Back to Windows 11CyberPatriot Hub
← Previous Lesson

Windows 11 · Lesson 16

Windows 11 Final Review Checklist

Bring the entire Windows 11 pathway together with a final review of identity, protection, system health, access, evidence, and functional verification.

A strong final state is not the one with the most settings changed. It is the one you can explain, verify, and defend without breaking what the scenario requires.

Final Review Snapshot

Security domains6
Final verification areas10
Primary ruleScenario wins
GoalSecure + functional

Final principle

Secure is not enough if the system no longer works

Final review must prove both sides: unnecessary exposure was reduced and every required Windows function still works.

Final-round warning

Do not create a new emergency at the end

The last review is not the time for untested bulk scripts, large upgrades, sweeping ownership changes, or speculative cleanup.

Prefer verification and targeted correction over new broad changes.

Final-review domains

Review Windows by what each control protects

Identity

Users, administrators, account state, password policy, lockout, local groups, and remote-access authorization.

01

Authorized users match the scenario.

02

Unauthorized accounts are disabled or removed only after evidence is preserved.

03

Administrators are limited to users who truly require privilege.

04

Remote Desktop Users contains only required remote users.

05

Password and account policies are configured intentionally.

06

Built-in and special accounts have been reviewed rather than changed blindly.

Protection

Microsoft Defender Antivirus, firewall profiles, firewall rules, exclusions, security intelligence, and required network exposure.

01

Defender is healthy and expected protections are active.

02

Security intelligence is reasonably current.

03

Broad or unexplained exclusions have been investigated.

04

Domain, Private, and Public firewall profiles are reviewed.

05

Required inbound rules remain available.

06

Firewall exposure is no broader than the scenario requires.

System

Windows Update, services, startup programs, installed software, scheduled tasks, and operating-system health.

01

Important security and quality updates were evaluated.

02

Restart requirements are understood.

03

Required services are available.

04

Unnecessary automatic execution has been reduced carefully.

05

Installed software has been classified and reviewed.

06

Scheduled tasks have been checked for required, unnecessary, misconfigured, or unknown behavior.

Access

File permissions, shares, RDP, service access, local rights, and least privilege.

01

NTFS permissions match role and scenario need.

02

Share permissions are not broader than required.

03

Ownership and inheritance were reviewed before high-impact changes.

04

RDP is available only if required.

05

Remote users, user rights, services, firewall, and network scope align.

06

Required applications and service accounts retain the access they need.

Evidence

Event logs, Defender history, task history, account evidence, service paths, file metadata, and team notes.

01

Relevant forensic evidence was preserved before remediation.

02

Logs were not cleared.

03

Important observations are separated from conclusions.

04

Timelines use supported timestamps and multiple sources where possible.

05

Team-generated changes are documented separately.

06

Unresolved questions are recorded instead of guessed.

Verification

Proving that Windows remains secure, functional, reachable, and consistent after changes.

01

Authorized administrator access still works.

02

Networking still works.

03

Required RDP and shares still work.

04

Defender and firewall remain healthy.

05

Required services and applications still function.

06

No new critical errors appeared after high-impact changes.

Fast final sweep

Twelve checks before you go deeper

01

Re-read the scenario requirements before the final sweep.

02

Confirm every required service and application is still available.

03

Confirm the correct local administrators.

04

Confirm no obvious unauthorized local accounts remain active.

05

Confirm Defender status and exclusions.

06

Confirm firewall profiles are enabled as expected.

07

Confirm Windows Update has no obvious unresolved high-priority issue.

08

Confirm required RDP and file shares still work.

09

Confirm no required service was disabled accidentally.

10

Confirm no unnecessary startup program or suspicious scheduled task was missed.

11

Review recent event logs for errors caused by your own changes.

12

Re-check forensic questions and evidence notes.

Identity review

Make sure privilege matches authorization

Users

Does every enabled local user have a clear scenario purpose?

Are disabled accounts intentionally disabled?

Was evidence preserved for any suspicious account before remediation?

Administrators

Does every administrator truly require administrative privilege?

Did anyone get added to Administrators just to make another feature work?

Can remote users use required functionality without unnecessary elevation?

Groups

Are Remote Desktop Users, Users, Administrators, and other important groups reviewed?

