Lab Baseline — Windows 11 (192.168.50.114)
Lab Baseline — Windows 11 (192.168.50.114)
Single source of truth for the TESTER Win11 lab. Re-run the audit script after snapshots, patches, or policy changes. All Windows playbook guides reference this baseline.
|
|
| SSH |
ssh tester808@192.168.50.114 (password tester) |
| Hostname |
TESTER |
| Last full audit |
2026-09-01 from MiniMac 192.168.50.127 |
| Re-audit script |
C:\Users\tester808\win11-full-audit.ps1 (or copy from MiniMac /tmp/win11-full-audit.ps1) |
Operating system
| Field |
Value |
| Caption |
Windows 11 (reported via Win32; build family 26100) |
| Build |
26200 OSVersion |
| Architecture |
AMD64 |
ntoskrnl.exe |
12,741 KB · v10.0.26100.9168 |
Network surface (listening)
| Port |
Process |
Notes |
| 22 |
sshd |
OpenSSH — lab management |
| 135 |
svchost |
RPC |
| 139 |
System |
NetBIOS |
| 445 |
System |
SMB |
| 5040 |
svchost |
Windows service |
| 7680 |
svchost |
Delivery Optimization |
| 49664–49675 |
lsass, services, svchost, … |
Ephemeral RPC range |
ICMP: blocked inbound (ping fails); TCP works.
Firewall profiles: Domain / Private / Public — all enabled, default inbound NotConfigured.
Local administrators
| Account |
Class |
TESTER\Administrator |
User |
TESTER\tester808 |
User |
Security services
| Service |
Status |
StartType |
Notes |
WinDefend |
Running |
Automatic |
MsMpEng.exe |
WdNisSvc |
Running |
Manual |
Network inspection |
mdcoresvc |
Running |
Automatic |
Defender core |
SecurityHealthService |
Running |
Manual |
Security Center |
Sense |
Stopped |
Manual |
MDE not onboarded |
wscsvc |
Running |
Automatic |
Security Center service |
EventLog |
Running |
Automatic |
EVTX |
mpssvc / BFE |
Running |
Automatic |
Firewall |
RemoteRegistry |
Stopped |
Disabled |
Good |
WinRM |
Stopped |
Manual |
|
ssh-agent |
Stopped |
Disabled |
|
Microsoft Defender Antivirus
| Setting |
Value |
| Product version |
4.18.26070.9 |
| Platform folder |
C:\ProgramData\...\Platform\4.18.26070.9-0\ |
| Signature version |
1.457.442.0 |
| Real-time protection |
On |
| Tamper protection |
On (IsTamperProtected: True) |
| MAPS / cloud reporting |
2 (advanced) |
| PUA protection |
2 (enabled) |
| Network protection |
0 (off) |
| Sample submission consent |
1 |
MDE sensor (Sense) |
Not running |
ASR (active)
| Rule |
GUID |
Mode |
Action |
| Block obfuscated scripts |
5beb7efe-fd9a-4556-801d-275e5ffc04cc |
Block |
1 |
Exclusions
Verified 2026-09-01 (re-check): all exclusion lists empty — ExclusionPath, ExclusionProcess, ExclusionExtension, ExclusionIpAddress are blank.
Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess, ExclusionExtension, ExclusionIpAddress
Minifilter stack (fltmc)
Defender WdFilter registered at altitude 328010 (antivirus band), 5 instances.
| Filter |
Altitude |
Role |
| WdFilter |
328010 |
Defender real-time file scan |
| applockerfltr |
265000 |
AppLocker (if policy exists) |
| luafv |
135000 |
UAC virtualization |
| FileInfo |
40500 |
File info |
Full stack captured 2026-09-01 — re-run fltmc after installing EDR or backup filters.
Key binaries (System32 + Defender)
| File |
Size (KB) |
Version (abbrev) |
ntoskrnl.exe |
12,741 |
10.0.26100.9168 |
ntdll.dll |
2,459 |
10.0.26100.8972 |
kernel32.dll |
817 |
10.0.26100.8972 |
kernelbase.dll |
4,101 |
10.0.26100.8972 |
amsi.dll |
112 |
10.0.26100.7309 |
wldp.dll |
433 |
10.0.26100.8521 |
crypt32.dll |
1,523 |
10.0.26100.1 |
sechost.dll |
692 |
10.0.26100.1 |
lsass.exe |
82 |
10.0.26100.8972 |
services.exe |
893 |
10.0.26100.8115 |
MpClient.dll (Defender path) |
1,761 |
4.18.25080.5 |
Event logs (existence / records)
| Log |
Records |
Enabled |
Lab note |
| Windows Defender/Operational |
313 |
Yes |
Primary AV telemetry |
| Security |
21,396 |
Yes |
Auth / audit (if policy on) |
| System |
1,113 |
Yes |
|
| Application |
517 |
Yes |
|
| PowerShell/Operational |
293+ |
Yes |
Script block logging enabled (4104) via installer |
| CodeIntegrity/Operational |
102 |
Yes |
CI events |
| Sysmon/Operational |
1121+ |
Yes |
Installed 2026-09-01 — SwiftOnSecurity config |
| TaskScheduler/Operational |
enabled |
Yes |
Enabled by tools installer |
Virtualization / Credential Guard
| Field |
Value |
SecurityServicesRunning |
{0} — Credential Guard not active |
VirtualizationBasedSecurityStatus |
0 |
CodeIntegrityPolicyEnforcementStatus |
2 |
Top processes (memory, audit snapshot)
| Process |
~MB |
Path |
MsMpEng |
332 |
Defender engine |
explorer |
187 |
Shell |
msedge |
147+ |
Browser |
powershell |
97 |
When auditing |
Autoruns snapshot
- Run keys (HKLM/HKCU): empty at audit
- Scheduled tasks (non-Microsoft sample): Edge update, OneDrive, SoftLanding tasks
| Component |
Location / status |
| Sysinternals Suite |
C:\Tools\Sysinternals\ — 151 tools; on Machine PATH |
| Sysmon |
C:\Tools\Sysmon\ — service Running, SysmonDrv altitude 385201 |
| 7-Zip |
winget 7zip.7zip |
| WinDbg |
winget Microsoft.WinDbg |
| Installer script |
C:\Users\tester808\win11_lab_tools_install.ps1 |
Full inventory: Lab tools inventory.
Re-install:
powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\tester808\win11_lab_tools_install.ps1
GUI access (2026-09-01)
| Method |
Port |
Status |
Notes |
| SSH |
22 |
Working |
ssh tester808@192.168.50.114 |
| RDP |
3389 |
Working |
Microsoft Remote Desktop → 192.168.50.114; lab subnet only |
| TightVNC |
5900 |
Working |
Fallback; set password via tvnserver -controlservice -setpassword |
Scripts: win11_lab_enable_rdp_audit.ps1, win11_lab_post_gui_ad.ps1
Advanced audit policy (2026-09-01)
Enabled via win11_lab_enable_rdp_audit.ps1:
- Process Creation / Termination (4688 with command line)
- Logon / Special Logon / Account Management categories
auditpol /get /category:*
# Full audit (admin)
powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\tester808\win11-full-audit.ps1
# Quick health
Get-MpComputerStatus | fl *
fltmc
Get-Service WinDefend, WdNisSvc, Sense
From MiniMac:
ssh tester808@192.168.50.114
Navigation
← MOC · Defender · Evidence & EVTX