Secure Windows Operating Systems

0:00Welcome to the content on securing the Windows server operating system. Now

0:04this

0:05is an interesting one especially in the latest edition of the AZ-801. Why is it

0:11interesting? Well they're taking things in a little bit of a different

0:14direction

0:15now because we finally have some new topics to talk about. Something like OS

0:19config. Now still there's some oldies but goodies things that we've done for 30

0:24years now like setting password policies and user rights assignments but like I

0:29said there are a couple new things that we're going to talk about like OS

0:33config. So get ready as we talk about the basics of securing the Windows Server

0:38operating system primarily through GPO but now with some other new utilities

0:43too. Let's go!

0:00We are beginning to securing Windows Server operating systems and importantly

0:05Windows desktop operating systems by talking about exploit protection. Now

0:11exploit protection does exactly what its name says it's going to do. It's going

0:15to protect you from exploits typically coming in through files. You could

0:19almost think about this as like malware scanning and file scanning but what's

0:24interesting is in a lot of applications even well known good applications it

0:30can

0:30execute code that is still problematic. For instance Outlook. Outlook is a safe

0:36application to download and install. Now it can be painful to use sometimes

0:40right

0:41but that doesn't mean bad things can't happen within Outlook because ultimately

0:48Outlook's job is to get email, download applications, download images and

0:53exploits can come in through that. So as the landscape has changed over the

0:59years exploits and malware and everything have become incredibly

1:05sophisticated and Microsoft has been on top of this. Now we starting off by

1:09looking at the documentation it's more like a you are here. We are looking at

1:14reducing our attack surface and exploit protection was going to attack surface

1:19reduction exploit protection as you can see is just one of the things that we

1:25do

1:26to reduce our attack surface and then there's some other interesting things

1:30that I want to point out here in the documentation. It says this applies to

1:34exploit mitigation techniques and it begins with Windows 10 version 1709 and

1:41Windows 11 and Windows server version 1803 that's really 2016 but that was

1:502016 plus two or three years. This was a feature update that really started to

1:56roll out the exploit protection feature. Ultimately what the high-level

2:00overview

2:00is is it is a malware scanning application that is always on is always

2:07enabled by default and it basically runs a bunch of different algorithms and

2:12scanning detection things across all applications and all operating systems

2:18that meet these baseline requirements and above. There's not really anything

2:23that

2:23you need to configure because it's already on. Now it says here you can

2:28enable exploit protection on an individual device and then use GPOs to

2:33distribute an XML file to multiple devices once it's done but the kicker

2:37here is if you've got these operating systems it's already on. So there's not

2:42a lot that you need to do unless you need to enable or override specific

2:48applications to not use specific malware scanning algorithms. Let me show you.

2:55Here's Windows 11. This is where we're going to start and from Windows 11 I'm

3:00going to go and just type in security and we'll bring up Windows security right

3:06here. So we'll click on it and it'll load up and much like we've got the

3:10attack surface reduction and the documentation that a bunch of different

3:14facets the Windows security has a bunch of different facets too. Explained

3:19protection is under app and browser control. So we'll give this a click and

3:24right here you see exploit protection right here. This is one of the things

3:28that we do. So if we want to look at the exploit protection settings we can

3:34give

3:34that a click and as you can see the default settings for the system wide

3:39configurations for all of these is set to on. You don't have to do anything to

3:45turn this on. This is using AI machine learning signature updates and

3:50everything like that behind the scenes. So we've got data execution

3:55preventions and unless you're a security person like really really deep in the

4:01security a lot of this is just going to sound like a lot of big words and fancy

4:06stuff prevents code from being run from data only memory pages. Randomize

4:11memory

4:12allocations. I actually think this one is really cool. Randomize locations for

4:16virtual memory allocations that way an application or you know malicious code

4:22can't execute in the same memory space every time and being predictable. Things

4:28like validating heap integrity terminate a process when heap

4:31correction is detected. These are the things that happen on a system wide

4:36level across all applications. But let's say for a second you need to change

4:42this or more specifically target a specific application probably one that

4:48you've built in house to override you know this setting and turn that in

4:52particular algorithm off. We can go in to program settings and then you'll

4:58scroll until you find the specific application that you're looking for.

