cyber security lab(excercise 1 and 4)

 

Exercise 1: Audit Security Policy Implementation in Windows Environment

 

Lab Exercise	1 of 14
Title	Audit Security Policy Implementation in Windows Environment
Aim	To understand and implement audit security policies in a Windows environment to track user activities and security events.

 

Objective

Configure Windows Audit Policy to monitor and record security-relevant events including logon failures, privilege use, account management, and object access. Understand the Windows Security Event Log and analyze audit records.

Pre-requisites

•        Windows Server 2016/2019/2022 or Windows 10/11 Pro

•        Administrator privileges

•        Local Group Policy Editor (gpedit.msc) or Group Policy Management Console (GPMC)

•        Event Viewer

Theory

Windows Audit Policy is a set of security settings that determine which events are recorded in the Security log of the Event Viewer. Auditing enables administrators to detect unauthorized access, track user activities, and ensure compliance with security policies. There are two levels of audit policy:

•        Basic Audit Policy – Configured through Local Security Policy

•        Advanced Audit Policy – Provides granular control with 53 sub-categories

Lab Procedure

Step 1: Open Local Security Policy

1.     Press Win + R, type secpol.msc, and press Enter.

2.     Navigate to Security Settings → Local Policies → Audit Policy.

Step 2: Configure Basic Audit Policies

Enable the following audit categories:

Policy Name	Setting	Events Tracked
Audit account logon events	Success, Failure	Credential validation
Audit account management	Success, Failure	User/group changes
Audit directory service access	Failure	AD object access
Audit logon events	Success, Failure	Local logon/logoff
Audit object access	Success, Failure	File/folder/registry access
Audit policy change	Success	Audit policy changes
Audit privilege use	Failure	Sensitive privilege use
Audit process tracking	No Auditing	Process creation
Audit system events	Success, Failure	System startup/shutdown

 

Step 3: Configure Advanced Audit Policy (Recommended)

Navigate to: Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration

auditpol /get /category:*

Enable specific subcategories using auditpol command:

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable

auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable

auditpol /set /subcategory:"File System" /success:enable /failure:enable

auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable

Step 4: Verify Audit Policy Settings

auditpol /get /category:"Logon/Logoff"

auditpol /get /category:"Account Management"

Step 5: Generate Test Events

3.     Attempt failed login: Lock workstation (Win+L), then enter wrong password 3 times.

4.     Create a new local user account via lusrmgr.msc.

5.     Delete the test user account.

6.     Access a monitored file (set object auditing on C:\TestFile.txt via Properties → Security → Advanced → Auditing).

Step 6: Analyze Events in Event Viewer

eventvwr.msc

Navigate to Windows Logs → Security. Filter by important Event IDs:

Event ID	Category	Description
4624	Logon	Successful account logon
4625	Logon	Failed account logon
4634	Logoff	Account logged off
4648	Logon	Logon using explicit credentials
4720	Account Mgmt	User account created
4726	Account Mgmt	User account deleted
4728	Account Mgmt	Member added to security group
4740	Account Mgmt	Account locked out
4756	Account Mgmt	Member added to universal group
4663	Object Access	Attempt to access an object

 

Step 7: Export and Save Audit Logs

wevtutil epl Security C:\AuditLogs\security_backup.evtx

Or via Event Viewer: Right-click Security log → Save All Events As → .evtx or .csv

Expected Results

•        Audit policies are successfully configured and visible in secpol.msc.

•        Failed logon attempts appear as Event ID 4625 in the Security log.

•        User creation/deletion events are recorded as 4720/4726.

•        File access events appear when accessing monitored objects.

Precautions

⚠ NOTE: Enabling excessive auditing (especially Process Tracking and Object Access on high-traffic paths) can fill logs rapidly and degrade performance. Always set appropriate log size (minimum 128 MB recommended) via Event Viewer → Security → Properties.

