Competition Checklist · 02 · Windows 11
Windows 11 Checklist
A competition-ready reference for accounts, Defender, Firewall, updates, services, persistence, processes, networking, remote access, shares, and Windows event evidence.
Use this after reading the image-specific requirements. The checklist helps you inspect consistently without replacing the scenario or encouraging blind hardening.
Quick Use
Windows rule
Verify the mission before disabling anything
Windows has many services, scheduled tasks, built-in accounts, and listeners that can look unfamiliar. Investigate purpose and dependency first, then make the smallest justified change.
Opening pass
Do these checks before deep hardening
Read the Windows 11 image requirements before changing accounts, services, remote access, or security settings.
The competition scenario may require specific users, applications, services, shares, or remote-access behavior.
Record approved local users and approved administrators.
This gives you a trusted reference before changing account state or Administrators membership.
Confirm Defender, Firewall, and Windows Update status early.
Core protections should be understood before lower-priority cleanup begins.
Capture the current service, scheduled-task, startup, process, and listener state.
A baseline helps you identify what changed after remediation and preserves evidence before state-changing actions.
Write down any required remote-access method.
RDP or another service should not be disabled until the mission confirms it is unnecessary.
Record high-risk findings before acting.
Unknown privileged accounts, disabled protection, suspicious persistence, or active suspicious processes should be prioritized.
Accounts & privilege
Confirm identities before account cleanup
Local users
Get-LocalUser
net user
Every local account is approved, expected, disabled when appropriate, and documented before removal.
Administrators group
Get-LocalGroupMember Administrators
net localgroup Administrators
Only approved administrators retain elevated membership.
Other local groups
Get-LocalGroup
Get-LocalGroupMember "Remote Desktop Users"
Membership in security-sensitive groups matches the scenario.
Recent account changes
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4720,4722,4725,4732,4733} -MaxEvents 80Unexpected account creation, enable/disable activity, or privileged group changes are investigated.
Core security
Check Defender, Firewall, updates, and security services
Microsoft Defender
Get-MpComputerStatus
Get-MpPreference
Antivirus, real-time protection, signatures, and relevant protection features remain enabled unless the scenario states otherwise.
Windows Firewall
Get-NetFirewallProfile
Get-NetFirewallRule | Where-Object Enabled -eq True
Domain, Private, and Public profiles are enabled as appropriate and required application rules still function.
Windows Update
Get-Service wuauserv
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 20
Update services are available and the machine is not obviously missing required security maintenance.
Security Center services
Get-Service SecurityHealthService,WinDefend,MpsSvc
Core Windows security services are running or configured as expected.
Services & remote access
Know what is listening before you disable it
Running services
Get-Service | Where-Object Status -eq Running | Sort-Object Name
Every unusual service is compared with the mission before being disabled.
Automatic services
Get-CimInstance Win32_Service | Where-Object StartMode -eq Auto | Select-Object Name,State,StartName,PathName
Automatic services have expected names, accounts, and executable paths.
Remote Desktop
Get-Service TermService
Get-NetTCPConnection -LocalPort 3389 -ErrorAction SilentlyContinue
Get-LocalGroupMember "Remote Desktop Users"
RDP state matches the mission and only approved users can use it.
Other listeners
Get-NetTCPConnection -State Listen | Select-Object LocalAddress,LocalPort,OwningProcess
Unexpected listeners are mapped to processes and services before remediation.
Persistence
Review scheduled and automatic execution
Scheduled tasks
Get-ScheduledTask
Get-ScheduledTask | Where-Object State -ne Disabled
Unexpected tasks are investigated by action, trigger, author, run-as identity, and path.
Startup folders
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -Force
Get-ChildItem "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" -Force
Startup entries are expected, required, or documented before removal.
Run keys
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Autorun entries point to expected software and locations.
Services as persistence
Get-WinEvent -FilterHashtable @{LogName="System"; Id=7045} -MaxEvents 50Recently installed services are compared with executable paths and mission requirements.
