Day 2 Capstone

Windows Systems

This section contains questions about your Windows VM. In most cases, we expect you to use the PowerShell cmdlets and techniques from the labs to answer the questions. If you use other tools, you might want to validate the response with the equivalent PowerShell technique to ensure your answers are in the correct format.

Windows - Build Number

What is the value of the BuildNumber property reported by WMI for the Window OS installed on the Windows VM? Your answer will be a five-digit integer.

Windows - Caption

What is the value of the Caption property reported by WMI for the Window OS installed on the Windows VM? Your answer will be a series of 20 alphanumeric characters separated by hyphens.

Hints

Get-CimInstance can be used for WMI queries

WMI has a class named Win32_OperatingSystem with information about the installed OS

The resulting object has a property named Caption

Windows - Hotfix Date

What is the InstalledOn date for the KB5049622 Microsoft patch on the Windows VM? Your answer should include the full date+time string.

Hints

There is a cmdlet to get information about hotfixes.

It's called Get-Hotfix.

The InstalledOn property gives the date of installation.

Windows - Hotfixes

How many total hotfixes were installed on the same date as KB5049622? Your answer should be an integer.

Hints

There's a command to get hotfix information

The InstalledOn property shows the date the hotfixes were installed

Using group-object would allow you so group by the InstalledOn dates

Windows - Permissions

The C:\Windows\System32 directory on the Windows VM has a single access control entry which grants permission on the file to the ephemeral Creator Owner group. What is the numeric representation of that permission? Your answer will be an integer.

Hints

Windows file/folder permissions are stored in access control lists (ACLs)

Some ACLs are listed with names and some are numeric

Get-Acl is used to query ACLs.

Windows - Shares

What is the name of the Server Message Blocks (SMB) share on the Windows VM which is NOT associated with a filesystem? Your answer should include any special characters which are part of the name.

Hints

There is a command to get SMB share information

It's called Get-SmbShare

It has a property called path, which might be empty for some shares

Windows - Groups

How many local groups on the Windows VM have the student user as a member?

Hints

This can be done manually by listing the members of every group

Get-LocalGroup gives a list of groups

Get-LocalGroupMember lists the members

The older net user command can yield this information, also.

Windows - Registry

What is the numeric setting for the registry key which controls whether the Local Security Authority (LSA) on the Windows VM restricts anonymous enumeration of SAM accounts and shares? Your answer will be an integer.

Hints

This is covered by the CIS Benchmark for Windows 10 Enterprise

The registry key is under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

The registry is mapped as PSDrives in PowerShell

Get-ItemProperty can be used to query values in registry keys

Windows Domains

All of the questions in this section make use of the Windows domain controller running in your AWS lab range. You will need to connect with OpenVPN to access this system, just like you did in the labs for the Windows section.

As a reminder, here are the credentials and IP address of this VM:

Address: 10.55.7.100
Username: student
Password: Password1

General

What is the IP address of the Windows domain controller provided to you in the Lab and used in this challenge?

Hints

Have you read the directions for this section?

AD Users

Retrieve a list of all users in the domain using Get-ADUser. What is the SAMAccountName of the last user returned by the query?

Hints

Create a set of credentials to pass with $cred=Get-Credential

Remember to specify a server, since you are not a member of the domain

You must specify a filter of * to retrieve all users

Disabled Users

How many users in the domain are marked as disabled? (Your answer should be an integer)

Hints

Change the filter from '' to limit results using the 'Enabled' property*

Remember that false is specified as $false

-Filter 'Enabled -eq $False'

User Attributes

Only one user in the domain has the office property configured in Active Directory for their account. What is the SAMAccountName of that user?

Hints

Could you create a Get-ADUser filter to remove all users with nothing in the office attribute?

-like "*" would find only users with a value in an attribute.

The office attribute is named either “office” or “physicalDeliveryOfficeName”

Attribute Value

Only one user in the domain has the office property configured in Active Directory for their account. What is the value saved in the “office” attribute for that user?

Hints

Create a filter to return the correct user

Use the -Properties flag for Get-ADUser to return the correct AD attribute

The Select-Object command can be used to limit the number of properties returned

AD Groups

There is a group in the domain that has the word “audit” as part of the name. What is the fully qualified name of that group? (Your answer should start with “CN=” and end with “local” -- don’t include any surrounding quotations marks!)

Hints

Get-ADGroup is used for querying groups.

Groups have a “name” property you can filter on.

‘’ characters serve as wildcards in name filters.*

Domain Admins

How many users are Domain Administrators on the domain?

Hints

Get-ADGroupMember is a good command for this.

Remember that groups can be members of other groups. You’ll need to expand these nested groups recursively.

Measure-Object is a good command for counting results.

Password Settings

How many enabled users have passwords which are set to never expire?

Hints

There are users with non-expiring passwords whose accounts are disabled. Don't count them.

You'll need to search for accounts where Enabled -eq $true

Get-ADUser has a filter for "PasswordNeverExpires" as well