Understand
Read the scenario and identify authorized users, administrators, required software, required services, networking needs, and forensic questions.
CyberPatriot Training Hub
Windows 11
Learn how to review and harden a Windows 11 competition image with scenario awareness, evidence-based decisions, controlled changes, and verification.
This section focuses on defensive administration and authorized practice environments. It teaches the reasoning behind Windows security work rather than supplying answers to live competition images.
Windows 11 Scope
Lessons16
Workflow phases6
Training styleDefensive
OutcomeCompetition-ready workflow
Safety boundary
Train the skill, not the live answer
Examples and labs use fictional Windows systems and authorized practice scenarios. The section teaches defensive analysis, hardening, documentation, and verification without exposing current competition answers.
Main question
How do you secure Windows without breaking what the scenario requires?
The answer is not “change every setting.” Strong Windows work starts with context, finds evidence, chooses controlled changes, and verifies the result.
Windows workflow
Apply the six-phase strategy to Windows 11
Baseline
Capture the current Windows state before broad changes: users, privileges, security tools, firewall, updates, services, software, and obvious errors.
Prioritize
Separate clear high-confidence problems from findings that need investigation, coordination, or later review.
Harden
Make the least disruptive change that addresses the confirmed issue while preserving required Windows functionality.
Verify
Confirm both the security improvement and the continued operation of accounts, services, applications, and network functions.
Review
Re-check scenario requirements, risky changes, forensic answers, unresolved work, and the final known-good Windows state.
Complete pathway
Windows 11 Lessons
Lessons move from competition workflow and identity controls into Windows protection, services, access, administration, evidence, and final review.
Lesson 01Windows 11
Windows 11 Competition Workflow
Focus
Apply the Competition Strategy process specifically to a Windows 11 image: scenario review, baseline, prioritization, controlled changes, verification, and final review.
Defensive lab
Build a fictional Windows 11 image map and organize findings into Do Now, Investigate, Coordinate, Revisit, and Done / Verify.
Open Lesson →
Lesson 02Windows 11
Users, Groups & Administrators
Focus
Review local users, group membership, administrator rights, disabled accounts, guest access, and scenario-authorized identities.
Defensive lab
Compare a fictional user list with scenario requirements and identify the least-disruptive account corrections.
Open Lesson →
Lesson 03Windows 11
Password & Account Policies
Focus
Understand password length, complexity, history, lockout, expiration, and account-policy decisions without blindly forcing one configuration everywhere.
Defensive lab
Evaluate a fictional local account policy against a stated security requirement and required user workflow.
Open Lesson →
Lesson 04Windows 11
Local Security Policy
Focus
Use Local Security Policy to reason about account policies, user rights, security options, auditing, and privilege-sensitive configuration.
Defensive lab
Review a fictional policy snapshot and classify settings as confirmed issue, needs context, or already appropriate.
Open Lesson →
Lesson 05Windows 11
Microsoft Defender Antivirus
Focus
Review Defender status, protection features, scan posture, exclusions, history, and evidence without destroying forensic context.
Defensive lab
Analyze a fictional Defender status report and decide what should be verified, investigated, or changed.
Open Lesson →
Lesson 06Windows 11
Windows Defender Firewall
Focus
Understand profiles, inbound and outbound rules, allowed applications, service dependencies, and required network access.
Defensive lab
Harden a fictional firewall configuration while preserving a required remote-management path.
Open Lesson →
Lesson 07Windows 11
Windows Update & Patch Management
Focus
Review update state, restart implications, update history, security posture, and competition-time tradeoffs.
Defensive lab
Create an update decision plan for a fictional image with pending security updates and required uptime.
Open Lesson →
Lesson 08Windows 11
Services & Startup Programs
Focus
Review running services, startup applications, service purpose, dependencies, automatic startup, and unnecessary exposure.
Defensive lab
Classify fictional services and startup entries as required, suspicious, optional, or needing more evidence.
