Scenario requirements
Identify authorized users, authorized administrators, required software, required services, remote-access needs, restrictions, and forensic questions before broad hardening begins.
Windows 11 · Lesson 01
Windows 11 Competition Workflow
Turn the overall competition strategy into a practical Windows 11 workflow: understand the image, establish a baseline, prioritize evidence, make controlled changes, and verify the final state.
This lesson is the map for the rest of the Windows section. It does not try to teach every Windows setting at once. Instead, it shows where each security area fits into a disciplined competition process.
Lesson Snapshot
First-look areas6
Baseline areas8
Task categories5
Main goalControlled Windows defense
Learning objectives
What this workflow should help you do
01
Translate the overall CyberPatriot strategy into a Windows 11-specific competition workflow.
02
Build a useful Windows baseline before making broad security changes.
03
Separate obvious high-confidence fixes from findings that need investigation or coordination.
04
Protect required Windows users, services, applications, remote access, and forensic evidence.
05
Use Windows tools to verify changes instead of assuming a saved setting worked.
06
Finish the image with a controlled review of identity, protection, services, access, evidence, and functionality.
Core idea
Do not treat Windows as a list of settings
A competition image is a functioning system with users, services, applications, access paths, evidence, and dependencies. The goal is to improve security while keeping the required mission intact.
Windows risk
Small settings can have large side effects
Group membership, firewall rules, services, user rights, and permissions can affect the whole system. Windows rewards teams that understand the impact before they click Apply.
If you cannot explain what a change affects or how you will test it afterward, gather more evidence before making a high-impact change.
First look
Six things to understand before broad hardening
Identity
Review local users, administrator membership, groups, disabled accounts, guest access, and anything that conflicts with the scenario.
Protection
Check Microsoft Defender, Windows Defender Firewall, update status, security policy, and obvious warnings or disabled protections.
System
Review important services, startup programs, scheduled tasks, installed software, and required Windows features.
Access
Understand permissions, shared folders, remote access, user rights, and network exposure before changing them.
Evidence
Read forensic questions early and protect logs, files, accounts, tasks, processes, and timestamps that may be needed later.
Windows baseline
Know the current state before changing it
A baseline does not mean documenting every setting. Capture enough information to understand the image, identify obvious conflicts, and recognize when a later change causes a new problem.
Users & groups
Observe
Local accounts, Administrators membership, standard users, disabled accounts, guest access, and unusual group membership.
Why it matters
Identity mistakes are often high-value and can also affect access to every other part of the image.
Defender
Observe
Protection status, scan state, exclusions, history, and obvious disabled protection features.
Why it matters
Security tooling gives fast context about the current protection state and possible evidence.
Firewall
Observe
Active profiles, major allow rules, required remote-access paths, and unusually broad exposure.
Why it matters
Firewall changes can protect the image quickly, but they can also break required connectivity.
Updates
Observe
Pending updates, restart state, update history, and whether security patches appear significantly behind.
Why it matters
Patch posture matters, but update timing and restart impact must be managed carefully during competition work.
Services
Observe
Running and stopped services, required Windows roles, remote-management services, and unfamiliar entries.
Why it matters
A service may be risky, required, or both. Purpose and dependencies matter before disabling anything.
Software
Observe
Installed programs, remote-access tools, unsupported software, utilities, and applications named in the scenario.
Why it matters
Unwanted software can create risk, but legitimate competition-required applications should not be removed blindly.
Startup & tasks
Observe
Startup applications, scheduled tasks, triggers, commands, account context, and unfamiliar persistence.
Why it matters
Automatic execution can be legitimate maintenance or suspicious persistence and should be interpreted with evidence.
Logs & errors
Observe
Authentication events, service failures, application errors, Defender history, and other clues relevant to forensic questions.
Why it matters
Logs help explain what happened and can be damaged or lost by aggressive cleanup.
Prioritization
Put each Windows finding in the right task bucket
Do Now
Clear problem, strong evidence, manageable risk, and a result that can be verified quickly.
Windows example
A legitimate standard user is clearly listed as an administrator even though the scenario authorizes only one named administrator.
Investigate
Potentially important finding, but the team still needs more evidence before changing the image.
Windows example
An unfamiliar scheduled task runs at login, but its purpose and required application dependency are not yet known.
Coordinate
A change may affect remote access, networking, authentication, services, permissions, forensic evidence, or another teammate.
Windows example
Changing Windows Defender Firewall rules that protect a required RDP path.
Revisit
The task is blocked, low-confidence, or consuming too much time compared with the current value.
Windows example
An unclear event-log pattern needs more investigation while several high-confidence fixes are still available.
Done / Verify
The action is complete, but the team still needs to confirm the intended secure state and required functionality.
Windows example
An account privilege was corrected and now needs membership verification and a quick authorized-access check.
Before a major change
Eight questions to ask
01
What exactly is wrong right now?
02
What Windows evidence proves it?
03
What does the scenario require?
04
Is the affected user, service, application, or feature required?
05
What is the least disruptive fix?
06
Could this break remote access, authentication, permissions, or another service?
07
Could this alter forensic evidence?
08
How will I verify the result?
Windows tool map
Use the right administrative view for the question
Settings
Quick visibility into Windows Update, Defender, accounts, apps, networking, and common security configuration.
Computer Management
Local users and groups, services, shared folders, storage, Event Viewer access, and other administrative areas.
Local Security Policy
Account policies, user rights, auditing, and security options when the edition and environment provide it.
Windows Security
Microsoft Defender Antivirus, firewall status, protection history, and other Windows security controls.
Task Manager
Running processes, startup applications, resource use, and quick process context.