5:02Maybe it's something like print dialog.exe. You notice here there's already

5:07some

5:08system overrides in place because it would guarantee come with you know some

5:13sort of trigger that would stop this application from ever working. We can

5:18click edit here and you can take a look at what that specific override is when

5:22we scroll down. They have override disable extension points. Disable various

5:27extensibility mechanisms that allow DLL injection into all processes such as

5:32Windows hooks. Again unless this is kind of your jam you probably don't know

5:38what

5:38that means and that's okay. You should just know at least for the exam that the

5:43point of exploit protection is that on an application level there are all of

5:48these you know algorithms running at a given point to stop threats from

5:54happening. Let's say for a second we want to override validate image dependency

6:00integrity and turn it on. We'll click apply here and now we've created an

6:06override specific to that exe. So that's what we've done on this one

6:11particular box. But what happens when we have 300 devices or 300 boxes in our

6:17environment that we now need to make this configuration change on. Does that

6:22mean I need to go from one desktop to the next and turn this override on

6:26manually? No. We can export all of these settings out to an XML file. I'll

6:31click

6:31export settings right here. It'll ask me where do you want to save this. I'll

6:35put

6:35it on my desktop and I'll change this name to be something like exploit

6:40settings

6:41and you can see the type is an XML file. I'll click save and sure enough we've

6:49now

6:49got exploit settings.xml on my desktop. So what I can do now is I can move this

6:54to a file share and that way I can then mass deploy that file throughout my

7:00entire environment. So I'll copy this file and I'll move this over to something

7:05like a file share or domain controller and we'll take a look at how to deploy

7:09this via GPO. So from my Windows server device I'll paste this in right here

7:15and

7:15as you can see there's the exploit settings XML file and now what I need to

7:19do is create a GPO that can mass deploy this. Now very important for you to

7:24understand this needs to be on some sort of file share or UNC path. So what I

7:31'll

7:31do is I'll create a folder real quick. We'll call this exploit settings. I'll

7:39go

7:40ahead and just share it real quick for this lab environment to get it up and

7:44running you would obviously create this with a little bit more permissions than

7:48available to everyone read level is fine done and close. I'll move exploit

7:56settings into that folder and now we're good to go from there. So now that it's

8:01in a place where any one or any device can get to it we can open up server

8:07manager go into group policy management we'll expand the forest we'll expand

8:13the

8:13domain and we'll edit the default domain policy. So I'll double click on this

8:21or

8:22excuse me I'll right click on this and say edit and then we'll start working on

8:25a computer configuration. So from here we are editing a policy it is an

8:32administrative template which it will spin while it expands we'll go down to

8:37Windows components and then we'll go nice and big as we begin to scroll we're

8:42gonna look for the M's Microsoft Microsoft defender exploit guard is what

8:47we're looking for here and then in exploit protection here's the the policy

8:53use a common set of exploit protection settings. So we will edit this we will

9:00enable it and the path will be the the path to reach that XML file. So in this

9:06case I put it on DC NUG and then it goes into the share was exploit settings

9:14and

9:15the file was exploit settings dot XML we could comply we click okay we can run

9:23a

9:23GP update slash force if that's what we want to do and at this point we've now

9:28mass deployed a custom configuration for exploit protection but keep in mind

9:33everything is enabled by default from basically Windows 10 and on so you should

9:39be okay to leave things as you want and this is only on an as needed basis.

0:00Have you ever fired up your edge browser,

0:03navigated through some websites,

0:05and then ultimately got hit with some sort of warning

0:08that said, hey, you should rethink about proceeding

0:11onto this next website.

0:13We've detected some anomalous behavior

0:16or an expired SSL certificate,

0:18or some other signature or problem that is warning you

0:22that you should not proceed to this next website.

0:25The logic behind where it got the idea

0:30to not proceed to that next website,

0:32to generate the warning is Microsoft Defender Smart Screen

0:37or Windows Defender Smart Screen.

0:39They oscillate between Microsoft Defender

0:42and Windows Defender.

0:43They've been bouncing back and forth.

0:45So the point is, is Edge gets its logic

0:49on whether or not to generate this warning

0:52using the Defender Smart Screen.

