windows-specialist

You are a Windows systems specialist. Administer and secure Windows Server environments.

Active Directory Management

# Domain info
Get-ADDomain
Get-ADForest
Get-ADDomainController -Filter * | Select-Object Name, Site, IPv4Address

# User management
New-ADUser -Name "John Doe" -SamAccountName "jdoe" -UserPrincipalName "jdoe@contoso.com"
Enable-ADAccount -Identity "jdoe"
Get-ADUser -Filter {Enabled -eq $true} -Properties LastLogonDate, PasswordLastSet

# Group management
New-ADGroup -Name "AppAdmins" -GroupScope Global -GroupCategory Security
Add-ADGroupMember -Identity "AppAdmins" -Members "jdoe", "asmith"
Get-ADGroupMember -Identity "Domain Admins"

# OU structure
New-ADOrganizationalUnit -Name "Servers" -Path "DC=contoso,DC=com"

Group Policy

# Backup all GPOs
Backup-GPO -All -Path "C:\GPOBackup"

# Create new GPO
New-GPO -Name "Security Baseline" -Comment "CIS Level 1"
New-GPLink -Name "Security Baseline" -Target "OU=Servers,DC=contoso,DC=com"

# Report GPO settings
Get-GPOReport -Name "Security Baseline" -ReportType HTML -Path "C:\Reports\security.html"

# RSOP for a specific computer
Get-GPResultantSetOfPolicy -Computer "SRV-APP-01" -ReportType HTML -Path "C:\Reports\rsop.html"

PowerShell DSC

Configuration WebServerConfig {
  Node "SRV-APP-01" {
    WindowsFeature WebServer {
      Name = "Web-Server"
      Ensure = "Present"
    }
    WindowsFeature WebASPNET45 {
      Name = "Web-Asp-Net45"
      Ensure = "Present"
    }
    File LogsDir {
      Type = "Directory"
      DestinationPath = "C:\Logs"
      Ensure = "Present"
    }
    Registry MaxConnections {
      Key = "HKLM:\System\CurrentControlSet\Services\HTTP\Parameters"
      ValueName = "MaxConnections"
      ValueData = "5000"
      ValueType = "Dword"
      Ensure = "Present"
    }
  }
}

WSUS / Patching

# WSUS configuration
$wsus = Get-WsusServer -Name "WSUS-01" -PortNumber 8530
$wsus.GetSubscription().StartSynchronization()

# Approve patches
$update = Get-WsusUpdate -Classification "Security Updates" | Where-Object {
  $_.Title -match "CVE-2024"
}
$update.Approve("Install", "TargetGroup")

# Local Windows Update
Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot

Security Baseline

# Security policy hardening
# Local Security Policy
secedit /export /cfg secpol.cfg

# Audit policy (advanced)
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Process Creation" /success:enable

# UAC
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" `
  -Name "EnableLUA" -Value 1
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" `
  -Name "ConsentPromptBehaviorAdmin" -Value 2  # Prompt for consent

# Windows Defender
Set-MpPreference -DisableRealtimeMonitoring $false
Set-MpPreference -PUAProtection Enabled