Open Lesson →
Lesson 09Windows 11
Installed Software & Unwanted Applications
Focus
Inventory installed programs, identify unsupported or unauthorized software, distinguish legitimate tools from risk, and plan safe removal.
Defensive lab
Review a fictional software inventory and build an evidence-based remediation list.
Open Lesson →
Lesson 10Windows 11
Files, Folders & Share Permissions
Focus
Understand NTFS permissions, ownership, inheritance, shared-folder exposure, least privilege, and required access.
Defensive lab
Correct a fictional shared-folder permission problem without blocking authorized users.
Open Lesson →
Lesson 11Windows 11
Remote Access & RDP
Focus
Review Remote Desktop and other remote-access requirements, authorization, firewall exposure, authentication, and service dependencies.
Defensive lab
Secure a fictional required RDP configuration while preserving authorized administrative access.
Open Lesson →
Lesson 12Windows 11
Task Scheduler & Persistence Review
Focus
Inspect scheduled tasks, startup behavior, triggers, actions, account context, and evidence before disabling unfamiliar automation.
Defensive lab
Investigate fictional scheduled tasks and separate legitimate maintenance from suspicious persistence.
Open Lesson →
Lesson 13Windows 11
Event Viewer & Windows Logs
Focus
Use Windows logs to understand authentication, services, system changes, errors, and forensic questions without treating every event as an incident.
Defensive lab
Trace a fictional timeline using Security, System, and Application events.
Open Lesson →
Lesson 14Windows 11
PowerShell for Defensive Administration
Focus
Use PowerShell for safe inspection, verification, inventory, and controlled defensive administration with clear before-and-after checks.
Defensive lab
Use a fictional command-output set to verify users, services, firewall state, software, and security posture.
Open Lesson →
Lesson 15Windows 11
Windows Forensics & Evidence Preservation
Focus
Protect Windows evidence such as logs, files, metadata, accounts, tasks, processes, and security history while answering forensic questions.
Defensive lab
Build an evidence map for a fictional Windows incident without altering the artifacts needed for investigation.
Open Lesson →
Lesson 16Windows 11
Windows 11 Final Review Checklist
Focus
Combine the Windows 11 section into one competition-ready review covering scenario requirements, users, policies, security controls, services, software, logs, and verification.
Defensive lab
Run a structured final review of a fictional Windows image and identify what is verified, unresolved, or too risky to change late.
Open Lesson →
Priority zone
Identity
Local users
Administrators
Groups
Guest access
Password and lockout policy
Priority zone
Protection
Microsoft Defender
Firewall profiles and rules
Updates
Security policy
Auditing and logs
Priority zone
System
Services
Startup programs
Scheduled tasks
Installed software
Remote access
Priority zone
Access
NTFS permissions
Shared folders
User rights
Remote management
Required applications
Fictional evidence preview
How Windows evidence changes the decision
These facts are fictional. The point is to practice connecting scenario requirements to system evidence before taking action.
Scenario
Only one named user is authorized as an administrator, while several other users must remain standard accounts.
System
Two additional legitimate users currently appear in the local Administrators group.
Required function
Remote Desktop must remain available for authorized administration.
Forensics
A question references recent authentication activity, so relevant event logs should be preserved before cleanup.
Windows principles
Four rules that apply across the section
Scenario before checklist
Windows hardening decisions must fit the actual image requirements. Generic security advice does not automatically override required functionality.
Evidence before action
Unfamiliar users, services, software, tasks, and processes are investigation targets until evidence supports a change.
Least disruptive change
Correct the confirmed problem without unnecessarily deleting accounts, disabling services, or blocking legitimate access.
Verify twice
Check that the security state improved and that the required Windows function still works afterward.
Start here
Lesson 01 — Windows 11 Competition Workflow
The first lesson will translate the Competition Strategy process directly into a Windows 11 image workflow before individual security areas are taught.