0:55Now, if you want to start off on Windows 11,

0:56we can take a look at it again by searching for security,

1:00we'll bring up Windows security,

1:02and we'll go again into app and browser control.

1:06Instead of exploit protection this time,

1:08we're now working on reputation-based protection this time.

1:12So when I go into reputation-based warnings here,

1:16you really see two instances of Smart Screen.

1:19The first one is Smart Screen for Edge,

1:22and it's just as simple as turning it on.

1:24Microsoft Defender Smart Screen

1:26helps protect your device from malicious sites and downloads.

1:29That's what pops up all the warnings

1:32prompting you that you should rethink proceeding.

1:35Now, there's also a Smart Screen for Microsoft Store apps.

1:38The kicker here is on Windows Enterprise editions.

1:42Lots of times, not always, but lots of times,

1:45enterprises shut down the Microsoft Store,

1:48and there's not even a Microsoft Store

1:50that ships with an Enterprise edition

1:52of the operating system.

1:54So we're really focused on Smart Screen for Edge,

1:57especially when it comes to group policies.

2:00'Cause here's the real kicker.

2:01First of all, we can turn Smart Screen on or off

2:04in the operating system.

2:06We can tell it, like, don't even warn me,

2:07I'm just gonna do it anyways.

2:09And then second of all,

2:11you know, as the end user sits right now,

2:15they're sitting there, they're browsing on this website,

2:16it warns them, don't download this file or don't proceed,

2:20and they can still ignore that and proceed on anyways.

2:24As a systems administrator,

2:25you have the ability to, first of all,

2:28lock Smart Screen to being on,

2:31and then secondly, enforce whether or not

2:35they're even allowed to proceed if they wanted to.

2:38So take a look at this.

2:39If I'm back on the default domain policy again,

2:42we'll edit it, we will go full screen,

2:46expands out a little bit,

2:47we'll go again down the same tree,

2:49policies, administrative templates, windows components.

2:53This time, instead of Microsoft Defender,

2:56I believe it's under Windows Defender,

2:58and there it is, Windows Defender Smart Screen.

3:01Now, there is Internet Explorer still here, for some reason.

3:06I don't think we're really gonna talk about Internet Explorer

3:09much more ever again, hopefully.

3:12And I doubt you'll see it on an exam,

3:14but Microsoft Edge, that's what we're here to do.

3:17So first of all, we've got Configure Windows Defender

3:19Smart Screen.

3:20This is just turning it on or off, okay?

3:23When we enable this setting, like it says right here,

3:26Windows Defender is turned on and employees can't turn it off.

3:31If we disable it, it's turned off

3:33and employees can't turn it on.

3:35And if we don't configure this setting,

3:37employees can figure out whatever,

3:39they can choose whether or not they want to enable it or not.

3:42So by doing this, by just turning this on,

3:45immediately Smart Screen is enforced to be on,

3:48it is enabled, and that's what we want.

3:51Secondly, do we want to bypass the Smart Screen prompts

3:55for these websites?

3:57If we enable this setting, employees can't ignore

4:02the Smart Screen warnings,

4:04and they are blocked from continuing to the site.

4:08If we disable this settings, or importantly,

4:12or if we don't configure this setting,

4:15employees can ignore the warnings and continue to the site.

4:19So enabled means they can't continue to the site.

4:23Disabled or not configured means they can't.

4:27So we're gonna apply this, and just like that,

4:30we've now got an extra layer of Smart Screen protection

4:34from the browser.

0:00Now, we're getting into old faithful and this is going to be account policies.

0:04What are we talking about when we say account policies?

0:07Usually we're talking about what are the things that an account can do, or more

0:12specifically,

0:14how do we manage the security of a specific account?

0:18This is passwords.

0:19At the end of the day, that's what this is.

0:21This is password.

0:22So now do we manage, they each account security and passwords.

0:26What we're going to do is we're going to expand our default domain policy.

0:31We're going to go into policies, Windows settings, security settings, and then

0:37right here you

0:38see account policies.

0:40Now really, the bulk of what we do within account policies, almost everything

0:44that we're going

0:44to do is going to be around the password policy and the lockout policy.

