Windows Foundations

Understanding the Windows Operating System

The Windows Operating System (OS) stands as one of the most widely used operating systems in the world. Developed by Microsoft, Windows has evolved significantly since its inception, becoming a cornerstone of personal computing and business operations. This section aims to demystify the Windows OS for beginners interested in cybersecurity, providing an overview of its history, key features, and the basic architecture that underpins it.

Windows Architecture: At its core, the Windows architecture is designed to provide a secure, stable platform for a wide range of computing activities. It consists of two main layers: the user mode and the kernel mode.

• User Mode: This layer is where applications and user-oriented services run. It includes the Windows Shell (the graphical user interface), application frameworks, and high-level APIs that allow software developers to build Windows applications.
• Kernel Mode: The kernel mode operates at a low level, managing core system functions such as hardware operations, memory management, and process control. It contains the Windows kernel, the Hardware Abstraction Layer (HAL), and device drivers. The kernel acts as the OS’s heart, facilitating communication between hardware and software.

Critical System Files: Windows relies on several critical system files to operate. Notable among these are:

• ntoskrnl.exe (Windows NT Kernel & System): The core kernel file responsible for essential system services such as process and memory management.
• hal.dll (Hardware Abstraction Layer): Enables the Windows kernel to operate independently of the hardware.
• win32k.sys (Windows API and Graphics Engine): Handles the Windows graphical user interface and input from devices like keyboards and mice.
• System Registry: A database that stores low-level settings for the OS and applications. It plays a crucial role in the configuration and security of Windows systems.

Navigating the Windows Environment: Command Line Basics

For anyone stepping into the cybersecurity field, understanding how to navigate the Windows environment, especially through the command line, is important. The command line interface (CLI) offers a set of tools for managing Windows settings, files, and network configurations more efficiently than you might through the graphical user interface (GUI). Here’s a beginner-friendly guide to using the command line navigation in Windows, which is an important skill for aspiring cybersecurity professionals.

Command Prompt vs. PowerShell

Windows provides two primary command line interfaces: Command Prompt and PowerShell. While both can execute commands and automate tasks, PowerShell is a more powerful tool, designed with advanced features and scripting capabilities that are particularly beneficial for cybersecurity tasks.

• Command Prompt: A legacy CLI that executes simple commands. It’s useful for basic file management, system diagnostics, and network operations.
• PowerShell: An advanced CLI and scripting environment that combines command-line speed with the flexibility of scripting languages. PowerShell is essential for automating complex administrative tasks and managing system and network security. The Powershell CLI is great and very useful because it allows you to use many of the Linux commands that you would any Linux CLI.

Command Prompt

The Command Prompt, often referred to as cmd.exe or simply cmd, is a command-line interface that is available in most Windows operating systems. It provides a user interface for executing commands and scripts via a text-based window, allowing users to perform a wide range of tasks without a graphical interface. These tasks include managing files and directories, configuring system settings, running utilities for diagnosing network and system issues, and automating tasks through batch scripts.

Basic File Management

• dir: Lists files and directories in the current directory.
• cd: Changes the current directory. Use cd.. to go up one directory level.
• md or mkdir: Creates a new directory.
• rd or rmdir: Deletes a directory.
• del: Deletes one or more files.
• copy: Copies one or more files to another location.
• move: Moves one or more files to another location.
• rename or ren: Renames a file or directory.

Network Configuration and Troubleshooting

• ipconfig: Displays all current TCP/IP network configuration values and refreshes DHCP and DNS settings.
• ping: Checks the network connection between the host and one or more destinations.
• tracert: Traces the route taken by packets to reach a network host.
• netstat: Displays active TCP connections, ports on which the computer is listening, Ethernet statistics, the IP routing table, and IPv4/IPv6 statistics.
• nslookup: Queries the DNS to obtain domain name or IP address mapping or any specific DNS record.

System Management

• tasklist: Displays a list of currently running processes.
• taskkill: Allows you to kill processes by their process ID (PID) or name.
• systeminfo: Displays detailed configuration information about a computer and its operating system, including hardware and software information.
• sfc: System File Checker, scans and restores corruptions in Windows system files.
• chkdsk: Checks the file system and file system metadata of a volume for logical and physical errors.
• diskpart: A text-mode command interpreter that enables storage configuration from a script, remote session, or direct input from a command prompt.

User and Group Management

• net user: Displays or modifies user accounts on a computer or domain.
• net localgroup: Adds, displays, or modifies local groups.

These commands are the building blocks for navigating and managing files directly through the command line.

Exploring PowerShell

To open PowerShell:

1. Right-click the Start button and select “Windows PowerShell” or “Windows PowerShell (Admin)” for administrative tasks.

Basic Operations

• Get-Help: Provides detailed information about PowerShell cmdlets and syntax. For example, Get-Help Get-Process would give you information on how to use the Get-Process cmdlet.
• Get-Command: Lists all cmdlets, functions, scripts, and aliases available in your PowerShell session. You can use it to discover new cmdlets or remind yourself of ones you’ve forgotten.
• Set-ExecutionPolicy: Changes the user preference for PowerShell script execution policies. This cmdlet is crucial for running scripts safely.

