Progress checklist
Copy this file or tick the boxes in your own fork. A lab is done when you ran the attack simulation, applied the control, and saw the verification result.
- Lab built (4 VMs, domain, users, RSAT) and the extra setup done
- Checkpoint Baseline taken on every VM
Chapter 1: Securing the Windows Server operating system
- Lab 1.1: Password and lockout baseline with Group Policy
- Lab 1.2: Exploit protection
- Lab 1.3: App Control for Business (WDAC)
- Lab 1.4: Credential Guard
- Lab 1.5: Microsoft Defender SmartScreen
- Lab 1.6: Microsoft Defender for Endpoint
Chapter 2: Securing hybrid Active Directory accounts
- Lab 2.1: Fine-grained password policy
- Lab 2.2: Microsoft Entra Password Protection
- Lab 2.3: The Protected Users group
- Lab 2.4: Read-only domain controller (RODC)
- Lab 2.5: Authentication policies and silos
Chapter 3: Least privilege and delegation
- Lab 3.1: Built-in admin groups and Restricted Groups
- Lab 3.2: Delegation of Control
- Lab 3.3: The Kerberos double-hop
- Lab 3.4: Microsoft Defender for Identity
Chapter 4: Watching your servers from Azure
- Lab 4.1: Azure Arc and Log Analytics
- Lab 4.2: Hunting with KQL and creating an alert
- Lab 4.3: Microsoft Sentinel
- Lab 4.4: Improving the Secure Score with Defender for Cloud
Chapter 5: Securing Windows Server networking
- Lab 5.1: Windows Defender Firewall
- Lab 5.2: IPsec connection security rules
- Lab 5.3: Firewall review with Windows Admin Center
Chapter 6: Securing Windows Server storage
- Lab 6.1: BitLocker with recovery keys in Active Directory
- Lab 6.2: Forcing BitLocker recovery
- Lab 6.3: Encrypting Azure VM disks
Final
- Self-test: cover the middle column of the attack → control map and name the control for every attack