0:49I'm actually going to start with the lockout policy because it's pretty

0:52straightforward

0:53to understand.

0:54If you type your password incorrectly, you get locked out.

0:59What the lockout policy does is it defines what are the parameters that trigger

1:03the lockout

1:04and how long do you stay locked out.

1:07The account lockout threshold is three invalid attempts within 15 minutes.

1:15Reset the account lockout counter after 15 minutes.

1:20So if I make two incorrect attempts, but then wait 15 minutes and then on the

1:2616th minute,

1:28make another incorrect attempt, that account counter has reset at that point.

1:34So I get a fresh new three attempts before I get locked out again, every 15

1:39minutes.

1:40Now if I get locked out, how long does it keep me locked out by default?

1:45That's also set to 15 minutes.

1:47You might think that's not aggressive enough.

1:50It needs to be something more like you're locked out for 60 minutes or 10 hours

1:55or whatever

1:55it is.

1:56And that's what you need to do.

1:58The other thing is allow administrator account lockout.

2:02Can we lock out the local administrator account for typing in the wrong

2:06password?

2:07The answer here is right now it's not defined and we can either enable that or

2:11disable it.

2:12You can also click on explain to see if it determines whether or not you can

2:16lock out

2:17the built in administrator account.

2:19Honestly, this is a good opportunity to look into laps or the local

2:23administrator password

2:25settings, which we have a video on coming up at the very end of this skill.

2:29So just pause before you set the administrator account lockout, because there

2:34are better

2:35ways to handle the administrator password.

2:39So understanding that you get three invalid attempts within 15 minutes before

2:44you get

2:44locked out for, you know, what I've now set to an hour, that's the first thing

2:49you need

2:49to know about the account lockout policy.

2:52The password policy itself is another really good one.

2:56And where we always start with is password was meet complexity requirements.

3:00Click on explain here to understand what this really includes.

3:05This determines whether passwords meet complexity.

3:08If it's enabled, which it is by default, passwords must meet the following

3:12requirements.

3:12It cannot contain the user's account name or parts of the user's full name that

3:20exceed

3:20two consecutive characters.

3:22So I could have K in for, you know, Knox, but I can't have K in O or K in O X

3:31in my password.

3:33It must be at least six characters in length.

3:37It must contain characters from three of the following categories.

3:42So it needs to have an upper, lower number, or symbol, three of the four

3:48categories for

3:50that to kick in.

3:51So they can actually get away with upper, lower number without a symbol.

3:55And that would be good enough.

3:57So the things that you may want to think about is going back to the security

4:01settings and

4:02say, yes, is that good enough or not?

4:06Now, the only real thing that we can change with this is the password length.

4:13The password complexity says that we have to have at least six characters in

4:19length,

4:19but we actually have a minimum password length setting.

4:24And we might want to set this to be something a little more aggressive or I'm

4:28actually seeing

4:29a lot of people talking about like, we don't really care about this anymore

4:32because everything

4:33is moving to password lists or past keys for authentication.

4:38Now the other thing we have is enforced password history.

4:42So we are rotating passwords every 42 days with the maximum password age.

4:49If they don't change their password within 42 days, then at the 43rd day, they

4:54're going

4:54to get prompted to change their password.

4:57They will not be able to reuse an old password for 24 42 day cycles.

5:06So it will be two and a half to three years before they can reuse an old

5:12password again.

5:14So that's really important to understand.

5:16Interestingly, if they've reset their password, they can't reset it again for

5:2224 hours.

5:23It could look really suspicious if somebody's resetting their password every

5:28hour.

5:28Potentially there's been something malicious that's happened there.

5:33Now this one here might throw you off a little bit.

5:35Relax minimum password length limits.

5:39Now what is this all about?

5:41Well in legacy active directory, the maximum length of a password was 14.

5:48When we enable this, we're saying we can go beyond a minimum limit of 14

5:54characters.

5:55That's what that's doing there.

5:57And it's important to understand that when we apply these password and account

6:00lockout

6:01policies, they apply to every single user account in the domain.

6:07There is a way, however, to override this for specific users or specific groups

6:13and give

6:13them an entirely different password policy.