Processes
Investigate execution before containment
Process inventory
Get-Process | Sort-Object ProcessName
Unknown processes are investigated by path, owner, parent, command line, and network activity before termination.
Process details
Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine
Suspicious-looking names are not judged without checking path and execution context.
Process-to-network mapping
Get-NetTCPConnection | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess
Active connections are tied to owning processes so network findings have context.
Process creation evidence
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4688} -MaxEvents 100Execution evidence is preserved when auditing is available.
Network & shares
Map connections, listeners, and required access
IP configuration
Get-NetIPConfiguration
ipconfig /all
Addresses, gateways, DNS, and adapter state match the expected environment.
Active connections
Get-NetTCPConnection | Sort-Object State,RemoteAddress
Unexpected external connections are investigated with process ownership.
Listening ports
Get-NetTCPConnection -State Listen | Sort-Object LocalPort
Every important listener is associated with a required or investigated service.
Shares
Get-SmbShare
Get-SmbSession
Unexpected shares or sessions are investigated without breaking required collaboration.
Event quick reference
Windows events worth checking during investigation
4624
Successful logon
Correlate approved or suspicious sessions with later account, process, or service activity.
4625
Failed logon
Identify repeated authentication failures and unusual source patterns.
4672
Special privileges assigned
Review privileged sessions and correlate them with account or system changes.
4688
Process creation
Use when available to connect an executable, user, parent process, and command line.
4720
User account created
Investigate new local identities and whether they match the mission roster.
4732
Member added to local group
Investigate unexpected additions to Administrators or other privileged groups.
7045
Service installed
Correlate newly installed services with executable paths and timestamps.
High-priority findings
Preserve the evidence, then address the actual risk
Unapproved user in Administrators
Preserve account and event evidence, verify the roster, then remove or disable only if confirmed unauthorized.
Defender or Firewall disabled
Confirm the scenario does not require the state, re-enable protection, and verify required applications still work.
Unknown process with active outbound connection
Record PID, path, parent, command line, hash, and network details before containment.
Suspicious scheduled task or service
Record action, trigger, account, path, and related logs before disabling or removing it.
RDP enabled when not required
Verify no required administration depends on it, then restrict or disable it and re-check management functionality.
Unexpected SMB share
Confirm whether it is required, record permissions and sessions, then remove only if justified.
Do not blindly change
Common Windows competition overreactions
Do not delete every account you do not recognize without checking the mission.
Do not disable all services marked unfamiliar.
Do not turn off RDP until the scenario confirms it is unnecessary.
Do not remove scheduled tasks only because their names look unusual.
Do not terminate a process before preserving useful process and network evidence.
Do not remove shares before verifying whether users or services depend on them.
Do not change firewall rules in bulk without understanding the required applications.
Do not assume a clean-looking desktop means the system is secure.
Verification sweep
Re-check the system after remediation
Accounts
Approved users remain, unauthorized users are handled, and Administrators membership matches the mission.
Defender
Microsoft Defender is healthy and real-time protection is active.
Firewall
Required firewall profiles are enabled and approved applications still communicate.
Updates
Windows Update services remain usable and no remediation broke update functionality.
Services
Required services are running and disabled services were actually unnecessary.
Persistence
Scheduled tasks, startup entries, and service-based persistence match the final approved state.
Network
Expected addressing, listeners, connections, shares, and remote-access behavior remain functional.
Evidence
Important logs, paths, timestamps, hashes, and notes were preserved before high-impact changes.
Windows 11 final checklist
Finish only when the workstation still satisfies the mission
Scenario requirements were reviewed before Windows changes.
Approved local users and administrators match the final state.
Defender is enabled and healthy.
Windows Firewall profiles are enabled as required.
Windows Update remains functional.
Required services remain available.
Unneeded remote access is disabled only when justified.
Scheduled tasks and startup locations were reviewed.
Suspicious processes were investigated before containment.
Listening ports and active connections were mapped to processes.
Shares and sessions were reviewed without breaking required access.
Relevant event logs were checked for account, privilege, process, and service changes.
Every major remediation was verified.
The change log records what was changed and why.