File and Directory Management

• Get-ChildItem: Lists items in a specified directory. It can be used similarly to dir or ls in Command Prompt or Unix/Linux.
• New-Item: Creates a new item, such as a file or directory. For instance, New-Item -Path 'C:\new_folder' -ItemType Directory creates a new directory.
• Remove-Item: Deletes a file or directory. For example, Remove-Item -Path 'C:\old_folder' -Recurse deletes a folder and all its contents.
• Copy-Item: Copies an item from one location to another.
• Move-Item: Moves an item from one location to another.

Working with Processes

• Get-Process: Lists currently running processes. You can filter to find specific processes, similar to using tasklist in CMD.
• Start-Process: Starts one or more processes on the local computer.
• Stop-Process: Stops one or more running processes.

System Information and Management

• Get-Service: Retrieves the status of services on a local or remote machine.
• Start-Service and Stop-Service: Start and stop services, respectively.
• Get-SystemInfo: Provides a detailed look at the system’s configuration, including hardware and operating system settings.
• Get-WmiObject: Gets instances of Windows Management Instrumentation (WMI) classes or information about the available classes.

Networking

• Test-Connection: Sends ICMP echo request packets (“pings”) to a target host and displays the results. It’s akin to the ping command in CMD.
• Get-NetIPAddress: Gets IP address configuration.
• Invoke-WebRequest: Makes an HTTP or HTTPS request to a web page. Useful for downloading files or querying REST APIs.

Security and Permissions

• Get-Acl: Gets the access control list (ACL) for a file or resource.
• Set-Acl: Sets the ACL for a file or resource.

Working with Active Directory

• Get-ADUser: Retrieves a user object or performs a search to retrieve multiple user objects from Active Directory.
• New-ADUser: Creates a new AD user.

PowerShell uses a verb-noun command syntax, making it intuitive to understand what each command does. For cybersecurity tasks, PowerShell’s advanced capabilities allow you to script complex operations, manage security policies, and automate routine checks and balances.

Managing Windows Accounts and Permissions

Managing Windows Accounts and Permissions is a foundational task for ensuring the security and proper functioning of Windows Server environments. For beginners, navigating these tasks can seem daunting, but understanding the basics can significantly simplify the process. This section aims to demystify the management of accounts and permissions on Windows servers for those just starting out.

Understanding the Basics

Windows Accounts: These are the identities assigned to users and services that interact with the Windows Server. Accounts can be categorized into two main types: User Accounts (for people) and Service Accounts (for running applications or services).

Permissions: Permissions define what actions an account can perform on a system’s resources, such as files, directories, and printers. Properly managing permissions is crucial for securing sensitive data and ensuring that users have the access they need to perform their jobs.

Managing User Accounts

1. Creating User Accounts:
   • Active Directory (AD): In a domain environment, you’ll use the Active Directory Users and Computers (ADUC) tool to create and manage user accounts. Right-click on the appropriate Organizational Unit (OU), select “New”, and then “User” to start the creation process.
   • Local Users: On servers not part of a domain, you can create user accounts through the Local Users and Groups manager. Access this via the Computer Management tool, navigate to “Local Users and Groups”, right-click “Users”, and select “New User”.
2. Setting Account Properties:
   • During account creation, you’ll be prompted to fill in various properties, such as the user’s full name, user logon name, and password. Ensure that passwords meet your organization’s security requirements.

Managing Groups

Groups simplify the management of permissions by allowing you to assign rights and access to multiple users simultaneously.

• Creating and Managing Groups: Use ADUC for domain environments or Local Users and Groups for standalone servers to create groups. Add user accounts to groups based on their role or the resources they need access to.

Assigning Permissions

1. File and Directory Permissions:
   • Right-click on a file or folder, select “Properties”, and go to the “Security” tab to view or modify permissions. Here, you can add user accounts or groups and specify their access levels (e.g., Read, Write, Full Control).
2. Understanding Permission Inheritance:
   • Permissions can be inherited from parent folders, simplifying the management process. Be mindful of inheritance when setting permissions to ensure it doesn’t inadvertently grant access to unintended users.

Best Practices for Security

• Least Privilege Principle: Always assign the minimum level of access necessary for users to perform their duties. This reduces the risk of accidental or malicious misuse of system resources.
• Regular Audits: Periodically review accounts and their permissions to ensure they’re still necessary and conform to security policies. Remove or adjust as needed.
• Secure Service Accounts: Use strong, unique passwords for service accounts and limit their permissions strictly to what’s needed for their operation.

Tools and Resources

• PowerShell: As you become more comfortable with Windows Server, PowerShell scripts can streamline the management of accounts and permissions.
• Group Policy: In domain environments, Group Policy Objects (GPOs) can enforce security policies and manage user settings across multiple servers and workstations.

Starting with the management of Windows accounts and permissions can seem complex, but it’s essential for maintaining the security and functionality of your server environment. By following the outlined steps and adhering to best practices, beginners can effectively manage user access and secure resources on Windows servers. Remember, practice and continuous learning are key to becoming proficient in Windows Server administration.

