Practice Lab · 04 · Windows Server
Windows Server Identity Review
Investigate local and domain identities, privileged groups, authentication events, remote access, and recent account changes before modifying any administrative access.
This lab focuses on privilege reasoning. The question is not simply whether an account exists, but whether its access is justified by the server's role and supported by evidence.
Lab Snapshot
Mission briefing
Preserve approved administration while removing unjustified privilege
This fictional Windows Server system supports a small school district office and may be joined to a domain.
Approved privileged identities are the built-in Administrator account, Domain Admins, and the fictional support account DistrictOps.
Ordinary staff accounts should not have local or domain administrative privileges unless the scenario explicitly requires them.
Remote Desktop is permitted only for approved administrators and must not be broadly exposed to ordinary users.
The server must preserve authentication, file access, and required administrative functionality during remediation.
Microsoft Defender and Windows Firewall must remain enabled.
Do not delete accounts, reset passwords, or remove group membership until you understand whether the identity is required.
Identity evidence should be correlated across users, groups, logons, group changes, remote access, and recent administrative activity.
Identity rule
Privilege is a relationship, not just an account property
An account may gain power through local groups, domain groups, remote-access rights, service assignments, scheduled tasks, or active sessions. Review those relationships before changing the identity.
Identity context
Understand local versus domain authority
Start by establishing whether the server is domain-joined and which security context you are currently using.
Determine domain context
Establish whether the server is domain-joined, which identity context is active, and whether a domain controller is reachable.
whoami /fqdn
whoami /user
whoami /groups
Get-ComputerInfo | Select CsName,CsDomain,CsPartOfDomain,WindowsProductName
nltest /dsgetdc:$env:USERDNSDOMAIN
Inspect local users
List local accounts and compare them with the mission-approved identities.
Get-LocalUser
net user
Inspect local groups
Review local privilege and remote-access membership.
Get-LocalGroup
Get-LocalGroupMember -Group "Administrators"
Get-LocalGroupMember -Group "Remote Desktop Users"
Review effective privileges
Understand the privileges and security groups attached to the current session.
whoami /priv
whoami /groups
Domain review
Inspect privileged identities and stale access
These checks apply when the server is domain-joined and the ActiveDirectory PowerShell module is available.
Domain users
Review domain identities, enabled state, recent activity, and password metadata when the ActiveDirectory module is available.
Get-ADUser -Filter * -Properties Enabled,LastLogonDate,PasswordLastSet
Privileged domain groups
Identify members of highly privileged groups and compare them with the mission briefing.
Get-ADGroupMember "Domain Admins"
Get-ADGroupMember "Enterprise Admins" -ErrorAction SilentlyContinue
Get-ADGroupMember "Administrators" -ErrorAction SilentlyContinue
Inspect one account
Practice reviewing one approved administrative identity in detail.
Get-ADUser "DistrictOps" -Properties * | Select SamAccountName,Enabled,LastLogonDate,PasswordLastSet,MemberOf
Search stale or inactive accounts
Identify accounts that deserve review without assuming inactivity alone justifies deletion.
Search-ADAccount -AccountInactive -TimeSpan 30.00:00:00 -UsersOnly
Search-ADAccount -AccountDisabled -UsersOnly
Authentication evidence
Use event logs to reconstruct privilege changes
Account state tells you what exists now. Event logs can help explain when privilege was created or used.
Successful logons
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4624} -MaxEvents 40Review successful authentication activity, logon type, account name, source information, and timing.
Failed logons
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4625} -MaxEvents 40Look for repeated failures, unexpected accounts, or suspicious source patterns that need context.
Special privileges assigned
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4672} -MaxEvents 40Identify logons that received special administrative privileges.
User created
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4720} -MaxEvents 40Review account creation events and correlate who created the account and when.
User enabled
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4722} -MaxEvents 40Check when disabled identities were re-enabled and by whom.
User disabled
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4725} -MaxEvents 40Review account disablement events before assuming an account should remain disabled.
Local group membership added
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4732} -MaxEvents 40Review additions to local security groups such as Administrators or Remote Desktop Users.
Domain global group membership added
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4728} -MaxEvents 40Review additions to domain global groups when relevant auditing is available.
Remote access
Review who can reach the server interactively
Remote Desktop may be valid for administrators, but broad access creates unnecessary exposure.
Remote Desktop service
Confirm whether the service is running and whether the server is listening on the default RDP port.
Get-Service -Name "TermService"
Get-NetTCPConnection -LocalPort 3389 -ErrorAction SilentlyContinue
Remote Desktop firewall rules
Check whether RDP is permitted through the firewall and on which profiles.
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Select DisplayName,Enabled,Profile,Direction,Action
Remote Desktop users
Identify which local or domain identities are granted remote sign-in access.
Get-LocalGroupMember -Group "Remote Desktop Users"
Recent RDP-related sessions
Review current or recent interactive sessions before changing remote-access configuration.
quser
qwinsta
Fictional evidence set
Correlate identity, privilege, authentication, and remote access
Administrator, DISTRICT\Domain Admins, DISTRICT\DistrictOps, and DISTRICT\Avery are members of the local Administrators group.
Investigation prompt
Which memberships are explicitly approved, and which one conflicts with the mission unless additional evidence supports it?
