CyberPatriot Field Guide
Speed Reference

windowsClient Windows Client Speed Reference

Condensed, no-explanation command sheet for when the clock is running.

0 / 0 checked

No explanations here — this assumes you've already read the Master Checklist or Beginner Guide once. Pure recall/scan sheet for live-round speed. secpol.msc = Local Security Policy, lusrmgr.msc = Local Users/Groups, services.msc = Services, gpedit.msc = Group Policy Editor.

0. Before Anything#

  • Snapshot the VM. Read README. Answer forensics questions. Note required users/software.

1. Accounts (lusrmgr.msc / PowerShell)#

powershell
Get-LocalUser | Select Name,Enabled,PasswordRequired,PasswordLastSet
Get-LocalGroupMember Administrators
Get-LocalGroupMember "Remote Desktop Users"
net user Guest /active:no
wmic useraccount where name='Administrator' call rename name='<newname>'
  • Guest disabled · unrenamed default Admin left alone (only rename if you're not on it) · unauthorized admins removed from group (not deleted from system) · unknown accounts disabled, not deleted.

2. Password / Lockout Policy (secpol.msc → Account Policies)#

Setting Value
Enforce Password History 24
Max Password Age 30–90 days
Min Password Length 8–14
Password Complexity Enabled
Lockout Duration 15–30 min
Lockout Threshold 3–5 attempts
Reset Lockout Counter 15 min
shell
net accounts                                          # quick check
secedit /export /cfg C:\secpol.cfg                     # scripted edit path
secedit /configure /db C:\Windows\security\local.sdb /cfg C:\secpol.cfg /areas SECURITYPOLICY

3. Firewall (wf.msc)#

  • All 3 profiles (Domain/Private/Public): On, inbound Block, outbound Allow, logging On with real size limit.
cmd
netsh advfirewall set allprofiles state on
netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound

4. Backdoor / Sabotage Checks (the ones people forget)#

powershell
# Sticky Keys / IFEO hijack
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*" | Select PSChildName,Debugger

# Registry admin-tool sabotage
Get-ItemProperty "HKCU:\Software\Policies\Microsoft\Windows\System" -Name DisableCMD -EA SilentlyContinue
Get-ItemProperty "HKCU:\...\Policies\System" -Name DisableTaskMgr -EA SilentlyContinue
Get-ItemProperty "HKCU:\...\Policies\Explorer" -Name NoControlPanel -EA SilentlyContinue

# Defender exclusions abuse
Get-MpPreference | Select ExclusionPath,ExclusionExtension,ExclusionProcess

# Hidden accounts
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList"

# Suspicious scheduled tasks
schtasks /query /v /fo list
Get-ScheduledTask | ? {$_.State -ne "Disabled" -and $_.TaskPath -notlike "\Microsoft*"}

# Startup keys
Get-ItemProperty HKLM:\...\Run*, HKCU:\...\Run*

# Winlogon hijack (expect Shell=explorer.exe, Userinit=...userinit.exe,)
Get-ItemProperty "HKLM:\...\Winlogon" | Select Shell,Userinit

# Spoofed services
Get-CimInstance Win32_Service | Select Name,DisplayName,PathName,StartName
  • Verify after: gpresult /z > C:\gpresult_after.txt

5. Services / Ports#

powershell
netstat -ano
Get-Service | ? {$_.Status -eq "Running"}
  • Disable: Telnet, Remote Registry, RIP Listener, SNMP Trap, Simple File Sharing, unneeded IIS/FTP/TFTP.
  • Every listening PID cross-referenced against Task Manager Details tab + signature.

6. Malware / Prohibited Files#

powershell
Get-ChildItem C:\Users,C:\ProgramData,C:\Windows\Temp -Recurse -Include *.mp3,*.mp4,*.avi,*.exe,*.bat,*.vbs,*.ps1 -EA SilentlyContinue
  • Uninstall everything except required software (check README first). Registry Uninstall key for hidden entries.

7. Other Quick Hits#

  • UAC slider maxed. RDP off / NLA on if required. Unauthorized shares removed (Get-SmbShare). Saved credentials cleared. AutoPlay/Autorun off. DEP on for all programs. Windows Update installed + automatic. SMBv1 disabled. Anonymous SAM enumeration disabled.
  • sfc /scannow + DISM /Online /Cleanup-Image /RestoreHealth if system files suspect.

8. Final Pass#

  • Snapshot again. Re-check README requirements weren't broken. Re-answer forensics questions with final state noted.