Does group membership explain any unexpected file or service access?

Are unfamiliar groups investigated before removal?

Account policy

Are password settings intentional and scenario-aware?

Is account lockout configured without creating avoidable denial-of-service risk?

Were one-size-fits-all values avoided when the scenario gave different requirements?

Protection review

Confirm the defensive layers are still active

Defender

Is real-time protection healthy?

Are security intelligence updates reasonably current?

Were suspicious exclusions investigated?

Was Protection History preserved when relevant to forensics?

Firewall

Are all needed profiles enabled?

Are inbound allow rules tied to required services?

Is RDP or file-sharing exposure limited to the needed profile and network where practical?

Were required connections tested after narrowing rules?

Required security functions

Were security services left available?

Did troubleshooting avoid globally disabling Defender or the firewall?

Did any third-party security product change the expected Windows configuration?

System review

Check the parts most likely to break after hardening

Updates

Were security updates evaluated?

Were optional drivers and major feature updates treated cautiously?

Was restart timing coordinated with the team?

Was the system verified after servicing?

Services

Does every changed service have a documented reason?

Were dependencies checked before disabling services?

Are required networking, security, RDP, sharing, and application services healthy?

Startup

Are unnecessary startup applications disabled where appropriate?

Were unknown startup entries investigated by path, publisher, and user scope?

Was software removed only when the application itself was unnecessary?

Installed software

Is required software still installed?

Were remote-access tools, unsupported software, and unnecessary applications reviewed?

Were leftovers such as services or startup entries checked after uninstall?

Scheduled tasks

Were logon, startup, high-privilege, and unusual-path tasks reviewed?

Were suspicious task properties preserved before disabling or removing them?

Do required Windows and application tasks still run?

Access review

Confirm who can reach what

NTFS permissions

Do Read, Modify, and Full control match actual job need?

Was inheritance reviewed before editing child objects?

Were SYSTEM, service accounts, and application dependencies preserved?

Shares

Are share permissions no broader than required?

Do NTFS and share permissions combine to produce the intended effective access?

Can authorized users still reach the share remotely?

Remote Desktop

Is RDP enabled only if required?

Are only required users authorized?

Is NLA enabled when appropriate?

Does firewall scope match the expected source network?

Was end-to-end RDP access tested?

Evidence review

Confirm the investigation survived the cleanup

Logs

Were relevant Security, System, Application, and operational logs reviewed?

Were logs preserved rather than cleared?

Were event provider, event ID, time, user, and message recorded for important findings?

Artifacts

Were task, service, account, software, and Defender artifacts documented before remediation?

Were file paths and timestamps captured where relevant?

Were suspicious items correlated with a second evidence source when possible?

Team notes

Can another teammate explain what changed and why?

Are confirmed facts separated from hypotheses?

Are unresolved questions visible rather than hidden?

Verification matrix

Prove the final system state

Identity

Sign in with the authorized administrator and confirm intended standard users still function.

Network

Confirm basic network connectivity and any scenario-required internal communication.

RDP

If required, connect from the authorized path with the intended user.

File sharing

Test required share access with one authorized and one unauthorized account when practical.

Defender

Confirm protection state remains healthy and no required application was broken by exclusions or remediation.

Firewall

Confirm profiles and required rules remain in the intended final state.

Services

Check required services and any service changed during hardening.

Applications

Launch required applications and confirm important workflows still work.

Scheduled tasks

Confirm required tasks remain enabled and suspicious disabled tasks stay disabled.

Event logs

Review recent System/Application events for new errors caused by the final changes.

Stop conditions

Five reasons not to click yet

You do not understand the dependency

Stop before disabling a service, task, account, firewall rule, share, or application if you cannot explain what depends on it.

You may destroy forensic evidence

Preserve logs, task properties, Defender history, account evidence, or file metadata before remediation.

You are about to make a broad change

Re-check scope before using bulk commands, wildcards, global firewall changes, ownership resets, or large policy changes.

You cannot verify afterward

If the team has no way to test the result, delay the change until verification is possible unless the risk clearly demands immediate action.

The scenario contradicts your checklist

Scenario requirements win. Do not break a required service because a generic checklist normally recommends disabling it.

Final decision cases

What a final reviewer should do

Everything looks hardened, but RDP fails

The team completed most checklist items, but the authorized administrator can no longer connect remotely.

