Practice Lab · 03 · Windows Server
Windows Server Roles & Shares
Investigate installed server roles, SMB shares, permissions, active sessions, services, firewall rules, and event evidence while preserving the file-sharing function the fictional organization depends on.
This lab emphasizes availability. A server can be more secure after a change and still fail the mission if required services stop working.
Lab Snapshot
Mission briefing
Keep the fictional media file server available
This fictional Windows Server system supports a small school media department and must remain available to approved staff.
The server provides shared project storage through SMB and must continue serving the approved MediaProjects share.
The server is not intended to provide Remote Desktop access for ordinary users.
The approved local administrators are the built-in Administrator account and the fictional IT support account HelpDeskAdmin.
Microsoft Defender and Windows Firewall must remain enabled.
The File Server role is required and must not be removed.
Any unnecessary server role, share, service, or listener should be investigated before remediation.
Changes must preserve required file access and should be verified after each significant action.
Availability rule
Required roles are part of the security boundary
Do not remove a role, stop a service, or change a share until you understand what depends on it. Protecting confidentiality and integrity does not justify breaking required availability.
Role inventory
Understand what the server is built to do
Begin with operating-system context, installed roles, required features, and listening services.
Installed roles and features
Identify installed server roles and features before deciding what is required or unnecessary.
Get-WindowsFeature | Where-Object Installed
Get-WindowsFeature
File Server role state
Confirm that the required File Server capability is installed and review core SMB server settings.
Get-WindowsFeature -Name "FS-FileServer"
Get-SmbServerConfiguration
Server identity and edition
Record the server name, operating system, and domain/workgroup context before making changes.
hostname
Get-ComputerInfo | Select WindowsProductName,WindowsVersion,OsName,OsVersion,CsDomain,CsName
Listening services by role
Relate installed roles and services to the network ports actually exposed by the server.
Get-NetTCPConnection -State Listen
netstat -ano
Share review
Inspect both SMB and NTFS access
Remote file access is affected by both share-level permissions and file-system permissions. Review both before deciding that access is too broad or too restrictive.
List SMB shares
Identify all published shares, including administrative shares and custom project shares.
Get-SmbShare
net share
Review share permissions
Review share-level permissions for the required fictional project share.
Get-SmbShareAccess -Name "MediaProjects"
Review NTFS permissions
Compare file-system permissions with share permissions before changing either one.
Get-Acl "C:\Shares\MediaProjects" | Format-List
icacls "C:\Shares\MediaProjects"
Review active SMB usage
Understand whether approved users currently depend on the share before changing access or restarting services.
Get-SmbSession
Get-SmbOpenFile
Service review
Map service state to server function
The Server service, remote-access services, and recently installed services should be understood in context rather than judged only by name.
Core service inventory
Record service state, startup mode, service account, and executable path.
Get-Service
Get-CimInstance Win32_Service | Select Name,State,StartMode,StartName,PathName
SMB server service
Understand the service that supports SMB file sharing and its dependencies before making changes.
Get-Service -Name "LanmanServer"
Get-Service -Name "LanmanServer" -RequiredServices
Get-Service -Name "LanmanServer" -DependentServices
Remote Desktop service
Check whether Remote Desktop is active and whether the server is listening on the default RDP port.
Get-Service -Name "TermService"
Get-NetTCPConnection -LocalPort 3389 -ErrorAction SilentlyContinue
Service to process mapping
Correlate service configuration with the process that is actually running.
tasklist /svc
Get-CimInstance Win32_Process | Select ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine
Firewall review
Permit required services without broad exposure
Firewall profiles
Confirm that Domain, Private, and Public profiles remain enabled.
Get-NetFirewallProfile
Enabled inbound rules
Review what inbound traffic is explicitly permitted.
Get-NetFirewallRule -Direction Inbound -Enabled True | Select DisplayName,Profile,Action
SMB-related rules
Verify that firewall policy supports the required file-sharing role without broadly opening unrelated access.
Get-NetFirewallRule -DisplayGroup "File and Printer Sharing" | Select DisplayName,Enabled,Profile,Direction,Action
Remote Desktop rules
Check whether firewall rules expose RDP even though ordinary remote access is not required.
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Select DisplayName,Enabled,Profile,Direction,Action
Event evidence
Correlate configuration with recent activity
Successful logons
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4624} -MaxEvents 25Review recent authentication activity and compare accounts with the mission briefing.
Failed logons
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4625} -MaxEvents 25Look for repeated failures, unexpected accounts, or timing that deserves correlation.
Share access events
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=5140} -MaxEvents 25When auditing is available, review network share access and correlate it with approved users and expected shares.
Service installation
Get-WinEvent -FilterHashtable @{LogName="System"; Id=7045} -MaxEvents 25Look for recently installed services and compare the service path and account with expected software.
Fictional evidence set
Decide what needs evidence, action, or protection
File and Storage Services is installed. Web Server (IIS) is also installed even though the mission briefing does not mention a web application.
Investigation prompt
What evidence should you collect before deciding whether IIS is unnecessary?
