Installed and configured Windows, created role-based user accounts, and applied baseline security hardening (password policy, disabled services, firewall rules) across 2 machines.
- Overview
- Objectives
- Lab Architecture
- Environment
- Implementation Phases
- Role-Based Access Control
- Security Baseline
- Verification & Validation
- Screenshots
- Troubleshooting
- Skills Demonstrated
- Repository Structure
- Future Improvements
- License
This lab simulates a real-world Windows workstation deployment. It covers the full lifecycle of preparing a Windows endpoint for use in a managed environment:
- Installing and configuring Windows on each machine
- Creating role-based local user accounts with least-privilege permissions
- Hardening each system against common attack vectors
- Verifying that every control is applied and effective
The goal is to demonstrate the workflow a system administrator or security-minded IT technician follows when provisioning endpoints that must meet a defined security baseline.
- Deploy and configure Windows on 2 machines with consistent settings
- Design and implement role-based user accounts using the principle of least privilege
- Enforce a password policy aligned with common compliance guidance
- Disable unnecessary services to reduce attack surface
- Configure Windows Defender Firewall rules to allow only required traffic
- Document and verify each configuration step with evidence
┌──────────────────────────┐ ┌──────────────────────────┐
│ MACHINE 01 │ │ MACHINE 02 │
│ OS: Windows [version] │ │ OS: Windows [version] │
│ Role: [e.g., Standard] │ │ Role: [e.g., Admin] │
│ Users: [user1, user2] │ │ Users: [user3, user4] │
│ Hardening: Applied │ │ Hardening: Applied │
└──────────────────────────┘ └──────────────────────────┘
Replace with a diagram of your actual setup, or describe whether the machines are VMs (Hyper-V / VirtualBox / VMware) or physical hosts.
| Component | Details |
|---|---|
| Operating System | Windows [10 / 11 / Server 20XX] |
| Edition | [Pro / Enterprise / Home] |
| Virtualization | [Hyper-V / VirtualBox / Physical] |
| Machines | 2 |
| Admin Tools | PowerShell, Local Users and Groups, Local Security Policy, Windows Firewall with Advanced Security |
- Installed Windows on each machine
- Set computer names, time zone, and region settings
- Applied all available updates via Windows Update
- Verified system information:
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumberUsers were created according to the responsibilities of each role, with no unnecessary administrator rights granted.
# Create a standard user
net user [username] [password] /add /fullname:"[Full Name]" /passwordchg:yes
# Add to the appropriate group
net localgroup Users [username] /add
# Add to Administrators only if the role requires it
net localgroup Administrators [username] /addConfigured via Local Security Policy (secpol.msc) or the command line:
net accounts /minpwlen:12 /maxpwage:90 /minpwage:1 /uniquepw:5 /lockoutthreshold:5 /lockoutduration:30 /lockoutwindow:30| Setting | Value |
|---|---|
| Minimum password length | 12 characters |
| Maximum password age | 90 days |
| Minimum password age | 1 day |
| Password history enforced | 5 passwords |
| Account lockout threshold | 5 attempts |
| Lockout duration | 30 minutes |
Unnecessary services were disabled to reduce the attack surface. Each service was reviewed before changes were made.
# Example: disable a service that is not required for this role
Stop-Service -Name [ServiceName] -Force
Set-Service -Name [ServiceName] -StartupType Disabled| Service Name | Display Name | Action | Reason |
|---|---|---|---|
| [Service1] | [Display Name] | Disabled | Not needed for this role |
| [Service2] | [Display Name] | Disabled | Legacy protocol, unused |
| [Service3] | [Display Name] | Disabled | Reduces remote attack surface |
Windows Defender Firewall was enabled on all profiles, and inbound rules were restricted to required traffic only.
# Enable firewall on all profiles
Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True
# Block a specific inbound port (example)
New-NetFirewallRule -DisplayName "Block Telnet" -Direction Inbound -Protocol TCP -LocalPort 23 -Action Block
# Allow only required application traffic (example)
New-NetFirewallRule -DisplayName "Allow [App]" -Direction Inbound -Program "[Path\To\App.exe]" -Action Allow| Rule Name | Direction | Protocol | Port | Action | Purpose |
|---|---|---|---|---|---|
| [Rule 1] | Inbound | TCP | [port] | Allow | [purpose] |
| Block Telnet | Inbound | TCP | 23 | Block | Insecure protocol |
| Machine | Username | Role | Group(s) | Privileges |
|---|---|---|---|---|
| Machine 01 | [user1] | [Standard User] | Users | Basic application access |
| Machine 01 | [user2] | [Administrator] | Administrators | Full local administration |
| Machine 02 | [user3] | [Standard User] | Users | Basic application access |
| Machine 02 | [user4] | [Restricted] | Users | Limited, role-specific apps |
Principle applied: Each account receives only the permissions its role requires. Administrative rights are reserved for accounts that explicitly need them.
The baseline below summarizes the controls applied to both machines:
| Control Area | Configuration | Status |
|---|---|---|
| OS Updates | All updates installed | ✅ Done |
| Password Policy | Min length 12, complexity enabled | ✅ Done |
| Account Lockout | 5 attempts / 30-minute lockout | ✅ Done |
| Unused Services | Disabled and documented | ✅ Done |
| Firewall | Enabled on all profiles | ✅ Done |
| Inbound Rules | Restricted to required traffic | ✅ Done |
| User Privileges | Least privilege applied | ✅ Done |
Each control was tested after implementation:
# Confirm password policy
net accounts
# Confirm firewall status
Get-NetFirewallProfile | Select-Object Name, Enabled
# Confirm service state
Get-Service -Name [ServiceName] | Select-Object Name, Status, StartType
# List local group membership
Get-LocalGroupMember -Group Administrators
# List local users and their status
Get-LocalUser | Select-Object Name, Enabled, LastLogonResults: [Summarize what passed, e.g., "All password policy values match the target configuration on both machines. The firewall is active on all three profiles, and only the defined inbound rules are present."]
Evidence for each phase is stored in the Screenshots/ folder.
| Phase | Description | Preview |
|---|---|---|
| 1 | Windows installation summary | [Screenshots/phase1.png] |
| 2 | User account creation | [Screenshots/phase2.png] |
| 3 | Password policy configuration | [Screenshots/phase3.png] |
| 4 | Disabled services | [Screenshots/phase4.png] |
| 5 | Firewall rules | [Screenshots/phase5.png] |
| Issue | Cause | Resolution |
|---|---|---|
net accounts changes not reflected |
Policy overridden by Group Policy | Run gpupdate /force and recheck |
| Service fails to disable | Dependent service still running | Check dependencies with Get-Service -Name X -DependentServices |
| Application blocked after firewall change | Missing allow rule for the program | Add an inbound rule scoped to the executable path |
| "Access denied" when creating users | Command not run as administrator | Launch PowerShell with "Run as administrator" |
- Windows installation and system configuration
- Local user and group management
- Password policy and account lockout configuration
- Service management and attack surface reduction
- Windows Defender Firewall configuration
- PowerShell scripting and command-line administration
- Security baseline design and validation
- Technical documentation
Windows-OS-Deployment-Configuration-Lab/
├── Screenshots/ # Evidence for each implementation phase
├── README.md # Project documentation
└── [scripts/] # Optional: PowerShell scripts used in the lab
This project is licensed under the MIT License.
Author: Ravi Kumar · GitHub: @code-with-rv