Course 9:Implementing PowerShell Security Best Practice 2019

Engage in hands-on labs to master Windows PowerShell security best practices and defend against threats, exploring editions, cross-platform PowerShell Core, and security overview.

Explore the PowerShell architecture, including the runtime engine, the shell inside a hosting application, spaces, commands, modules, providers, and workflows, to improve secure script execution.

Explore PowerShell version history from 1 through 6 and beyond, and learn security enhancements, Windows PowerShell versus PowerShell Core, open source PowerShell code, and cross-platform implications.

Compare full clr and core clr in PowerShell, show module availability and AD cmdlets, and demonstrate an RSAT script update for installing and managing features across Windows versions.

Learn to run Windows PowerShell modules in PowerShell Core using CDXML, PSCoreWindowCompact, and PSModulePath, with the Windows compatibility pack and notes on Active Directory.

Explore PowerShell syntax and parameters for Windows PowerShell and PowerShell core, including command, script, encoded command, execution policy, and deployment considerations across Windows, Linux, and macOS.

Explore how PowerShell profiles customize and persist a session by loading functions and variables, with six profile types and precedence, including domain and personal profiles, governed by the execution policy.

Install PowerShell Core 6 on Windows and Linux, including CentOS, using the command line, and explore its use for penetration testing and cross‑platform administration.

Install PowerShell core on Windows and set up package management by upgrading PowerShellGet and the Nugget provider. Remove and reinstall modules to ensure compatible versions for future updates.

Learn how to install PowerShell core on Red Hat based Linux distributions, download the package, install via sudo, and verify the PowerShell version and basic commands.

Learn how to install PowerShell core on Debian-based linux distributions using three installation methods: direct download, package repository installation, and portable binaries, including handling dependencies and repository setup.

Install PowerShell core on macOS using Homebrew (the preferred package manager), direct download, or binary archives, then verify the version and restart the shell to complete the setup.

Learn to manage local and remote PowerShell script execution using execution policies, scopes, and code signing, while leveraging the anti-malware scan interface to strengthen Windows security.

Explore how code signing certificates from a certification authority create an electronic stamp and encrypted script to prevent tampering, enforce authentication, and ensure PowerShell execution policies protect networks.

Prepare and issue a code signing certificate for Victoria P.S.1 through the domain controller and Active Directory Certificate Services, configuring a template and enabling administrator use.

Learn how code signing with a certificate authority protects PowerShell scripts by enforcing an all signed execution policy, preventing tampering with script files.

Check and set PowerShell execution policy to all signed, create and sign a script with a certificate, verify the signature, and deploy trusted publishers to ensure secure script execution.

Master PowerShell desired state configuration (DSC) to enforce secure, automatic configurations with auditing and logging. Explore DSC architecture—resources, configuration, and the local Configuration Manager, plus push and pull deployment.

Configure a DSC pull server using PowerShell Desired State Configuration. Install the x DSC module, deploy the pull server configuration, and set up an IIS site on port 1880.

Configure the DSC configuration file and LCM script to pull and apply a print service configuration, and set up a web download manager with a server URL and certificate.

Configure pull-based dsc with the local configuration manager, load and apply remote configuration files, enable auto correct, and validate successful deployment to a target device such as Victoria PS1.

Learn how just enough administration (JEA) uses an end point server to securely delegate admin tasks via PowerShell scripts and session configurations.

Explore Windows PowerShell based exploits and their mitigation, and learn red team versus blue team security concepts. Use service accounts and port scanning to strengthen defense.

Install Linux in a virtual machine by downloading the mix image, configuring network adapters, creating a 20 gigabyte storage disk, and completing initial setup and updates.

Install and configure PowerShell on Linux by updating libraries, adding the Microsoft repository, and installing PowerShell, then update the help system and explore core commands for remote access.

Learn to set up a Linux host to connect to Windows over WinRM using Python, enabling PowerShell remoting, basic authentication, and encrypted communication.

Learn to use nmap and zenmap for information gathering, detecting operating systems and open ports. See how to block unnecessary ports with a firewall.

Learn to gather network information and identify open ports for defenders and hackers. Build port discovery script and manage ports via control panel, local security GPO, domain GPO, or PowerShell.

Build a PowerShell port scanner using arrays for tcp and udp ports, test local connections for open or closed ports, and prepare a remote report via domain controller access.

Develop a tcp port scanner in PowerShell to test common tcp and udp ports, handle connectivity with try/catch, and report open or closed status for targets like a domain controller.

Teach how to build a UDP port scanner in PowerShell, creating a UDP client, setting a one-second timeout, encoding ASCII data, and assessing server responses to determine port status.

