Beginner · Systems and cryptography · topic 12 of 43 · 35 min
Windows security basics
Explanation
Why Windows matters
In most companies, staff laptops and many servers run Windows. Many real attacks, especially ransomware, spread through Windows networks. A SOC analyst reads Windows logs every day.
Accounts and groups
- Local accounts live on one computer. The built-in Administrator account is powerful and is often disabled or renamed.
- Domain accounts live in Active Directory (AD), a central directory that companies use to manage users, computers and permissions. A server called a domain controller checks logins.
- Groups collect accounts. Members of the local Administrators group control that computer; members of Domain Admins control the whole domain, so that group must be tiny.
PS> Get-LocalGroupMember -Group "Administrators"
ObjectClass Name PrincipalSource
----------- ---- ---------------
User LAPTOP-7Q2\Admin Local
User LAPTOP-7Q2\ravi Local
Group CORP\Desktop-Admins ActiveDirectoryBuilt-in protections
| Feature | What it does |
|---|---|
| User Account Control (UAC) | Even admins run with normal rights until they approve a prompt to elevate |
| Microsoft Defender Antivirus | Built-in anti-malware with real-time protection |
| Windows Update | Security patches, released monthly on "Patch Tuesday" (second Tuesday) |
| BitLocker | Encrypts the whole disk, so a stolen laptop does not leak data |
| Windows Defender Firewall | Host firewall that filters network traffic |
| Group Policy | Pushes security settings to all domain computers at once |
| LAPS | Gives each computer a unique, rotating local admin password |
PS> Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated
AntivirusEnabled RealTimeProtectionEnabled AntivirusSignatureLastUpdated
---------------- ------------------------- -----------------------------
True True 14-03-2026 06:02:11The Windows event logs
Windows writes events into logs you can open in Event Viewer or read with PowerShell. The Security log records logons, account changes and policy changes. Each kind of event has a number called an Event ID. A few you will see constantly:
| Event ID | Meaning |
|---|---|
| 4624 | An account logged on successfully |
| 4625 | An account failed to log on |
| 4634 / 4647 | Logoff |
| 4672 | Special (admin-level) privileges assigned to a new logon |
| 4688 | A new process was created (if process auditing is turned on) |
| 4720 | A user account was created |
| 4732 | A member was added to a security-enabled local group (for example Administrators) |
| 4740 | A user account was locked out |
| 1102 | The audit log was cleared |
PS> Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 3
ProviderName: Microsoft-Windows-Security-Auditing
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
14-03-2026 02:14:09 4625 Information An account failed to log on....
14-03-2026 02:14:07 4625 Information An account failed to log on....
14-03-2026 02:14:05 4625 Information An account failed to log on....Common mistakes
- Everyday users being local admins. Most malware then runs with full control. Give staff normal accounts and a separate admin account only for IT.
- The same local Administrator password on every PC. One stolen password opens all of them. LAPS fixes this.
- Disabling Defender or UAC "because it is annoying".
- Event 1102 (log cleared) ignored. Attackers clear logs to hide; this event should always be investigated.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Windows security basics · 1/7
Most office laptops run Windows and most companies manage them with Active Directory.
Prefer a video by a teacher? Find free videos on “windows security event log 4624 4625 event viewer tutorial” on YouTube ↗
In real life: Same password, every laptop
An IT services firm in Noida set the same local admin password on all 300 laptops to make support easy. Malware on one laptop collected that password and used it to log on to every other laptop, then installed ransomware everywhere in one night. After recovery, the firm deployed LAPS (unique, rotating passwords), removed admin rights from everyday accounts, and alerted on Event ID 4732 (someone added to Administrators).
Practice (0/3 done)
Which Event ID means a failed logon?
Write unexpected_admins(members, allowed) that returns a sorted list of names in members that are NOT in allowed. Compare without caring about upper or lower case, but return the names as they appear in members.
On your own Windows PC, open PowerShell as administrator and check: who is in the local Administrators group, whether Defender real-time protection is on, whether BitLocker (or Device Encryption) is on, and the last 5 failed logons (Event ID 4625). Write what you found and one thing to improve.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Hashing: fingerprints for dataSystems and cryptography · same module
- Symmetric and asymmetric encryptionSystems and cryptography · same module
- Logs and log sourcesLogs, SIEM and incident response
- Logging and monitoring in the cloudCloud security basics
- Microsoft Entra ID and Azure RBACCloud Computing (AWS, Azure, Google Cloud) · Microsoft Azure essentials
- Security basics: threats, CIA and AAAComputer Networking (CCNA level) · Network security
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
What is Active Directory?
Answer: A central directory that manages users, computers and permissions in a Windows network
AD stores accounts and policies; domain controllers check logins.
Which Event ID shows that the Security log was cleared?
Answer: 1102
1102: the audit log was cleared. Always investigate it.
What does BitLocker protect against?
Answer: Data being read from a lost or stolen disk
Full-disk encryption keeps data unreadable without the key.
Why should daily users not be local administrators?
Answer: Any malware they run also gets full control of the PC
Least privilege limits what malware can do.
What does LAPS do?
Answer: Sets a unique, rotating local admin password on each computer
Unique passwords stop one stolen local admin password unlocking every machine.
Which Event ID is a failed logon?Related
Why use sudo instead of logging in as root?Related
Answer: Each admin action is tied to a named user and logged
Named users plus logging gives accountability and fewer mistakes.
Why should cloud audit logs go to a separate logging account?Related
Answer: So an attacker who controls the main account cannot delete them
Separation protects evidence.
A Function app needs to read a storage account without any stored secret. What should it use?Related
Answer: A managed identity with a narrow data role
A managed identity gets tokens from Entra ID automatically; you then grant it a role such as Storage Blob Data Reader.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 3 more topics in “Systems and cryptography” before its exam: Hashing: fingerprints for data, Symmetric and asymmetric encryption, Certificates and PKI.
- Module 3 exam: Systems and cryptography · 12 questions · 25 min, without help. 5 topics of this module still to finish first.
- Then the next module, Identity and network defence. 43 topics left in the course before the final exam.