MediaProjects points to C:\Shares\MediaProjects. A second custom share named Transfer points to C:\Temp\Transfer.
Investigation prompt
Which share is clearly required, and what questions should you ask before removing or restricting Transfer?
MediaProjects grants Change access to the approved group MediaEditors and Full access to Administrators.
Investigation prompt
Does this immediately indicate a problem, or do you need NTFS permissions and business context too?
C:\Shares\MediaProjects grants Modify to MediaEditors and Full Control to Administrators and SYSTEM.
Investigation prompt
How do the share and NTFS permissions combine when an approved user connects over SMB?
Two MediaEditors currently have files open on MediaProjects.
Investigation prompt
Why does this evidence matter before restarting LanmanServer or changing the share?
TermService is running and TCP 3389 is listening. Remote Desktop firewall rules are enabled.
Investigation prompt
How does the mission briefing affect the priority of this finding?
A 7045 event shows a service named TransferSync installed four days ago from C:\ProgramData\TransferSync\syncsvc.exe.
Investigation prompt
What additional evidence would help determine whether this is approved software or an unnecessary service?
Several 4625 events reference a local account named tempadmin that is not listed in the mission briefing.
Investigation prompt
What should you verify about the account before disabling or deleting it?
Decision checkpoint
Protect required function while reducing unnecessary exposure
Which server role is explicitly required by the mission briefing?
Which installed role appears unnecessary but still needs validation before removal?
Which share currently has active users and therefore deserves extra caution?
Which service directly supports SMB and should not be stopped casually?
Which remote-access finding conflicts with the stated server role?
Which service-installation event should be correlated with file path, publisher, process, and network evidence?
Preserve first
Record dependency and usage before disruption
Record the installed roles and features before removing anything.
Record all custom SMB shares and their paths.
Record both share permissions and NTFS permissions.
Record active SMB sessions and open files before restarting services.
Record firewall profile state and relevant inbound rules.
Record service name, startup type, service account, path, and dependencies.
Record relevant event IDs, timestamps, usernames, and source systems.
Record process IDs and listening ports tied to services under investigation.
Authorized remediation examples
Use narrow changes only when evidence supports them
These are defensive examples for an authorized practice server. They are not instructions for changing an unknown production system.
Remove an unjustified local administrator
Use only after confirming that the account exists, is not approved, and is not required by the scenario.
Remove-LocalGroupMember -Group "Administrators" -Member "tempadmin"
Disable an unapproved local account
Prefer disabling before deletion when preserving evidence or rollback capability is valuable.
Disable-LocalUser -Name "tempadmin"
Review a custom SMB share before removal
Collect path, description, permissions, active sessions, and business context before removing a share.
Get-SmbShare -Name "Transfer" | Format-List *
Inspect a service file hash
Preserve file identity before stopping, disabling, or removing a suspicious service.
Get-FileHash "C:\ProgramData\TransferSync\syncsvc.exe" -Algorithm SHA256
Verification
Prove the server still fulfills its mission
Roles
The required File Server role remains installed and any justified role change is reflected correctly.
Get-WindowsFeature | Where-Object Installed
SMB
MediaProjects still exists, permissions match the scenario, and approved users can continue accessing required files.
Get-SmbShare
Get-SmbShareAccess -Name "MediaProjects"
Get-SmbSession
Services
Required file-sharing services remain functional and remote-access state matches the mission.
Get-Service -Name "LanmanServer"
Get-Service -Name "TermService"
Firewall
Firewall protection remains enabled and required SMB traffic is still supported.
Get-NetFirewallProfile
Get-NetFirewallRule -DisplayGroup "File and Printer Sharing" | Select DisplayName,Enabled,Action
Network
Expected server listeners remain available and unnecessary exposure is re-checked after remediation.
Get-NetTCPConnection -State Listen
netstat -ano
Security
Defender protection remains enabled after server-role or service changes.
Get-MpComputerStatus
Reflection
Debrief the availability decisions
Why is an installed server role not automatically unnecessary just because it is absent from the mission briefing?
Why should you inspect both share permissions and NTFS permissions?
Why are active SMB sessions important before restarting the Server service or changing a share?
Why is a running Remote Desktop service more important when the mission specifically says ordinary remote access is not required?
Why is a 7045 event useful when investigating a recently installed service?
Why should a suspicious service executable be hashed before removal?
What is the danger of disabling a service without checking dependencies?
Which finding in this lab required the strongest balance between security and availability?
Completion checklist
Finish only when the required file service still works
I recorded the server identity, edition, and role context.
I identified installed roles and confirmed the required File Server role.
I reviewed custom SMB shares and their paths.
I compared share permissions with NTFS permissions.
I checked active SMB sessions before considering disruptive changes.
I reviewed firewall rules for required SMB traffic and unnecessary remote access.
I correlated services with process, file-path, event-log, and network evidence.
I made only narrow, mission-supported changes.
I verified that MediaProjects remained accessible after remediation.
I confirmed Defender and Windows Firewall remained enabled.