Lion Cipher Lab
Explore Windows security on your own PC
- SOC Analyst / Blue Team
- Beginner
- ~30 min
- Free · no account required
Why it matters
The internet is full of Linux security labs, but the machines a defender is actually paid to protect are mostly Windows — desktops, laptops, and servers running the operating system most of the world sits in front of every day. Knowing your way around Windows' own security tools is therefore one of the most directly employable things a beginner can pick up. In this lab you look at the same four things a Windows defender checks first: the accounts on the box (and why the everyday account should not be an administrator), whether Microsoft Defender's real-time protection is actually on, what the…
What you'll learn
- Windows accounts
- standard vs administrator
- Microsoft Defender
- User Account Control (UAC)
- Event Viewer
- logon events 4624/4625
Steps in this lab
- Find out who you are: standard user vs administrator
- Why not to daily-drive an administrator account
- Open the Windows Security app and check real-time protection
- Run a scan (a safe, read-only action)
- Meet User Account Control — the prompt that asks permission
- Open Event Viewer and find the Security log
- Filter for logon events 4624 (success) and 4625 (failure)
- Why this small tour is a big deal