Lion Cipher Lab
Harden a Windows host from a WinPEAS audit: find and fix the weak configurations
- Penetration Testing / Red Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
As the administrator of a Windows host, your job is not to break in — it is to make sure nobody who lands on the box as an ordinary user can quietly become administrator. A posture-enumeration tool like WinPEAS reads your whole configuration and hands you a colour-coded punch-list of the weak spots: a service path missing its quotes, a service a normal user can rewrite, an installer policy that hands out SYSTEM, a password sitting in the registry, a scheduled task pointing at a file anyone can edit. The skill that matters is READING that report correctly — knowing which lines are genuine…
What you'll learn
- reading a WinPEAS security-posture report as a hardening punch-list
- spotting an unquoted service path with a writable directory in tool output
- recognising a service whose binary or ACL a non-admin can modify
- identifying AlwaysInstallElevated, autologon stored credentials, and a writable scheduled-task target
- explaining, in defensive terms, WHY each misconfiguration weakens the host
- applying the concrete administrator fix for each finding and RE-CHECKING it is closed
- judgment: prioritising the highest-impact fixes and when a full audit is worth running
Steps in this lab
- The situation: you are the administrator, this is your report
- The report you're auditing (read it once, top to bottom)
- Finding 1 — the unquoted service path with a writable folder (BackupAgentSvc)
- Finding 2 — the service a standard user can rewrite (TelemetryUpdater)
- Finding 3 — AlwaysInstallElevated is switched on
- Finding 4 — the stored autologon credential
- Finding 5 — the scheduled task pointing at a writable script
- Re-check: prove each fix actually closed the weakness
- Judgment: when this audit is worth running, and how to prioritise