This lesson ties the course together into a repeatable plan. It is for your own practice VMs and for CyberPatriot-style rounds where you are authorized to change the provided images.

Start every image the same way

  • Read the README first, completely. It names authorized users, required services, and what must stay. Missing a requirement can cost more points than a fix earns.
  • Answer any forensics questions early before you change things that destroy evidence, such as deleting files or users.
  • Take a snapshot when you can, and keep a written change log.
  • Check the scoring report regularly to confirm each change counted.

The hardening checklist

Work in a fixed order so nothing is skipped.

1. Accounts and groups

  • Remove or disable unauthorized users; fix Administrators membership.
  • Disable Guest and the built-in Administrator if not required.
  • Set strong passwords; remove “password never expires” where policy forbids it.

2. Policies

  • Password policy: history, age, length, complexity on, reversible encryption off.
  • Lockout threshold around 5, with sensible duration.
  • Audit policy: success and failure for logon, account management, policy change.
  • Security options: no anonymous enumeration, inactivity lock, hide last user.

3. Updates

  • Install Windows updates and update key applications such as browsers.
  • Confirm the Windows Update service is not disabled.

4. Services and startup

  • Disable unneeded services (Telnet, Remote Registry, and others the README does not require).
  • Keep Defender, Firewall, and Windows Update running.
  • Review Task Manager Startup, Task Scheduler, and Run keys.

5. Firewall and network

  • Firewall on for all profiles; inbound default Block.
  • Remove unnecessary allow rules; check listening ports with netstat -ano.
  • Review shares with net share and remove ones that are not needed.

6. Software and files

  • Uninstall unauthorized or risky software (games, peer-to-peer tools, hacking tools that are not allowed by the README).
  • Check for prohibited media files in user folders per competition rules.
  • Run a Microsoft Defender scan.

7. Remote access

  • Disable Remote Desktop and Remote Assistance unless the README requires them.

Useful verification commands

net user
net localgroup Administrators
net accounts
auditpol /get /category:*
netsh advfirewall show allprofiles
sc query state= all
net share

Competition strategy

  • Prioritize by points and risk. Do the quick, high-value items first (accounts, updates, firewall), then the long tail.
  • Change one thing at a time and check the score. If points drop, undo it.
  • Divide work on a team. One person on accounts and policy, another on services and software, another on forensics and documentation.
  • Be careful with scripts. Community scripts can help you learn, but read every line, run them only on practice images, and understand what each change does. A script that blindly disables services can break required ones.
  • Watch the clock. Leave time to review the README again and confirm required services still run.
  • Practice. Rebuild a practice VM, break it on purpose with known weaknesses, and time how fast you fix them.

After the round

Review what cost points or time. Update your checklist with anything you missed. Good teams improve their checklist after every practice image.

Check your understanding

1. What should you read first on a CyberPatriot image?

  • The registry
  • The README
  • Event Viewer
  • The firewall log

Answer: The README. It lists authorized users and required services.

2. When should you handle forensics questions?

  • Last, after deleting files
  • Early, before changes destroy evidence
  • Never
  • Only after rebooting

Answer: Early, before changes destroy evidence. Some answers depend on files or accounts you might remove.

3. What is the right approach to a community hardening script?

  • Run it blindly on the real machine
  • Read it fully and use it only on an authorized practice machine
  • Share it with strangers
  • Ignore the README

Answer: Read it fully and use it only on an authorized practice machine. Understand every change first.

4. Your score drops after a change. What should you do?

  • Make more changes
  • Undo that change and investigate
  • Turn off the scoring report
  • Disable the firewall

Answer: Undo that change and investigate. A drop usually means you broke a required item.

Previous