CyberPatriot Field Guide
Speed Reference

windowsServer Windows Server Speed Reference

Condensed, no-explanation command sheet for when the clock is running.

0 / 0 checked

Recall/scan sheet only — read the Master Checklist or Beginner Guide first. dsa.msc = AD Users & Computers, gpmc.msc = Group Policy Management, dnsmgmt.msc = DNS, dhcpmgmt.msc = DHCP, inetmgr = IIS.

0. Before Anything#

  • Snapshot. Read README. Get-WindowsFeature | ? Installed — identify every role BEFORE touching services. Answer forensics questions first.

1. Roles & Features#

powershell
Get-WindowsFeature | Where-Object Installed
  • Remove roles not required by README (Remove-WindowsFeature) — but never guess; check the README twice before removing a role.

2. Local Admins & Golden Rule#

  • Get-LocalGroupMember Administrators — local admins, separate from Domain Admins.
  • On a Domain Controller, secpol.msc is mostly inert. Use gpmc.msc → Default Domain Policy (and Default Domain Controllers Policy) instead.

3. AD Users & Groups (dsa.msc)#

powershell
Get-ADUser -Filter * -Properties * | Select Name,Enabled,PasswordNeverExpires
Get-ADGroupMember -Identity "Domain Admins" -Recursive | Select Name,SamAccountName   # -Recursive catches nested-group sneak-ins!
Get-ADGroupMember -Identity "Enterprise Admins" -Recursive
Get-ADUser -Filter {PasswordNeverExpires -eq $true}
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true}          # AS-REP roasting targets
  • Audit: Administrators, Domain Admins, Enterprise Admins, Schema Admins, Account Operators, Backup Operators, Server Operators. Disable unauthorized accounts, don't delete. Don't touch krbtgt beyond checking group membership.

4. Domain Password/Lockout Policy (gpmc.msc → Default Domain Policy)#

Setting Value
Min password length 14
Complexity Enabled
Password history 24
Lockout threshold 5
Lockout duration 30 min
powershell
Set-ADDefaultDomainPasswordPolicy -MinPasswordLength 14 -ComplexityEnabled $true -PasswordHistoryCount 24 -LockoutThreshold 5 -LockoutDuration (New-TimeSpan -Minutes 30)

5. Kerberos / LDAP#

powershell
Set-ItemProperty "HKLM:\...\Kerberos\Parameters" -Name SupportedEncryptionTypes -Value 24 -Type DWord   # AES only
  • LDAP server signing: secpol.msc/gpmc.msc → Security Options → Domain controller: LDAP server signing requirements → Require signing

6. DNS (dnsmgmt.msc)#

  • Zone Transfers: restrict to named servers only, never "to any server." Dynamic updates: Secure only. Root hints intact (a-m.root-servers.net). Forwarders empty unless required.

7. DHCP (dhcpmgmt.msc)#

  • Authorized servers only (Get-DhcpServerInDC). Scope gateway/DNS options correct — a single wrong octet is a common miss.

8. Firewall / Services / Updates — same as Windows Client speed sheet, applies here too.#

9. Backdoor / Sabotage Checks (same techniques, server is a higher-value target)#

powershell
Get-ItemProperty "HKCU:\Software\Policies\Microsoft\Windows\System" -Name DisableCMD -EA SilentlyContinue
Get-ItemProperty "HKCU:\...\Policies\System" -Name DisableTaskMgr -EA SilentlyContinue
Get-MpPreference | Select ExclusionPath,ExclusionExtension,ExclusionProcess
schtasks /query /v /fo list
Get-CimInstance Win32_Service | Select Name,DisplayName,PathName,StartName
gpresult /z > C:\gpresult_after.txt
  • Print Spooler disabled on DCs (PrintNightmare) unless required.

10. IIS (if Web role present)#

  • Browse the site in host browser first. Check C:\inetpub\wwwroot for anything beyond default files + remove sample/example content. Anonymous Auth disabled unless required. TRACE/TRACK verbs denied. Legacy TLS/SSL disabled.

11. Final Pass#

  • Snapshot again. Confirm required roles/services still running. gpresult /z clean. Re-answer forensics questions.