Build a UDP port scanner listener in PowerShell by creating a UDP endpoint with IPAddress.Any and port 0, listen for responses, print IP and port, handle errors, and close sockets.

Learn to open or close ports using PowerShell and Windows firewall, covering graphical user interface, local group policy, and domain group policy, with inbound/outbound rules and port 1433.

Explore three PowerShell scripts to gather domain information, detect hacker profiles, and produce security group membership reports, then export gp data to history email files to analyze changes.

Learn to detect a suspected hacker by tracing logins across domain computers with PowerShell scripts, listing user profiles, and retrieving computer inventory via Get-ADComputer and Invoke-Command.

Learn to build a PowerShell script that retrieves all security groups and their members from Active Directory, prints the results, and saves them to a file for security review.

Develop a PowerShell script to inventory all GPO settings across an enterprise network, saving them to a CSV and displaying the resulting file path for review.

Learn to automate exporting all GPOs with a PowerShell function, saving policy objects to a folder, including directory creation and domain controller access checks.

Create and save a PowerShell script that exports GPO information, including display name, ID, status, creation and modification times, and generates per-GPO reports saved to a designated output directory.

Discover how to create, link, and modify GPOs with PowerShell, set registry values (screen saver timeout) for user and machine scopes, and generate deployment reports.

Build a PowerShell script to search a GPO registry key and value, deploy with gpupdate /force, and validate across multiple GPOs using a get registry value function.

Learn to search registry values in group policy objects (GPOs) with PowerShell, handle multiple GPOs, and build a GPO object containing display name, GUID, domain path, type name, and value.

Develop a flexible PowerShell function, discover shares, to enumerate Windows Server file shares from Active Directory, with filter shares enabled by default and exclusions for admin shares and system volumes.

Develop a PowerShell script to enumerate domain controllers, filter shares, and track progress with iteration and output, using try-catch to handle offline servers and record failed servers.

Build a flexible PowerShell function to gather domain controllers, servers, and shared folders with a true/false filter, iterative processing, and error handling to produce a consolidated output.

Develop and test a PowerShell script that iterates through seven servers, calculates and displays percent complete, handles discovery of shares, and saves results to a file.

Write a script to retrieve directory information, including group membership and permissions, for a specific path and its subfolders, with input parameters and an optional graphical interface.

Import the module and run the scan-permission function to understand required variables, then test a temporary folder with subfolders recursively to reveal read and write access.

Develop a flexible PowerShell script to scan directories (path, system 32, current directory) with optional recursion and alerts, colorized output, and parameter-driven configuration.

Spawn a PowerShell script to scan network shares for read/write access across target hosts or domain servers, then enumerate and display folders with open permissions for everyone.

Develop a flexible PowerShell script to audit shared folder permissions across domain devices, targeting by IP or file and using a domain query parameter to scan the entire domain.

Develop PowerShell security best practices by building modular functions with a built-in help system and parameter configuration. Learn to scan and enumerate shared folders across local, IP list, and domain targets using a dedicated explore shares security function for read and write permissions.

Learn to implement PowerShell security best practices by building a function to enumerate shared folders and permissions, handle errors with try/catch, and print access control lists.

Implement Windows PowerShell security in a domain environment using DSC and JEA, configure rule capabilities and session configurations, and deploy to Victoria domain devices to verify improvements.

Compile and deploy Windows PowerShell logging with desired state configuration (DSC) across three lab devices, test exploits, and strengthen security using just enough administration and group policy approaches.

Learn to deploy and verify DSC configurations across three devices using PowerShell. Adapt code for local host deployment, enable logging, and validate registry changes and device trust relationships.

Set up a Windows lab by adding a domain user to the local administrators group on two devices, enabling internet access, and exploring post-exploitation with PowerShell tools like Invoke-Mimikatz.

Explore Mimikatz and its use to gather credentials, parse hashes, and leverage golden tickets to escalate privileges across Windows systems, while understanding hash versus password and default policy implications.

Explore Mimikatz in memory and the use of PowerShell to download and deploy it on remote systems, while addressing Windows Defender antivirus warnings and logs.

Learn how Mimikatz analyzes compiled executables and dlls, evaluates memory protections such as aslr and dep, and explores privilege checks and Kerberos tickets for security learning.

Configure a jea role capability and session configuration to restrict admin tasks to restarting the print spooler service, create and test the capability file, and deploy the module path.

Configure a restricted JEA session by creating and registering a session configuration file with tailored capabilities. Define user groups, virtual accounts, and access controls to limit server access.

Demonstrates testing restricted remote access with PowerShell by configuring session permissions, enabling and disabling restricted configurations, and enforcing limited command scopes to improve server security.