Microsoft Security Fundamentals

Set up a virtualized lab with VirtualBox to run Windows 10 and Windows Server 2016 in a sandbox network for hands-on Active Directory, prerequisites, VirtualBox installation, and ISO downloads.

Install VirtualBox, verify a 64-bit processor with VT-x or AMD-V enabled, and allocate 8–12 GB RAM and about 40 GB per VM for Windows Server 2016 and Windows 10.

Learn how to download Windows operating system ISO files, including Windows 10 Enterprise and Windows Server 2016, from Google Drive or a website when the Microsoft Evaluation Center is offline.

download Windows 10 Enterprise and Windows Server 2016 ISO files from the Microsoft Evaluation Center, save them for use in a virtual machine, and connect to Active Directory.

Create and configure VirtualBox virtual machines for Windows 10 and Windows Server 2016, including dynamic VDI disks, 50 GB storage, RAM choices, and attaching ISO files for installation.

Discusses VirtualBox versions 5.2.22 and 6.0, the extension pack, and features like shared clipboard, drag-and-drop, memory and CPU settings, acceleration, USB support, and shared folders.

Learn to install Windows 10 on a VirtualBox virtual machine, choose custom installation, configure a local account, apply express settings, install VirtualBox guest editions, and create a clean installation snapshot.

Install Windows Server 2016 in a virtual machine, choose standard edition with desktop experience, configure administrator password, enable network discovery, install guest box editions, take a snapshot, plan for updates.

Update Windows 10 and Windows Server 2016, verify internet connectivity, run Windows Update, install updates, restart if prompted, and take pre- and post-update snapshots before switching to an internal network.

Switch virtual machines to an internal sandbox network and assign static private IPs in the 192.168.10.0/24 range to enable isolated inter-vm communication and prepare for Active Directory and dhcp deployment.

Discover how Active Directory centralizes authentication, authorization, and accounting with single sign-on for Windows domain networks, and how domain controller, LDAP, and organizational units enable centralized administration.

Install and promote Windows Server 2016 to a domain controller by adding the Active Directory Domain Services role, configuring a local domain like alnet.local, and ensuring DNS integration.

Install and configure a dhcp server on Windows to issue ipv4 addresses from a local 192.168.10.0/24 scope, verify leases, and test client connectivity via ipconfig and ping.

Learn to add a Windows 10 PC to an Active Directory domain by renaming the computer, joining the domain with domain administrator credentials, and verifying the new domain membership.

Explore domain one, covering core principles such as the CIA triad and defense in depth, plus physical and wireless security concepts including WEP, WPA two, and WPA three.

Explore the CIA triad: confidentiality, integrity, and availability, and learn how authentication, access control, encryption, and digital signatures protect data while redundancy, backups, and disaster recovery ensure uptime.

Explore authentication, authorization, and accounting as a framework that controls access to data and resources. Verify identities, enforce access control, and audit actions to protect data integrity and mitigate risks.

Implement defense in depth by enforcing multiple security layers, policies, physical and perimeter security, and network, host, and application protections to safeguard data even if one layer is breached.

Apply least privilege by granting minimum permissions to users, groups, and applications to reduce the attack surface, using Active Directory groups and standard account management.

Explore the types of risks and threats across monetary costs, asset losses, and legal concerns, including data and intellectual property breaches, corporate espionage, and threat categories—natural, unintentional, and intentional.

Analyze attack surface across applications, network, and users to identify vulnerabilities within risk management. Strengthen security by evaluating design, devices, and training to reduce exposure and enable least privilege.

Explore social engineering tactics like impersonation, phishing, piggybacking, tailgating, and dumpster diving, and learn how user training, verification, and security policies mitigate these attacks.

Explore physical and logical access control within risk management, and the six control types: preventative, detective, corrective, recovery, deterrent, and compensating, with door access and ACL examples.

Assess physical site security by layering parking lot perimeter, building access, and internal secure areas with defense in depth and physical access controls.

Apply physical security to computer equipment with cable locks and lockable server racks to add defense in depth, pairing these with logical access controls and in-room safes when traveling.

Educate users on removable and mobile device risks, rogue devices, and enforce training and policies, and apply encryption, remote data wiping, and port controls to prevent malware and data theft.

Explore keyloggers, their physical USB, software, and wireless variants, and learn practical protection methods such as anti-malware, encryption, and hardware security to prevent keystroke capture.

Compare the four wireless encryption standards—WEP, WPA, WPA2, and WPA3—and explain their vulnerabilities, including WPA2's 2018 cracking and WPA3 weaknesses noted in 2019.

WEP, the original 802.11 encryption, uses RC4 with a 24-bit key and a clear-text IV, making it vulnerable to eavesdropping and replay attacks, deprecated in 2004 and superseded by WPA.