Understanding Windows Services

Windows services are background processes that typically start when the computer boots up and run as long as Windows is running. These services are integral to the operating system’s functionality, providing networking, security, and various system operations.

Server Message Block (SMB)

What is SMB?

• SMB, short for Server Message Block, is a network file sharing protocol that allows applications on a computer to read and write to files and to request services from server programs in a computer network. SMB can be used over the internet on top of the TCP/IP protocol.

Uses of SMB:

• Sharing access to files, printers, and serial ports among networked computers.
• Facilitating network communication between servers and clients to authenticate and authorize users and services.

Security Considerations:

• SMB versions: Highlight the importance of using the latest versions (SMB 2 and SMB 3) for enhanced security features like encryption.
• Vulnerabilities: Discuss historical vulnerabilities associated with SMB, such as the WannaCry ransomware attack exploiting the SMBv1 protocol.
• Best Practices: Recommend disabling SMBv1, using strong passwords, and applying regular updates as security measures.

Other Essential Windows Services

Dynamic Host Configuration Protocol (DHCP)

• Role: Automatically assigns IP addresses to devices on a network, reducing manual configuration errors and saving time.
• Security Considerations: Unauthorized DHCP servers can lead to network attacks. Implementing DHCP snooping on switches can mitigate risks.

Domain Name System (DNS)

• Role: Translates domain names into IP addresses, making it easier to access websites without memorizing IP addresses.
• Security Considerations: Vulnerable to DNS spoofing attacks. Use DNSSEC (DNS Security Extensions) for validation.

Remote Desktop Protocol (RDP)

• Role: Allows remote connection and control of another Windows computer over a network connection.
• Security Considerations: Exposing RDP to the internet can lead to brute force attacks. Limiting RDP access, using VPNs, and enabling Network Level Authentication (NLA) can enhance security.

Windows Update Service

• Role: Automatically downloads and installs Windows updates, keeping the system secure with the latest patches.
• Security Considerations: Ensure updates are applied promptly to mitigate vulnerabilities. Consider managing updates through a centralized system in enterprise environments for better control.

Windows services like SMB, DHCP, DNS, RDP, and the Windows Update Service play critical roles in the functionality and usability of Windows networks. However, each service comes with its own set of security considerations. Understanding these services and their potential vulnerabilities is essential for cybersecurity professionals to protect networks from threats. Implementing best practices, such as regular updates, using secure configurations, and applying the principle of least privilege, is vital for maintaining a secure Windows environment.

This section aims to equip beginners with an understanding of key Windows services and their implications in cybersecurity, highlighting the importance of security awareness and proactive measures to safeguard networks.

Kerberos

Kerberos is a computer network authentication protocol that works on the basis of “tickets” to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner.

It is based on the symmetric key cryptography model and requires a trusted third-party, known as the Key Distribution Center (KDC), to authenticate parties.

How Kerberos Works in Windows:

In a Windows Active Directory (AD) environment, Kerberos is the default authentication protocol used to authenticate users and services.

The process involves three key parties: the client, the server, and the Key Distribution Center (KDC), which is usually integrated with the Active Directory domain controller.

Authentication steps:

1. The client requests an authentication ticket (TGT) from the KDC.
2. The client uses the TGT to request a service ticket for the desired service from the KDC.
3. The client presents the service ticket to the server to prove their identity and gain access.

Importance of Kerberos in Windows Security:

• Kerberos is essential for ensuring secure authentication within Windows domain environments without transmitting passwords over the network.
• It supports mutual authentication, where both the client and the server verify each other’s identity.
• Kerberos encryption adds a layer of security by encrypting parts of the communication between the client and the server.

Windows Services and Kerberos:

• Many Windows services, such as SQL Server, SharePoint, and Internet Information Services (IIS), can use Kerberos for secure authentication.
• Windows leverages Kerberos for various network services, including those accessed via the SMB protocol, to enhance security and reduce the risk of credential interception.

Kerberos is a fundamental part of the security infrastructure in Windows-based networks, particularly those utilizing Active Directory. Understanding Kerberos is essential for anyone involved in administering, securing, or working with Windows network environments.

Certifications

If you enjoyed learning about Windows and want to learn more, we recommend to study for the the AZ-800 certification and add that to you list of credentials.

For those interested, I’ve included an affiliate link to purchase the book. Using this link not only gets you a great resource for your studies but also supports our blog at no additional cost to you:

Administering Windows Server Hybrid Core Infrastructure AZ-800 Exam Guide

Next Steps in Your Learning Journey

With these basics under your belt, you’re well on your way to deeper cybersecurity learning. Dive into advanced topics and start applying your knowledge in practical scenarios. Check-out the next series to understand Linux Fundamentals to learn the basics of Linux or our coding fundamentals page to learn coding basics.

Remember, the field of cybersecurity is vast and ever-evolving. Stay curious, keep learning, and use SecureBitsBlog as your guide through the fascinating world of digital security.