Task Scheduler
Scheduled triggers, actions, accounts, and persistence-related automation.
Event Viewer
Security, System, Application, service, and other logs for troubleshooting and forensic reasoning.
PowerShell
Efficient inspection, inventory, verification, and controlled administration when the command and impact are understood.
Identity
Users, groups, and privilege
01
Compare every local user with the scenario.
02
Separate authorized users from authorized administrators.
03
Review Administrators and other privileged groups.
04
Check Guest and other special accounts in context.
05
Avoid deleting a legitimate user just because their privilege is wrong.
06
Verify group membership after any identity change.
Protection
Defender, firewall, updates, and policy
01
Confirm Microsoft Defender is available and protection status is understood.
02
Review exclusions and history before removing anything that may matter as evidence.
03
Identify which firewall profile is active.
04
Review broad or unusual firewall rules in context.
05
Check Windows Update state and restart implications.
06
Review obvious security-policy weaknesses with scenario requirements in mind.
Services
Purpose and dependencies before disable
01
Identify services explicitly required by the scenario.
02
Understand dependencies before stopping a service.
03
Review startup type only after understanding purpose.
04
Look for unnecessary exposure rather than assuming every enabled service is bad.
05
Re-test the required function after any service change.
06
Document high-impact changes that could affect other teammates.
Access
Permissions, shares, and remote access
01
Review RDP or other remote-access requirements before changing them.
02
Check NTFS and share permissions for excessive access.
03
Preserve legitimate user workflows while applying least privilege.
04
Coordinate firewall and remote-access changes.
05
Verify authorized access from the perspective of the user or system that needs it.
Forensic protection
Windows hardening can change the evidence
Logs, accounts, scheduled tasks, startup entries, files, processes, Defender history, and timestamps may matter to forensic questions. Read the questions first so cleanup does not erase the answer.
01
Read all forensic questions early.
02
Identify which Windows logs or artifacts may answer them.
03
Record file paths, timestamps, usernames, task names, event IDs, or other supporting facts.
04
Separate fact, inference, unknown, and assumption.
05
Avoid clearing logs or deleting suspicious files before needed evidence is captured.
06
Re-check every forensic answer during final review.
Verification model
Five layers before a Windows task is complete
Configuration
Confirm the account, group, policy, service, firewall rule, permission, application, or setting now matches the intended state.
Security
Confirm the original exposure or weakness is actually reduced rather than merely moved somewhere else.
Functionality
Confirm authorized users, required services, applications, RDP, shares, and other required workflows still function.
Evidence
Confirm the change did not destroy information still needed for forensic questions or later troubleshooting.
Team
Record and communicate important results so teammates understand the current Windows state.
Fictional practice round
See the workflow applied to one Windows image
01 · Scenario
A fictional Windows 11 workstation must keep Remote Desktop available for one authorized administrator. Three other named users are legitimate standard users. A forensic question asks about recent failed sign-ins.
02 · Baseline
The team finds two standard users in Administrators, Defender enabled, one broad inbound firewall rule, pending updates, several startup items, and relevant Security log events.
03 · Prioritize
The administrator mismatches go to Do Now. The firewall rule goes to Coordinate because RDP is required. An unfamiliar startup item goes to Investigate. The forensic log review begins before cleanup.
04 · Harden
The team removes only the unnecessary administrator privilege, narrows the firewall exposure without disabling required RDP, and leaves the startup item unchanged until its purpose is confirmed.
05 · Verify
The users remain present, only the authorized administrator has elevated rights, RDP still works for the authorized path, Defender remains healthy, and the failed-sign-in evidence is preserved.
06 · Review
The scenario is re-read, high-impact Windows changes are re-tested, forensic answers are checked, unresolved tasks are reviewed, and the image is left in a known-good state.
Common mistakes
Windows habits that create avoidable problems
Starting with random settings
Without a scenario map and baseline, the team can waste time or break something that was required.
Deleting instead of correcting
A legitimate user with excessive privilege may need a group-membership correction, not account deletion.
Disabling unfamiliar services
Unknown does not mean unnecessary. Confirm purpose and dependencies first.
Broad firewall changes
A rule may look unsafe, but deleting it without understanding required traffic can break remote access or services.
Ignoring forensic questions until the end
Normal hardening actions can alter logs, files, accounts, tasks, and other evidence.
Treating a successful command as verification
The real test is whether the Windows state improved and required functionality still works.
Reflection
Test your Windows workflow reasoning
Question 1
Why should a Windows baseline be created before broad hardening begins?
Question 2
What makes an unfamiliar service an Investigate task instead of an automatic Do Now task?
Question 3
Why should a firewall change affecting RDP be coordinated?
Question 4
What is the difference between correcting privilege and deleting an account?
Question 5
Why are logs and startup artifacts relevant to both security and forensics?
Question 6
What does it mean to verify required functionality after a Windows change?
Windows final review
Before you consider the image finished
01
Re-read the Windows scenario and ReadMe.
02
Confirm every authorized user still exists.
03
Confirm administrator membership matches the scenario.
04
Confirm Microsoft Defender and firewall state.
05
Confirm required services, applications, and Windows features.
06
Confirm remote access and required network paths.
07
Review major permission changes.
08
Review scheduled tasks, startup items, and installed software findings.
09
Check update and restart state.
10
Review forensic answers and supporting evidence.
11
Review all Done / Verify tasks.
12
Review unresolved high-value tasks.
13
Avoid late changes that cannot be verified.
14
Finish in a known-good Windows state.
Next Windows lesson
Users, Groups & Administrators
Next, go deeper into local identities, Administrators membership, group decisions, disabled accounts, Guest, and scenario-authorized access.