Stop 03 · Linux & Windows FundamentalsTopics · 4/10

Windows Fundamentals for Security

In short

Most company laptops run Windows, so most attacks land on Windows first. Knowing where it keeps users, services and startup settings tells you where attackers hide and where to look.

Understanding Windows' architecture, registry, and services — the majority of enterprise endpoints run Windows, making it essential knowledge for both attacking and defending real environments.

The blob pulls a folder from a tall cabinet with colourful drawers.

Think of it like this

An office's records room

Every office has a records room. One cabinet lists the staff, one lists who opens the office each morning, one lists rules for every desk. Windows keeps the same kind of records in the registry, the services list and user accounts.

Watch it happen

Places attackers like to hide on Windows

Windows

Registry

Services

Scheduled tasks

Local users

Run keys

1/5Attackers want to survive a reboot. This is called persistence, and Windows has several common spots for it.

The big ideas

What you need to know

The registry

A huge settings database. HKLM holds machine-wide settings, HKCU holds the current user's.

Processes and services

Task Manager and services.msc show what's running. Check the file path and who signed it.

SYSTEM and Administrators

SYSTEM is more powerful than an admin. Attackers aim to run code as SYSTEM.

Built-in defences

Microsoft Defender, Windows Firewall, BitLocker and UAC are all worth knowing and keeping on.

See it in code

Walk through the code

cmd

1:: Run in Command Prompt on your own Windows VM2whoami /priv3net user4net localgroup administrators5reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run6schtasks /query /fo LIST | more

1/3Shows your privileges. Rights like SeDebugPrivilege are powerful and worth noticing.

These built-in commands give a quick picture of users, admins and startup items. Note what's normal on a clean VM so oddities stand out later.

Save yourself the pain

Common mistakes

Oops

Judging a process as safe because of its name, like svchost.exe.

Do this instead

Check its path. The real one lives in C:\Windows\System32. A copy in a Downloads folder is malware.

Oops

Giving every user local admin to avoid IT tickets.

Do this instead

Admin rights let malware do far more. Use standard accounts and switch to admin only when needed.

Your mission

Baseline a clean Windows VM

~30 min

Quick check

You find svchost.exe running from C:\Users\Public\. What should you think?

Go deeper

1Set up a Windows practice VM and explore its file system, services, and registry.
2Learn the basic structure of the Windows registry and why it's a common attack/persistence target.
3Understand why enterprise security work skews heavily Windows-focused compared to consumer tech.