WPA serves as an interim fix to WEP, enabling updates via firmware and using a weaker RC4 cipher with encrypted IV, plus a temporal key integrity protocol to update keys.

WPA2 replaced the weaker RC4 algorithm with AES and upgraded TCP to CMP, but KRACK vulnerabilities surfaced in 2017; patch devices and firmware, and choose WPA3 where supported.

WPA3 arrived in 2018 as the successor to WPA2, introducing Sase (simultaneous authentication of equals) for a more secure initial key exchange, though patching and adoption were uneven by 2019.

Compare WPA personal and enterprise modes: personal uses a pre-shared key for small networks, while enterprise authenticates users against Active Directory via a radius server using 802.1X and EAP.

Perform a live router demo covering ssid management and hiding ssid, and compare wep, wpa, wpa2, and wpa3 encryption with mac address filtering, wi-fi protected setup, and radius for enterprise.

Explore domain two of operating system security, covering user authentication, smartcards, NTFS permissions and inheritance, AD groups and OUs, password policies, auditing, encryption, and malware types with live demos.

Explore authentication basics within the triple a framework, showing how users, computers, and devices authenticate to access resources and how multifactor authentication strengthens security.

Compare physical and virtual smart cards, showing how a TPM stores encryption keys and digital certificates to enable secure Windows logins with a PIN.

Explore how Radius provides centralized remote authentication, authorization, and accounting for remote access through vpn and wireless 802.1x, using Active Directory for credential checks and logging.

Watch a live demo on Windows Server 2016 showing how to set up a radius server with certificate services and network policy and access services for 802.1 X wireless authentication.

Watch a live demonstration of using the run as command to perform administrative tasks with elevated privileges. It highlights user account control and least privilege, with examples like check disk.

Learn NTFS advanced permissions for granular control beyond basic rights. See how to access them in Windows via the Security tab and Advanced settings.

Explore how NTFS file and folder moves and copies affect permissions and inheritance across and within partitions, showing when actions inherit destination permissions versus retaining originals.

Discover how network share permissions control access to shared drives and folders in Windows. Compare read, change, and full control with NTFS, and learn the most restrictive rule.

Explore how Active Directory groups streamline management by organizing users, computers, and other groups into security and distribution units to assign permissions across resources.

Explore Active Directory organizational units to mirror company structure with parent and child OUs for offices and departments, apply Group Policy objects, and delegate administrative tasks without full privileges.

Explore the Windows registry’s hive, key, and value structure, and how registry permissions including read, full control, and advanced options are inherited and managed, with safe editing tips.

Watch a live demonstration of inspecting the Windows Registry with Regedit, exploring hives, keys, subkeys, and values, and reviewing permissions and backups.

Demonstrate basic NTFS permissions in a Windows environment by creating a folder, adding domain users and a specific user, and adjusting read, modify, and deny versus allow settings.

Explore file system inheritance and changing ownership on a subfolder in Windows Server 2016. Learn to disable inheritance, convert to explicit permissions, and verify ownership via effective access.

View and verify a domain user's or a group's effective access using the advanced security settings and the effective permissions tool.

Demonstrate advanced NTFS permissions with a live session, showing how to access advanced settings, add a user, and assign granular permissions beyond basic options, including traversal and read attributes.

This live demo shows network share and NT file system permissions on Windows Server and Windows ten, demonstrating share vs file permissions and the most restrictive rule.

Watch a live demo showing moving and copying files in NTFS on Windows Server, across partitions and within the same partition, and how explicit versus inherited permissions behave.

See a live demo of creating Active Directory security groups, adding users, and assigning a folder with inherited permissions; verify effective access on Windows Server 2016.

Live demo of creating organizational units in Active Directory, assigning users and computers, delegating control, and configuring Group Policy for password and security settings across West and East offices.

Explore live Active Directory permissions in the users and computers console, enable advanced features to view the security tab, and assign granular permissions to groups such as organizational unit admins.

Learn how group policy objects enforce password policies in the Active Directory default domain policy, including complexity, minimum length, history, age settings, and why reversible encryption is discouraged.

Explore how group policy governs account lockout policies alongside password policies, detailing the threshold, duration, and reset account lockout counter after settings to mitigate failed login attempts and improve security.

Explore six common password attack methods, including social engineering, phishing, keylogging, and network sniffing. Learn about dictionary, brute force, and rainbow tables, and how hashes differ from encryption.

Demonstrates enforcing password and account lockout policies via the domain policy, applying changes with gpupdate /force, and testing lockouts on Windows 10, then unlocking and resetting passwords in Active Directory.