewall with Advanced Security.)
• Click Windows Firewall Properties on the main page.
• You'll see three tabs: Domain Profile, Private Profile, and Public Profile. For each one:
  • Make sure Firewall state is On.
  • Make sure Inbound connections is set to Block (this is usually already the default).
• Click OK.
• While you're in this tool, click Inbound Rules on the left. Skim the list for anything named Telnet, netcat, or similar — if you see one enabled, right-click it and choose Disable Rule.

Why this matters: a firewall that's off is one of the most obvious, commonly-scored vulnerabilities — it's also one of the fastest fixes, so always double check it's genuinely on (not just "looks on") before moving on.

A "service" is a background program Windows runs automatically, often without any visible window. Some services (like ones for remote access or old, insecure protocols) create security holes if they're left running without a real reason. You don't need to memorize every service — just learn to recognize and disable a handful of classic risky ones.

• Open the Start menu, type services.msc, and press Enter.
• Find each of these, right-click → Properties, and change Startup type to Disabled (click Stop first if it's currently running), unless the README specifically says you need it:
  • Remote Registry — lets someone edit this computer's registry from a different computer over the network.
  • Telnet — an old, insecure way to remotely control a computer (passwords aren't even encrypted).
  • Remote Desktop Services / Remote Desktop Configuration — covered in more detail in Step 8, but if RDP isn't required, these can be disabled too.
  • SNMP Trap — an old network-monitoring protocol rarely needed on a workstation.
• Do not disable these — they're required for Windows to work properly: Windows Firewall, Windows Defender / Microsoft Defender Antivirus, Windows Event Log, Windows Update, Remote Procedure Call (RPC), DHCP Client, DNS Client, Windows Management Instrumentation.

Why this matters: a service like Remote Registry or Telnet running "just because it's default" is exactly the kind of forgotten door into a system that CyberPatriot images test for. But turning off a required service (like RPC or the Firewall service) can break the whole system — this is why the "don't touch" list above matters just as much as the "disable" list.

If a service you don't recognize is running: don't panic and don't guess. Right-click → Properties and look at the description and the file path it runs from. If it's unfamiliar and doesn't match anything the README mentions, it's worth researching (or asking a teammate/mentor) before deciding what to do with it.

CyberPatriot images are often deliberately set up with games, hacking tools, pirated software, or media files that shouldn't be there, plus sometimes actual malware. Finding and removing these is a core part of scoring.

• Open Control Panel → Programs → Uninstall a Program. Go through the list.
  • Uninstall anything that's clearly not needed: games, torrent/file-sharing programs (uTorrent, BitTorrent, etc.), "hacking tools" (Wireshark, nmap, Metasploit, Cain and Abel, netcat/nc/ncat, keyloggers, password crackers), and remote-access tools that aren't authorized (TeamViewer, AnyDesk, etc. unless the README allows them).
  • Do not uninstall anything the README lists as required, or common dependencies like "Microsoft Visual C++ Redistributable" or ".NET Framework" — other programs need these to run.
• Open File Explorer and browse through the Users folders (each user's Desktop, Documents, Downloads, Music, Videos, Pictures) looking for files that shouldn't be there — music files (.mp3), videos (.mp4/.avi), pirated-software-looking files, or anything obviously out of place.
  • Delete anything you're confident is prohibited — but if a forensics question might be asking about a specific file, write down its name/location first.

Why this matters: an image scored by CyberPatriot is intentionally seeded with "shouldn't be here" items — the scoring engine checks whether you found and removed them, the same way a real system administrator would clean up a compromised or misused computer.

There's a famous, easy-to-check hidden backdoor technique called the "Sticky Keys" (or accessibility) hijack. Normally, pressing Shift five times at the Windows login screen launches an accessibility tool called Sticky Keys. Attackers sometimes secretly reconfigure that shortcut to open a full Command Prompt instead — which would give anyone standing at the login screen full control of the computer, without even logging in.

• Press Windows key + R, type regedit, press Enter (say Yes if prompted).
• Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe
• If that key exists and has a value called Debugger pointing to cmd.exe (or anything other than nothing at all), that's the backdoor. Right-click the sethc.exe folder in the left pane and delete it.
• While you're there, it's worth glancing at the folder right above it (Image File Execution Options) for any other unfamiliar program names with a Debugger value set — same trick, different accessibility tool (utilman.exe, osk.exe, magnify.exe).

Why this one specifically: it's iconic in the CyberPatriot community, extremely easy to check once you know where to look, and represents a full bypass of the login screen — a big deal for a small amount of effort.

Software with known, unpatched security bugs is an easy target. Keeping Windows updated closes those holes.

• Open Control Panel → System and Security → Windows Update.
• Click Change settings, and set it to Install updates automatically.
• Click Check for updates, and install everything available — only if you have internet access (see note below).

Important note: many competition rounds run with no internet access once scoring starts. If "Check for updates" just spins or fails, that's expected — don't waste a lot of time on it. Setting Automatic Updates to "on" as a setting is still worth doing even if nothing can actually download.

UAC is the pop-up that asks "Do you want to allow this app to make changes to your device?" It exists so that a program (including malware) can't silently gain full control of the computer without you noticing and approving it. If it's turned off, that protection disappears.

• Open Control Panel → System and Security → Security and Maintenance → Change User Account Control settings. (Or just search "Change User Account Control settings" from the Start menu.)
• Drag the slider all the way to the top ("Always notify").
• Click OK — clicking the X to close the window instead will discard the change without saving it.

Why this matters: UAC being turned all the way down (or off) is a very common thing to check for, and it's a 10-second fix once you know where it lives.

Remote Desktop (RDP) lets someone log into this computer from a different computer over the network. If it's turned on without a good reason, it's another way in for an attacker — especially if combined with a weak password.

Snapshot Checkpoint — read this before you continue: if you are currently connected to this computer through Remote Desktop (instead of sitting at it directly), turning RDP off in the next step will disconnect you and can lock you out of the session you're using right now. Make sure you (or a teammate) have direct/console access to the machine, and make sure you have a recent snapshot, before changing this setting.

• Right-click This PC (or My Computer) → Properties → Remote settings (on the left, or under "Advanced system settings").
• Under the Remote tab, uncheck Allow Remote Assistance connections to this computer.
• Set Remote Desktop to Don't allow connections to this computer — unless the README specifically says Remote Desktop access is required, in which case leave it enabled but choose the more restrictive "Allow connections only from computers running Remote Desktop with Network Level Authentication" option.
• Click Apply, then OK.

Why this matters: just like the accounts and passwords steps, this is about closing an unnecessary "front door" into the system — but unlike those steps, it's one where you can accidentally lock yourself out, which is why the snapshot warning above matters.

A "share" is a folder that's been made accessible to other computers on the network. An unauthorized or overly-open share can let anyone on the network read (or even change) files they shouldn't have access to.

• Open a Command Prompt (Start menu → type cmd → Enter).
• Type:

net share

• This lists every shared folder on the computer. IPC$, C$, and ADMIN$ are default Windows shares (they end in $) and are usually fine to leave alone unless the README says otherwise. For anything else in the list that isn't required, remove it:

net share <sharename> /delete

Why this matters: unauthorized shares are an easy, sometimes-overlooked way for data to leak across a network — and they're quick to check and fix once you know the command.