The Domain Admins group contains Administrator, DistrictOps, and a user named LabTemp.
Investigation prompt
Which account needs immediate review, and what evidence would you collect before removing membership?
A 4720 event shows LabTemp was created two days ago by DistrictOps.
Investigation prompt
What does this prove, and what still needs to be established about why the account exists?
A group-change event shows LabTemp was added to Domain Admins approximately ten minutes after creation.
Investigation prompt
How does this change the risk priority of the account?
A 4624 event shows Avery logged on interactively to the server late at night using an account that is not approved for administration.
Investigation prompt
Why is the logon type and account privilege important before drawing a conclusion?
A 4672 event appears immediately after Avery's logon.
Investigation prompt
How does this evidence strengthen the conclusion that Avery had elevated rights during that session?
TCP 3389 is listening, Remote Desktop firewall rules are enabled, and Avery is a member of Remote Desktop Users.
Investigation prompt
Does the mission allow ordinary staff remote access, and what should be changed if the evidence confirms Avery does not need it?
Multiple 4625 events reference a disabled account named FormerAdmin from several hours earlier.
Investigation prompt
What should you verify before deleting the account or assuming the failed attempts are malicious?
Evidence model
Build a complete identity picture
Identity
Does the account exist, is it enabled, and is it approved by the mission?
Privilege
Which local or domain groups grant administrative or remote-access rights?
Authentication
Has the account logged on successfully or failed repeatedly, and what logon type was used?
Administrative activity
Was the account recently created, enabled, or added to a privileged group?
Remote access
Can the account use RDP, and is that ability required by the server role?
Verification
After remediation, do approved administrators still have access while unjustified privilege is removed?
Preserve first
Identity changes can destroy context
Record account name, SID, enabled state, and domain/local scope.
Record current membership in Administrators, Domain Admins, and Remote Desktop Users.
Record relevant event IDs, timestamps, subject account, target account, and source information.
Record the current RDP service and firewall-rule state.
Record active RDP sessions before disconnecting users or changing access.
Document whether the account is referenced by services, scheduled tasks, scripts, or application configuration.
Prefer disabling or removing privilege before deleting an identity when evidence preservation matters.
Record the exact remediation command and the post-change verification result.
Authorized remediation examples
Reduce privilege without breaking approved administration
Use these only in the fictional authorized practice environment after the evidence clearly supports the action.
Remove unjustified local administrator membership
Use only after confirming Avery is not supposed to administer the server and the account is not needed by a service or task.
Remove-LocalGroupMember -Group "Administrators" -Member "DISTRICT\Avery"
Remove unnecessary RDP access
Use when the mission confirms that ordinary staff do not require Remote Desktop access.
Remove-LocalGroupMember -Group "Remote Desktop Users" -Member "DISTRICT\Avery"
Disable a suspicious temporary domain account
Prefer disabling before deletion when you need to preserve the identity and its event history for review.
Disable-ADAccount -Identity "LabTemp"
Remove unjustified Domain Admin membership
Use only when the mission and evidence clearly show the account should not retain domain-wide administrative privilege.
Remove-ADGroupMember -Identity "Domain Admins" -Members "LabTemp" -Confirm:$false
Verification
Confirm approved admins still have access
Local administrators
Only approved local or domain identities retain server-level administrative rights.
Get-LocalGroupMember -Group "Administrators"
Domain privilege
Highly privileged domain groups contain only mission-approved members.
Get-ADGroupMember "Domain Admins"
Remote access
Remote Desktop remains available only to approved administrators if the server role requires it.
Get-LocalGroupMember -Group "Remote Desktop Users"
Get-Service -Name "TermService"
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Select DisplayName,Enabled,Action
Authentication
Recent authentication evidence does not show continued unjustified privileged use.
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4624,4625,4672} -MaxEvents 30Account state
Suspicious or unapproved accounts reflect the intended enabled/disabled state after remediation.
Get-ADUser "LabTemp" -Properties Enabled,MemberOf
Get-LocalUser
Core protection
Firewall and Defender remain enabled after identity remediation.
Get-NetFirewallProfile
Get-MpComputerStatus
Reflection
Debrief the privilege decisions
Why is privileged-group membership stronger evidence than an account name alone?
Why should a temporary account usually be disabled before deletion when an investigation is still active?
How do 4624 and 4672 events complement each other when reviewing a privileged logon?
Why is a newly created account followed quickly by Domain Admin membership a high-priority finding?
Why should you check services, scheduled tasks, and scripts before disabling an administrative account?
What is the difference between being a local Administrator and being a Domain Admin?
Why does Remote Desktop membership matter even if the firewall currently blocks RDP?
Which identity finding in this lab required the strongest correlation before a safe decision could be made?
Completion checklist
Finish only when access matches the mission
I determined whether the server is domain-joined and recorded the current identity context.
I reviewed local users and local Administrators membership.
I reviewed privileged domain groups where available.
I correlated account creation and group-change events with logon evidence.
I reviewed Remote Desktop users, service state, firewall rules, and current sessions.
I checked whether suspicious identities are referenced by services or scheduled tasks before changing them.
I preserved event and identity evidence before remediation.
I made only mission-supported privilege changes.
I verified approved administrators still retained access.
I confirmed Defender and Windows Firewall remained enabled.