Practice Lab · 01 · Windows 11
Windows 11 Baseline Review
Build a disciplined first-pass review of a fictional Windows 11 workstation. Your job is to understand the current state, identify conflicts with the mission briefing, and avoid broad, unsupported changes.
This lab is designed for an authorized practice VM. The evidence below is fictional and does not reveal any live CyberPatriot scoring answers.
Lab Snapshot
Mission briefing
Fictional student media workstation
You are reviewing a Windows 11 workstation used by a student media team. Keep approved productivity tools, browsing, local sign-in, and normal network access functional while correcting security issues supported by the mission.
The workstation belongs to a fictional student media team and must remain usable for normal schoolwork.
The approved local users are Jordan, Priya, and the built-in Administrator account.
Jordan is the primary user and should remain a standard user.
Priya is a temporary support user and should not have administrator privileges.
Remote Desktop is not required for this workstation.
Microsoft Defender and Windows Firewall should remain enabled.
Windows Update should not be intentionally disabled.
The browser and approved productivity applications must continue to work.
Lab rule
Do not remediate during the initial inventory
Complete the baseline first. Record the current state, mark items that need more evidence, and only then decide what is justified by the mission requirements.
Initial inventory
Build the baseline
Run these checks on an authorized practice VM, or use the fictional evidence later in the lab if you are working without a VM.
Identity
Understand who can sign in and who has elevated rights.
Record
Account names, enabled/disabled state, administrator membership, and anything that conflicts with the mission briefing.
Get-LocalUser
Get-LocalGroupMember -Group "Administrators"
whoami
whoami /groups
Services
Identify unusual services without disabling required functionality.
Record
Service name, state, startup mode, service account, executable path, and whether the service is required by the scenario.
Get-Service
Get-CimInstance Win32_Service | Select Name,State,StartMode,StartName,PathName
Firewall
Verify firewall protection and inspect enabled rules before changing anything.
Record
Profile state, unusual enabled rules, rule direction, and any rule that appears related to remote access.
Get-NetFirewallProfile
Get-NetFirewallRule -Enabled True
Startup
Review common startup locations for unexpected persistence or unnecessary auto-start entries.
Record
Startup item name, executable path, user context, and whether the item is expected.
Get-CimInstance Win32_StartupCommand
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Scheduled Tasks
Find scheduled activity and distinguish configured state from actual execution.
Record
Task name, action, trigger, run-as account, last run time, and whether it is expected.
Get-ScheduledTask
Get-ScheduledTaskInfo -TaskName "ExampleTask"
Processes
Capture volatile process state and map suspicious-looking activity to an executable path.
Record
PID, parent PID, process name, executable path, command line, and user/service context when available.
Get-Process
Get-CimInstance Win32_Process | Select ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine
Network
Understand addressing, listeners, and active connections.
Record
IP configuration, listening ports, owning PIDs, remote endpoints, and anything that should be investigated further.
ipconfig /all
Get-NetTCPConnection -State Listen
Get-NetTCPConnection
netstat -ano
route print
Security & Updates
Verify core protection without assuming a healthy status proves the workstation is clean.
Record
Defender state, protection status, any detection history, and visible update history.
Get-MpComputerStatus
Get-MpThreatDetection
Get-HotFix | Sort-Object InstalledOn -Descending
Fictional evidence
Classify the findings before changing anything
These observations are intentionally incomplete. Use the mission briefing and your Windows knowledge to decide which need action and which need more evidence.
Jordan, Priya, Guest, and Administrator are present. Guest is disabled.
Your question
Which accounts are explicitly approved by the mission briefing, and which require closer review?
Administrator and Priya are members of the local Administrators group.
Your question
Does the mission briefing support Priya having administrator privileges?
Domain: On, Private: On, Public: On.
Your question
Is there any reason to disable a profile based on this evidence?
One startup item named MediaSync launches from C:\ProgramData\MediaTools\mediasync.exe.
Your question
What additional evidence would you collect before deciding whether MediaSync is expected?
A task named MediaBackup runs daily at 18:00 under Jordan and launches an approved backup script.
Your question
Why is task presence alone not enough to call it suspicious?
TCP 3389 is listening and maps to a Windows service associated with Remote Desktop.
Your question
How does the mission briefing change the priority of this finding?
Real-time protection is enabled. No recent threat detections are listed.
Your question
What does this prove, and what does it not prove?
The most recent visible hotfix was installed several weeks ago.
Your question
What should you verify before concluding that Windows Update is broken or disabled?
Finding categories
Label what you know
Expected
The state matches the scenario and does not need remediation.
Needs evidence
The state is not clearly good or bad. Collect more context before changing it.
Misconfigured
The state conflicts with an explicit scenario requirement or defensible baseline.
High priority
The state conflicts with the mission and creates immediate security or availability risk.
Decision checkpoint
Stop and justify the next action
Which findings directly conflict with the mission briefing?
Which finding looks unusual but still needs more evidence?
Which evidence should be preserved before remediation?
Which change would be the smallest justified correction?
What command would you run immediately after that change to verify the result?
What required functionality could be accidentally broken by a careless change?
Remediation guardrails
Avoid the changes that destroy evidence or break the workstation
Do not disable an account only because the name is unfamiliar.
Do not remove administrator membership without confirming the mission requirement.
Do not stop or disable a service until you understand what depends on it.
Do not delete a scheduled task before recording its action, trigger, account, and run history.
Do not kill a process before capturing path, command line, parent PID, and useful network context.
Do not disable the firewall to solve a connectivity problem.
Do not assume that no Defender detection means every file or process is safe.
Change one justified item at a time, then verify.
Verification
Prove that the correction worked
Accounts
Re-run Get-LocalUser and the Administrators group check. Confirm approved users still exist and privilege matches the scenario.
Remote access
Check Remote Desktop service/configuration and confirm the workstation still has the required local functionality.
Firewall
Re-run Get-NetFirewallProfile and confirm all required profiles remain enabled.
Services
Re-run service status for anything you changed and verify dependent functionality.
Startup / tasks
Re-run the exact startup or scheduled-task check that identified the finding.
Network
Re-check listeners, connections, and required connectivity after network-related changes.
Defender / updates
Confirm Defender protection remains enabled and Windows Update has not been intentionally disabled.
Evidence notebook
What your notes should contain
You do not need a special tool. A simple table or document is enough if it clearly separates observation, decision, change, and verification.
Finding ID
Source / command
Direct observation
Why it matters
Scenario requirement involved
Additional evidence needed
Decision
Change made
Verification result
Reflection
Debrief your reasoning
Answer these only after you finish the inspection and any justified remediation.
Why is administrator-group membership more meaningful when compared with the mission briefing?
Why should MediaSync not be removed immediately just because its name is unfamiliar?
What is the difference between a firewall rule allowing a port and a service actually listening on that port?
Why should you preserve scheduled-task details before deleting or disabling a task?
Why does a clean Defender status not prove that every program is safe?
Which baseline command gave you the most useful context, and why?
What was the highest-risk mistake you could have made by acting too quickly?
How did verification prevent you from assuming that a remediation worked?
Completion checklist
Finish the lab only after verification
I read the mission briefing before running remediation commands.
I identified approved users and expected privilege levels.
I reviewed service state and paths before considering changes.
I checked firewall profiles and did not disable protection.
I reviewed startup items and scheduled tasks with context.
I captured process and network evidence before changing volatile state.
I checked Defender and visible update state.
I made only scenario-supported defensive changes.
I re-ran relevant checks after remediation.
I can explain which observations were facts and which were inferences.