Exercise 4: Implement Windows Patch Management Policy

Aim

To implement and verify a Windows Patch Management Policy for maintaining system security, fixing vulnerabilities, and ensuring compliance in a Windows environment.

---

Objective

• Configure Windows Update settings.
• Check for available patches.
• Install security updates.
• Verify successful patch deployment.
• Maintain update logs and reports.

---

Requirements

Hardware

• PC/Laptop with minimum 4 GB RAM

Software

• Windows 10/11
• Administrator Privileges
• Internet Connection

---

Theory

Patch Management is the process of identifying, acquiring, testing, and installing software updates (patches) on operating systems and applications. Regular patching helps:

• Fix security vulnerabilities
• Improve system performance
• Correct software bugs
• Ensure regulatory compliance
• Protect against malware and ransomware attacks

Windows provides an automatic update mechanism through Windows Update and enterprise solutions such as:

• Windows Server Update Services (WSUS)
• Microsoft Endpoint Configuration Manager (MECM/SCCM)

---

Procedure

Step 1: Open Windows Update Settings

1. Click Start Menu
2. Select Settings
3. Click Update & Security
4. Select Windows Update

Screenshot Required:

• Windows Update Dashboard

---

Step 2: Configure Patch Management Policy

Method 1: Local Group Policy

1. Press Windows + R
2. Type:

gpedit.msc

3. Navigate to:

Computer Configuration
   └ Administrative Templates
      └ Windows Components
         └ Windows Update
            └ Manage end user experience

4. Open:

Configure Automatic Updates

5. Select:

Enabled

6. Choose Option:

4 - Auto download and schedule install

7. Set Schedule:

Every Day
03:00 AM

8. Click Apply → OK

---

Step 3: Force Group Policy Update

Open Command Prompt as Administrator and execute:

gpupdate /force

Expected Output:

Computer Policy update has completed successfully.
User Policy update has completed successfully.

---

Step 4: Check Available Updates

Open Command Prompt (Admin):

powershell

Execute:

Get-HotFix

This displays installed updates.

---

Step 5: Check Windows Update Status

Run:

Get-Service wuauserv

Expected Output:

Status : Running
Name   : wuauserv

---

Step 6: Scan for Updates

Open:

Settings → Windows Update

Click:

Check for Updates

Windows contacts Microsoft Update Server and downloads available patches.

---

Step 7: Install Updates

1. Select available updates.
2. Click:

Download and Install

3. Wait for installation.

Example updates:

Security Update
Cumulative Update
.NET Framework Update
Windows Defender Update

---

Step 8: Restart System

After installation:

Restart Now

to complete patch deployment.

---

Step 9: Verify Installed Patches

Open Command Prompt:

wmic qfe list brief /format:table

Sample Output:

HotFixID      InstalledOn
KB5058499     15-05-2026
KB5058501     15-05-2026

---

Step 10: Generate Patch Report

PowerShell Command:

Get-HotFix | Format-Table -AutoSize

Or save report:

Get-HotFix > C:\PatchReport.txt

Verify:

C:\PatchReport.txt

---

Verification Commands

Check Last Installed Update

Get-HotFix | Sort InstalledOn -Descending

Check Windows Update Service

sc query wuauserv

Check System Information

systeminfo

Look for:

Hotfix(s)

---

Sample Patch Management Policy

Policy Item	Configuration
Update Mode	Automatic
Installation Time	Daily 03:00 AM
Security Updates	Mandatory
Critical Updates	Mandatory
Driver Updates	Optional
Patch Verification	Weekly
Compliance Audit	Monthly

---

Expected Result

The Windows Patch Management Policy was successfully implemented. The system was configured to automatically download and install updates, available patches were applied, and the installation was verified using PowerShell and Command Prompt tools.

 

Conclusion

Windows Audit Policy provides comprehensive tracking of security events. By configuring both basic and advanced policies and regularly reviewing the Security Event Log, administrators can detect intrusions, verify compliance, and investigate security incidents effectively.