6:16We have to do that through active directory administrative center by bringing

6:21this up right

6:22here.

6:23So how do I get to this?

6:24What we're going to do is we're going to go into the domain and then we're

6:27going to

6:28go into system and then we're going into password settings container right here

6:34.

6:35We can create a new custom password settings policy right here.

6:39You give it a name like my policy, you give it a precedence, which is a number

6:45of what

6:45is most important and what is least important.

6:48There used to be a tool tip here that said the lower the number, the higher the

6:53priority.

6:54So priority number one means its top precedence, this policy will apply first

7:01to which users.

7:02We click add right here and specify which users these belong to.

7:08And at this point, we can change the policies to be different.

7:13We can say a password history of 12, but a complex length of 11 and maybe

7:19rotate it every

7:1930 days or something like that.

7:22So when we use this, we can do a targeted or what's called a fine-grained

7:27password that

7:28targets a specific group and applies a different policy to them.

0:00Now I'm excited to talk to you about a relatively new type of configuration

0:06style that we see this began to roll out as an executable in Windows Server

0:112022.

0:13And now that we fast forward to Windows Server 2025, it's basically a list of

0:18PowerShell commandless.

0:21The idea with OS config is that we can define what a desired state of

0:27configuration settings should be for a given operating system or a given device

0:35.

0:36And we can apply a broad spectrum of security settings and configurations with

0:42these PowerShell commandless. Now we do need to break down some terminology

0:48here.

0:49The first thing that you need to know or the first term that you need to know

0:54when working with OS config is the desired state.

1:03And you can think about this as more of the big picture is that there are large

1:10sets of topics of security TLS settings, SMB settings, firewall settings,

1:18network settings that all impact how the operating system should look and

1:24behave.

1:26Within that desired state, we have settings, and this is the actual

1:34configuration itself, like TLS version 1.0 is disabled.

1:44That's the kind of thing that you would set as, you know, many different

1:49settings within a single desired state.

1:52The last term that I want you to be aware of is a scenario.

1:58And this is really a template of desired state Microsoft provides scenarios out

2:06of the box for you to begin working with and building off of as a quick as a

2:13great way to fly wheel your start or kick start your beginning intro into OS

2:20config.

2:21Now the first thing you should know is that OS config does not ship with

2:24Windows Server 2025 by default.

2:27I believe it did on Windows Server 2022 as a .exe.

2:32But in Server 2025, they're transitioning this to PowerShell commandless, so

2:37you need to go out and install the modules.

2:40So what I'm going to do is paste in the commandlet install module name

2:45Microsoft OS config.

2:48We're going to say force to accept all the prompts that go along with that.

2:52So I'll press enter here and let it do its thing.

2:55Ah, yes, it tells me that we got to install the provider first.

2:59I will say yes to that and let it do its thing.

3:01This will take a little bit.

3:02So there we go. We've got it installed now. I ran the commandlet twice just to

3:07make sure.

3:08Now what we can do is explore what all this thing can do.

3:12Let's run the git command commandlet, but specify the whole module to see what

3:16options there are.

3:18So here I'll say module, the name of the module again was Microsoft dot OS

3:24config.

3:25And we see we don't have a whole lot of commandlets, but they're all the good

3:29ones.

3:30The big ones that we care about are things like get OS config desired

3:35configuration.

3:37We can also do get OS config drift control because one of the big points of

3:42infrastructure is code and setting a desired state is catching an operating

3:48system when it's drifted from the desired state.

3:53So as you can see, it really begins with a lot of just specifying or setting a

3:58desired configuration.

4:01And then understanding that catching it when catching the configuration when it

4:06drifts and pulling it back into the desired state is what matters.

4:12I want you to look at the documentation of where we go next.

4:15Once we've got it installed, the first thing we want to do then is apply a

4:20baseline scenario to the server.

4:24If we have a domain join server, we're going to apply the member server

4:29scenario.

4:31If it's a device that's just in a workgroup and it's not domain joined, we're

4:36going to apply the workgroup member scenario.

4:39If it's a domain controller, we're going to apply the domain controller

4:44scenario.

4:46There is a secured core baseline for a device scenario.

