Unit 01 · 1 h 38 min
How Windows is organised
Find your way around drives, system folders, user profiles and NTFS permissions like an investigator.
Windows and Active Directory Basics
Investigate a real-looking Windows intrusion from the first phished laptop to the domain, and close every path it used.
- Time
- 17 h 12 min
- Lessons
- 52
- Machine
- In your browser
What you earn
RootCertificateWindows and Active Directory Basics, certificate of completion CompTIAA+CompTIA A+ MicrosoftMD-102Endpoint Administrator Associate
Prepares you for CompTIA A+ and Endpoint Administrator Associate. Root is not affiliated with these issuers.
You will be able to
- Find your way around drives, profiles, permissions and the registry
- Audit local accounts, admin groups, UAC, privileges and help desk resets
- Spot fake system processes, rogue services, tampered software and pasted commands
- Read Security, System and PowerShell logs and build a timeline
- Explain domains, Group Policy, Kerberos and NTLM, and plan AD recovery
Units and lessons
Unit 02 · 1 h 42 min
Users, groups and UAC
Read SIDs, audit local admin groups and see what UAC and privileges really change in a token.
Unit 03 · 2 h 2 min
The registry
Read hives and keys like an auditor, hunt autostart entries and compare security settings against a baseline.
Unit 04 · 1 h 54 min
Processes and services
Read process trees, spot fake system processes, audit services and scheduled tasks, and tie connections to programs.
Unit 05 · 2 h
Windows event logs
Read the Security and System logs of a server that was broken into overnight and rebuild what happened.
Unit 06 · 2 h 14 min
PowerShell for defenders
Use read-only PowerShell to collect, filter and export evidence, hash files and read what scripts really ran.
- 1Cmdlets, objects and the pipeline20 min · virtual lab
- 2Filtering events with Get-WinEvent20 min · virtual lab
- 3Collecting services and processes18 min · virtual lab
- 4Hashing files and checking intel16 min · virtual lab
- 5Reading script block logs18 min · virtual lab
- 6Case file: the SharePoint server24 min · virtual lab
- 7Running an emergency patch18 min · virtual lab
Unit 07 · 2 h 26 min
Active Directory
See how a domain is built, how groups nest, how Group Policy lands and how Kerberos and NTLM sign people in.
- 1Domains and domain controllers18 min · virtual lab
- 2OUs, users and distinguished names18 min · virtual lab
- 3Groups and nesting22 min · virtual lab
- 4Group Policy20 min · virtual lab
- 5Kerberos and NTLM on the wire and in the logs24 min · virtual lab
- 6Case file: the blast radius22 min · virtual lab
- 7Backing up and recovering Active Directory22 min · virtual lab
Unit 08 · 1 h 4 min
Remote access and RDP
Find every way in from the internet, put remote desktop behind a gateway with MFA, and watch vendor access.
Unit 09 · 2 h 12 min
Hardening and monitoring capstone
Close the paths the intruder used: admin tiers, LAPS, audit policy and risky accounts, then write the close-out.
- 1Admin tiers20 min · virtual lab
- 2Local admin passwords with LAPS16 min · virtual lab
- 3Audit policy16 min · virtual lab
- 4Stale and risky accounts20 min · virtual lab
- 5Case file: when nothing boots20 min · virtual lab
- 6Defender, tamper protection and ASR rules22 min · virtual lab
- 7The close-out18 min · virtual lab
Nine units around one incident at Brightwater Logistics, with case files from real breaches. Every lab runs in your browser, on exported evidence.