3.1.2. Configure and apply basic Microsoft Windows OS security settings. (Obj. 2.2)

💡 First Principle: Leveraging built-in OS security features is the first line of defense in hardening a workstation.

Before you even think about third-party security software, you must master the powerful security tools built directly into the Windows operating system. Properly configuring these features creates a strong baseline of security for any workstation. The most critical areas are encryption and permissions.

Encryption is the process of scrambling data so it can only be read by someone with the correct key. Windows Pro and Enterprise editions offer two main types:

• BitLocker Drive Encryption: This provides full-disk encryption. It encrypts the entire Windows operating volume, protecting all files, including system files, temporary files, and user data. It's often paired with a TPM (Trusted Platform Module) chip on the motherboard, which securely stores the encryption keys. If a BitLocker-enabled laptop is stolen, the drive is nothing more than a paperweight to the thief; the data is completely inaccessible. In a domain, Group Policy sets BitLocker's rules centrally, including requiring each computer's recovery key to be backed up to Active Directory before encryption starts, so IT can always unlock a drive. From an elevated prompt, manage-bde -status reports the encryption state of every drive, and manage-bde -on C: turns encryption on.
• EFS (Encrypting File System): This provides file-level encryption. A user can right-click a specific file or folder on an NTFS-formatted drive and encrypt it. The encryption is tied to that user's account certificate. This is useful for protecting specific sensitive files on a shared computer, but BitLocker is the superior solution for overall device protection. Because the keys belong to the encrypting account, any other account (or the same user after their profile or certificate is lost) gets Access Denied when opening the file even though it is still listed, and File Explorer marks EFS-encrypted files with a small padlock overlay. Back up the EFS certificate and key (for example with cipher /x) to avoid locking data out.

Permissions control who can do what with files and folders. In Windows, you'll manage two sets:

• NTFS Permissions: These apply to users who are logged in locally to the machine. They are very granular, allowing you to set permissions like Read, Write, Modify, and Full Control for specific users and groups.
• Share Permissions: These apply to users accessing a folder over the network. They are simpler: Read, Change, and Full Control. When a folder is shared, the most restrictive permission wins. If a user has "Full Control" in NTFS permissions but only "Read" in Share permissions, they will only be able to read the files when accessing the folder over the network.

Windows Defender Firewall is Windows' built-in host-based firewall: it filters the network traffic entering and leaving this one PC according to its rules. It does not scan files for malware (that is Microsoft Defender Antivirus) and does not encrypt anything. It keeps a separate on/off setting for each network profile (Domain, Private, Public); from an elevated prompt, netsh advfirewall set allprofiles state on (or off) changes all three at once, and netsh advfirewall show allprofiles displays their state.

Other built-in Windows security settings:

• BitLocker To Go: BitLocker for removable drives (USB flash drives, external disks). The drive is unlocked with a password or smart card and can be read on other Windows computers. Use BitLocker for the fixed OS volume, BitLocker To Go for portable drives, and EFS for individual files that only one user account should open.
• User accounts and UAC: Standard User is for daily work. Administrator rights are needed for system-wide changes such as installing software, managing user accounts and changing security settings. Guest is disabled by default, and Power Users is a legacy group kept for backward compatibility. User Account Control (UAC) intercepts actions that need admin rights. An administrator gets a consent prompt; a standard user gets a prompt for an administrator's credentials. Working as a standard user and elevating only when needed ("Run as administrator") is least privilege in practice.
• Sign-in options: username and password, Windows Hello (PIN, fingerprint or facial recognition, enabling passwordless sign-in), and SSO with a Microsoft or work account. Requiring Ctrl+Alt+Del before sign-in (secure sign-in) guarantees the real Windows sign-in screen appears, because applications cannot intercept that key sequence.
• Firewall rule direction: a rule's direction is set by who starts the connection. Inbound rules govern connections other machines open to this PC (a service it offers). Outbound rules govern connections programs on this PC open to other systems. Replies to a connection belong to that connection, so they need no rule of their own. To create a rule: open Windows Defender Firewall with Advanced Security (wf.msc), select Inbound (or Outbound) Rules, click New Rule, choose the rule type (Program, Port, Predefined, Custom), specify the program or port, choose Allow or Block, select the profiles, then name the rule.
• Application control: AppLocker and App Control for Business (formerly Windows Defender Application Control) allow only approved applications to run. Restricting which programs may run is not what UAC (elevation) or the firewall (network traffic) does.
• Active Directory: joining a PC to a domain puts it under central management. Group Policy Objects (GPOs), linked to organizational units (OUs), push settings and security policies to domain-joined users and computers automatically. Security groups are used to assign permissions. In Active Directory Users and Computers, a user's Profile tab holds the logon script (runs automatically at every sign-in, for example to map drives or printers) and the home folder (a network path mapped to a drive letter at sign-in). Folder redirection, set through Group Policy, stores folders such as Documents on a server instead of the local disk.
• Cached credentials: Windows can sign a domain user in with cached credentials when a domain controller cannot be reached, so a successful local sign-in does not prove the domain account is healthy. A locked-out or expired domain account still cannot authenticate to network resources such as file shares.

Technician's Action Plan: Scenario: You are provisioning a new laptop for an executive who travels frequently. They will be storing sensitive company financial reports on it. You also need to create a shared folder on the network server for the finance team.

1. Harden the Laptop (BitLocker): The top priority is protecting the data on the laptop in case of loss or theft.
   • Ensure the laptop has Windows 11 Pro and a TPM chip.
   • Open the Control Panel and go to "BitLocker Drive Encryption".
   • Turn on BitLocker for the C: drive.
   • Crucially, save the recovery key to a secure location (e.g., the user's Microsoft account, a USB drive stored in a safe, or print it). Explain to the user that this key is their only way to access their data if something goes wrong with the TPM.
2. Create the Secure Network Share:
   • On the file server, create a new folder called "FinanceData".
   • Set NTFS Permissions: Right-click the folder -> Properties -> Security. Remove the default "Users" group. Add the "Finance Team" security group and grant it "Modify" permissions. Add the "Finance Managers" group and grant it "Full Control". This follows the principle of least privilege.
   • Set Share Permissions: Right-click the folder -> Properties -> Sharing -> Advanced Sharing. Share the folder. Click "Permissions". Remove "Everyone". Add the "Finance Team" group and grant it "Change" permission. Add "Finance Managers" and grant "Full Control".
3. Verify Access: Log in as a standard finance team member and confirm they can create and edit files in the share, but not change permissions. Log in as a finance manager and confirm they can do everything. Log in as someone from the Sales team and confirm they cannot access the share at all.

Reflection Question: Explain how the "most restrictive permission wins" rule applies when both NTFS and Share permissions are configured for a shared folder.