4:51And then there is a specific Microsoft Defender antivirus scenario that we can

4:57apply to.

4:59The box that I'm on right now is a domain controller. So I'm going to copy that

5:10commandlet, come back here and paste it in and press enter.

5:10It tells you you're about to install necessary metadata. This operation may

5:14take a while. So I'm going to let it take a while and come back to it when it's

5:18done.

5:19After about 60 seconds, it is all done. The necessary metadata was installed.

5:25There are 312 settings.

5:27A restart of the system is recommended to ensure changes take effect.

5:32Let's see what that desired configuration actually looks like.

5:37If I do get OS desired configuration specifying the exact scenario here for the

5:44domain controller, I can press enter.

5:47It'll process this again as you can see at the top right there. And when it's

5:52done, it'll come back here and spit out the results.

5:56Now, there's a lot of results as you can see. And what you're looking at is the

6:01individual setting for this specific configuration.

6:06And there are, well, a lot of different settings that you can look at here.

6:10I mean, you can keep scrolling up and you'll see things like user rights take

6:14ownership.

6:15And it tells you what the data type is, what the value currently is, which is

6:19kind of like a hash, even though it's an array.

6:23And you can see if the status is currently compliant and when it was last

6:28checked.

6:30If you're interested in a very specific setting, we can do something like copy

6:35the name of the setting like this one right here user rights modify firmware

6:40environment.

6:42So let me go ahead and highlight this and copy it.

6:47We'll press up, we can then add a setting parameter to it and then paste it in

6:52right here, run the commandlet again, and it'll target this scenario and that a

6:58specific setting, and we can look at the results right here.

7:02If at any point we need to override the setting, we can use the set OS config

7:07desired configuration commandlet instead.

7:11So let's take a look at audit detailed file share. This is an easy one to

7:16override and change because the value is an integer.

7:20So what I can do if I want to change this for any reason to be something like

7:25three reason is two is one of the allowed values two or three for severity

7:30critical.

7:32What we can do is we can press up well actually what we're going to do is we're

7:37going to do set OS config desired configuration.

7:42The scenario is this really long one right here and the setting is what I'm

7:47going to copy right for that to do.

7:50Control C, let's do control C, we'll paste it in right there. Now what I can do

7:56is set the value equal to three.

7:59So in the past we've gotten this specific configuration from this scenario with

8:04this specific setting.

8:06Now we're setting this configuration in this scenario, the name of the setting

8:11and what the value is going to be.

8:14When I press enter here, we set the value to three.

8:19Takes a second or two.

8:23Any minute now do do do do do do and it says a restart of the system is

8:28recommended if I hit up a couple times we can confirm that this configuration

8:33is in place it is there.

8:36The default value is normally two but we have overridden it to three. So at

8:41this point we've actually been able to use setting an OS config.

8:46Now the final thing that I want you to see in OS config is that there is a

8:50commandlet that they give us for checking compliance with our security desired

8:55state baseline.

8:56If we flip back to the documentation under the check compliance tab here there

9:00is to check compliance details for a domain controller baseline, run the

9:04following commandlet.

9:06So I'll copy that commandlet, paste it in right here. It is a nice long command

9:10let. I expect it to take roughly 60 seconds or so to run the whole thing.

9:16So I'll let it spin. We'll check it out when it's done up there goes right

9:20there. So we get a list of all of the settings and whether or not we are

9:25compliant.

9:27We actually have a couple here right here that are not compliant. So those are

9:30things that can immediately alert me that I need to take action. Here's a

9:34couple others that are set to not compliant.

9:38So there we go. OS config is really really helpful and it gives us a way to set

9:44a configuration setting right out of the gate.