The final state is not acceptable because a required function is broken.

Response

Trace the RDP chain: account, group, user rights, service, firewall profile/rule, remote scope, and network path. Restore the narrowest working authorized configuration.

Unknown service remains

One automatic service still has an unfamiliar name and path, but its purpose is not yet confirmed.

The final sweep should not force a destructive answer just to make the checklist look complete.

Response

Document it as Investigate, preserve the evidence, and avoid disabling it unless stronger evidence justifies the change.

Broad share access is still present

A required project share works, but share permissions still allow a larger group than the scenario needs.

Functionality is correct, but least privilege is incomplete.

Response

Reduce the share to the required audience, verify NTFS and share permissions together, and test authorized remote access.

Feature update is pending near the end

Windows offers a large feature update with little competition time remaining.

The change is high-impact and difficult to verify fully before the round ends.

Response

Do not treat it like a routine security patch. Defer unless the scenario gives a strong reason and there is enough time for complete verification.

Fictional final-review lab

Complete a full Windows 11 final sweep

Step 01

Re-read the fictional scenario

Morgan is the only administrator. Avery and Riley are standard users. RDP is required for Morgan, a project share is required for Avery and Riley, Defender and firewall must remain active, and one forensic question asks about an unknown task.

Step 02

Run the identity and protection sweep

Confirm users, groups, password policy, Defender, exclusions, firewall profiles, and the required RDP rule.

Step 03

Run the system and access sweep

Confirm services, updates, installed software, startup items, scheduled tasks, permissions, share access, and RDP dependencies.

Step 04

Review evidence

Confirm the unknown task evidence is preserved and the timeline is documented before final remediation.

Step 05

Verify required functions

Test Morgan's RDP, Avery's and Riley's project access, Defender health, firewall state, networking, and required applications.

Step 06

Record the final state

Document remaining Investigate items, any deferred update, all major changes, and the results of final verification.

Last ten minutes

Shift from changing to proving

01

Do not begin a major feature update or broad configuration rewrite.

02

Do not run a new bulk hardening script that has not already been tested.

03

Do not delete suspicious evidence that has not been documented.

04

Re-test required RDP, shares, and critical applications.

05

Confirm Defender and firewall are still active.

06

Confirm the authorized administrator still has access.

07

Review recent errors caused by your own changes.

08

Review unresolved Investigate items and decide whether they are safe to leave documented.

09

Make sure team notes explain every high-impact change.

10

Stop changing settings once the final state is secure, functional, and verified.

Reflection

Test your final-review reasoning

Question 1

Why is the final review organized by security domain instead of one universal checklist order?

Question 2

Why can a system be more hardened but still be in a worse competition state?

Question 3

What should make you stop before changing a service, task, account, or permission?

Question 4

Why should the last part of a competition focus more on verification than on new large changes?

Question 5

What is the difference between an unresolved Investigate item and an ignored problem?

Question 6

What does a complete Windows 11 final state need to prove?

Master checklist

Windows 11 final review

01

Scenario reread completed.

02

Authorized users reviewed.

03

Administrators reviewed.

04

Password and lockout policy reviewed.

05

Local Security Policy reviewed where relevant.

06

Defender health and exclusions reviewed.

07

Firewall profiles and required rules reviewed.

08

Windows Update state reviewed.

09

Required services verified.

10

Startup programs reviewed.

11

Installed software reviewed.

12

NTFS and share permissions reviewed.

13

RDP state, users, rights, service, and firewall verified if required.

14

Scheduled tasks reviewed.

15

Event logs reviewed for important findings and new errors.

16

Forensic evidence preserved before remediation.

17

PowerShell or command-line changes re-queried and verified.

18

Required applications tested.

19

Networking tested.

20

RDP/share access tested.

21

High-impact changes documented.

22

Unresolved Investigate items documented.

23

No unnecessary broad changes remain pending.

24

Final system state is both secure and functional.

Windows 11 pathway complete

You now have the complete Windows 11 defensive workflow

The next step is to connect all sixteen lessons with Previous and Next navigation, make the Windows 11 hub cards live, and complete a continuous browser review before the section is build-tested and committed.

Back to Windows 11CyberPatriot Hub
← Previous Lesson