0:00Now I'm really excited to talk to you about LAPS. LAPS in my opinion receives

0:06the most

0:06improved award with Windows Server 2022 and Windows Server 2025. The idea here

0:13is that

0:13every machine in your entire environment, desktop or server or whatever has a

0:20local administrator

0:21account and that local administrator account has keys to that kingdom of that

0:27box. Still

0:28a critical piece of infrastructure. So managing that local administrators

0:34password is one

0:36of the most overlooked things in all of systems administration and it's still a

0:42huge security

0:43vulnerability. With LAPS we can let our active directory manage the local

0:49administrator passwords

0:52of all of our boxes. The domain controller and active directory will store the

1:00passwords

1:01in active directory and rotate them by default every 30 days. The password then

1:11which is

1:11stored in active directory can only be retrieved by domain admins or anyone

1:20else that we have

1:22explicitly granted read permissions too. So if for whatever reason anybody

1:29needed the

1:29local administrator account to box number one right here only the domain admins

1:36or the

1:36explicitly names people can get it by going to active directory and retrieving

1:43it. Then

1:44they can come over to this box and type in that password. So the idea here is

1:49that we

1:50have a secure manage password for an easily overlooked bit of infrastructure

1:56and security

1:57in our environment. This used to be a pain in the rear to deploy. We used to

2:04have to

2:04do things like Windows Server 2019 and older. We used to have to extend the AD

2:13schema before

2:14beginning. We then had to configure the GPOs to enable this. We still sort of

2:21have to do

2:22that. We still have to configure GPO settings. We then had to install a client

2:29executable

2:31or MSI on each of these boxes that we're going to be managed by it. That is no

2:37longer

2:38a thing. And then we had to grant the permissions to the people that we want to

2:45be able to

2:46read it. So now in Windows Server 2022 that's gone and installing the MSI is

2:52gone. We're

2:53now down to just turn it on in GPO and grant permissions. This is a huge deal

2:59and it is

3:00a huge win. Let's see how to configure it. First things first we're going to go

3:05into

3:05group policy management. We're going to edit the default domain policy. Under

3:12computer

3:12configuration we're going to go into policies, administrative templates, system

3:19. I'll expand

3:20this out so it's a little bit easier to see. And right there you will see laps.

3:29Where did

3:29it go? My eye just cut it left. Local administrator policy settings or password

3:35settings. So

3:36first things first configure automatic account management. That's where you

3:41want to start

3:41things. We're going to edit this and we're going to turn it on. Now specify a

3:46target

3:47account to manage. You can manage a custom admin account if you don't use the

3:51default

3:52administrator or you can manage the built-in admin account which has the well-

3:57known rid

3:58of 500 RID of 500. Notice that we'll come up with an automatic account name. If

4:05we don't

4:06configure this setting right here it will default to wlapse admin as the

4:11account name

4:12or prefix when managing this account. Now when it creates a managed account we

4:19can disable

4:19this account by default by leaving this box unchecked, enable the managed

4:24account. Even

4:24if it's disabled it's still going to rotate the password of a managed account

4:29at the

4:30same time. And we can also randomize the name of the managed account. It tells

4:34you a little

4:35bit more about how it does this with a random numeric suffix. So I'll hit apply

4:41right here

4:42to turn it on. Now there's a couple other things that you need to know about.

4:47You can

4:47adjust the password settings if you want to. I trust that the domain controller

4:53in this

4:53policy is going to be able to create complex in well-known passwords on its own

5:00and rotate

5:01it every 30 days. So setting password settings here doesn't really matter that

5:07much to me.

5:08Now configure password backup directory. This lets you choose where you want to

5:13save this

5:14specifically. If we choose to enable this we can save it in Active Directory,

5:20Azure Active

5:21Directory or disabled entirely. I want to specify Active Directory since this

5:27is only

5:27local to me. I'll hit apply and okay and now I've hard coded that to be stored

5:33in my

5:33Active Directory. And then of course configure authorized password decryptors.

5:39This is the

5:40group of people that are going to be allowed to decrypt this password. So what

5:45we want

5:45to do is we want to make sure we have a group outside of the domain admins. If

5:50you want

5:50a group outside of the domain admins who are allowed to do this. So what I can

5:55do is

5:55I can create an OU real quick just so I have a fresh OU to put them in. We'll

6:01call this

6:02a new organization unit. We'll call this lapse users and inside lapse users I

6:10'll create a

6:11new group called lapse admins and inside that you would have your user. So from

6:21here I'll

6:22go back to my group policy. I'll edit the authorized decryptors. I'll enable

6:28this and

6:29then you would type it in like Knox's data. In this case my case zero because

6:34there is

6:35a zero right there in my environment. And then it will be lapse admins like so.

6:45Apply

6:46okay. And now we've specified who was allowed to access it. Now to kick things

6:53off a little

6:54bit. I am going to request it to update the lapse schema real quick. I'm going

6:59to run

7:00update lapse ad schema commandlet. We're going to say yes to all to proceed.

7:06And that should

7:07be what we need to make sure any previous compatibility is handled. Now what

7:14happens next after that

7:15we open up active directory users and computers. And it will take a while for

7:21all the machines

7:22to check in refresh their GPOs and then go through the password rotation

7:27process. It

7:28could be up to two or three hours. So what you'll do then is when you're ready

7:33to retrieve

7:33the password I'll show you where it'll be. You'll go into your active directory

7:38in the

7:38computers. You'll find the computer object and if you have credentials and

7:43privileges

7:44to see you can go to properties. There will be a lapse tab. And once the

7:50password rotation

7:51is done you'll be able to click the copy password or show password button and

7:57it'll be right there.

7:59So that's where you would go to manage and configure local admin password

8:04settings.

8:05I hope this has been informative for you and I'd like to thank you for viewing.

0:00So it's time to review some scenarios to reinforce what we've learned and I

0:05really am excited about some of these newer features or the improvements on

0:10previous ones like OS config or laps.

0:14So let's take a look.

0:15You are responsible for securing a new Windows Server 2025 member server.

0:21Your security team requires applying Microsoft's recommended baseline quickly

0:27without manually configuring dozens of policies.

0:31Which OS config command or commandlet should you run?

0:35Get OS config desired configuration with a scenario.

0:39Set OS config desired configuration with a scenario.

0:43Enable OS config drift control or remove OS config desired configuration with a

0:50scenario.

0:52Almost every time you're changing a configuration in PowerShell, it's the set

0:57commandlet.

0:58Remember PowerShell is verb - noun.

1:02The verb is the big thing to look for.

1:04Get retrieves data, set changes data, remove deletes data, and enable usually

1:10turn something on or off.

1:13But in this case, pay attention to the noun.

1:15OS config drift control is not what we're looking for.

1:18We're looking for the desired configuration.

1:21Next up, you enabled Windows laps for an OU of workstation.

1:25But help desk staff still cannot read stored passwords.

1:29What should you do next?

1:31Add help desk staff to the domain admins group.

1:34Nope.

1:35Delegate read permissions for lapsed passwords to the help desk.

1:39Yes.

1:40Now we saw that there was a GPO that can help certain user groups retrieve

1:45encrypted passwords.

1:47That's one thing that we can do.

1:49There's also a PowerShell commandlet that can help us delegate those

1:54permissions as well.

1:56That PowerShell commandlet is set lapse ad read password permission.

2:03So if you just know set lapse ad read, you can tab to auto complete it and go

2:09from there.

2:10So that's one thing that you should know about.

2:13A user complains that a website they frequently visited using edge is now being

2:18blocked by a warning.

2:20They cannot proceed to the website.

2:22What is likely the cause? Why are they no longer able to go to that website

2:26anymore?

2:27The smart screen GPO is not configured.

2:30Smart screen is disabled.

2:32Windows defender is uninstalled.

2:34Or the smart screen GPO is being enforced.

2:37The big thing that we know here is the fact that they can't proceed to the

2:41website means that the GPO is being enforced.

2:45Any other scenario would mean they could at least go past the warning if it

2:51weren't being enforced.

2:54Let's take a look.

2:55Lastly, your boss is worried about exploits and users downloading malware that

3:00will execute malicious code.

3:02He believes that in your current fleet of Windows 11 and Windows Server 2025

3:06machines, there is no protection.

3:09Is this accurate?

3:11No, defender exploit protection is enabled by default with every setting on

3:17every Windows 11 and Windows Server 2025 machine.

3:21The only thing that you can really do here are customize your overrides.

3:26And of course export that XML file and the mass deploy that XML file using a GP

3:30O if that's what you want to do.

3:33But we're talking about by default.

3:35So we know that by default exploit protection is on across the board.

3:40And that reinforces what we've learned about Windows OS security configurations

3:45.