Lab Baseline — Windows 11 (192.168.50.114)
Lab Baseline — Windows 11 (192.168.50.114)
Single source of truth for the TESTER Win11 lab. Re-run the audit script after snapshots, patches, or policy changes. All Windows playbook guides reference this baseline.
| |
| SSH | ssh tester808@192.168.50.114 (password tester) |
| Hostname | TESTER |
| Last full audit | 2026-09-01 from MiniMac 192.168.50.127 |
| Re-audit script | C:\Users\tester808\win11-full-audit.ps1 (or copy from MiniMac /tmp/win11-full-audit.ps1) |
Operating system
| Field | Value |
| Caption | Windows 11 (reported via Win32; build family 26100) |
| Build | 26200 OSVersion |
| Architecture | AMD64 |
ntoskrnl.exe | 12,741 KB · v10.0.26100.9168 |
Network surface (listening)
| Port | Process | Notes |
| 22 | sshd | OpenSSH — lab management |
| 135 | svchost | RPC |
| 139 | System | NetBIOS |
| 445 | System | SMB |
| 5040 | svchost | Windows service |
| 7680 | svchost | Delivery Optimization |
| 49664–49675 | lsass, services, svchost, … | Ephemeral RPC range |
ICMP: blocked inbound (ping fails); TCP works.
Firewall profiles: Domain / Private / Public — all enabled, default inbound NotConfigured.
Local administrators
| Account | Class |
TESTER\Administrator | User |
TESTER\tester808 | User |
Security services
| Service | Status | StartType | Notes |
WinDefend | Running | Automatic | MsMpEng.exe |
WdNisSvc | Running | Manual | Network inspection |
mdcoresvc | Running | Automatic | Defender core |
SecurityHealthService | Running | Manual | Security Center |
Sense | Stopped | Manual | MDE not onboarded |
wscsvc | Running | Automatic | Security Center service |
EventLog | Running | Automatic | EVTX |
mpssvc / BFE | Running | Automatic | Firewall |
RemoteRegistry | Stopped | Disabled | Good |
WinRM | Stopped | Manual | |
ssh-agent | Stopped | Disabled | |
Microsoft Defender Antivirus
| Setting | Value |
| Product version | 4.18.26070.9 |
| Platform folder | C:\ProgramData\...\Platform\4.18.26070.9-0\ |
| Signature version | 1.457.442.0 |
| Real-time protection | On |
| Tamper protection | On (IsTamperProtected: True) |
| MAPS / cloud reporting | 2 (advanced) |
| PUA protection | 2 (enabled) |
| Network protection | 0 (off) |
| Sample submission consent | 1 |
MDE sensor (Sense) | Not running |
ASR (active)
| Rule | GUID | Mode | Action |
| Block obfuscated scripts | 5beb7efe-fd9a-4556-801d-275e5ffc04cc | Block | 1 |
Exclusions
Verified 2026-09-01 (re-check): all exclusion lists empty — ExclusionPath, ExclusionProcess, ExclusionExtension, ExclusionIpAddress are blank.
Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess, ExclusionExtension, ExclusionIpAddress
Minifilter stack (fltmc)
Defender WdFilter registered at altitude 328010 (antivirus band), 5 instances.
| Filter | Altitude | Role |
| WdFilter | 328010 | Defender real-time file scan |
| applockerfltr | 265000 | AppLocker (if policy exists) |
| luafv | 135000 | UAC virtualization |
| FileInfo | 40500 | File info |
Full stack captured 2026-09-01 — re-run fltmc after installing EDR or backup filters.
Key binaries (System32 + Defender)
| File | Size (KB) | Version (abbrev) |
ntoskrnl.exe | 12,741 | 10.0.26100.9168 |
ntdll.dll | 2,459 | 10.0.26100.8972 |
kernel32.dll | 817 | 10.0.26100.8972 |
kernelbase.dll | 4,101 | 10.0.26100.8972 |
amsi.dll | 112 | 10.0.26100.7309 |
wldp.dll | 433 | 10.0.26100.8521 |
crypt32.dll | 1,523 | 10.0.26100.1 |
sechost.dll | 692 | 10.0.26100.1 |
lsass.exe | 82 | 10.0.26100.8972 |
services.exe | 893 | 10.0.26100.8115 |
MpClient.dll (Defender path) | 1,761 | 4.18.25080.5 |
Event logs (existence / records)
| Log | Records | Enabled | Lab note |
| Windows Defender/Operational | 313 | Yes | Primary AV telemetry |
| Security | 21,396 | Yes | Auth / audit (if policy on) |
| System | 1,113 | Yes | |
| Application | 517 | Yes | |
| PowerShell/Operational | 293+ | Yes | Script block logging enabled (4104) via installer |
| CodeIntegrity/Operational | 102 | Yes | CI events |
| Sysmon/Operational | 1121+ | Yes | Installed 2026-09-01 — SwiftOnSecurity config |
| TaskScheduler/Operational | enabled | Yes | Enabled by tools installer |
Virtualization / Credential Guard
| Field | Value |
SecurityServicesRunning | {0} — Credential Guard not active |
VirtualizationBasedSecurityStatus | 0 |
CodeIntegrityPolicyEnforcementStatus | 2 |
Top processes (memory, audit snapshot)
| Process | ~MB | Path |
MsMpEng | 332 | Defender engine |
explorer | 187 | Shell |
msedge | 147+ | Browser |
powershell | 97 | When auditing |
Autoruns snapshot
- Run keys (HKLM/HKCU): empty at audit
- Scheduled tasks (non-Microsoft sample): Edge update, OneDrive, SoftLanding tasks
| Component | Location / status |
| Sysinternals Suite | C:\Tools\Sysinternals\ — 151 tools; on Machine PATH |
| Sysmon | C:\Tools\Sysmon\ — service Running, SysmonDrv altitude 385201 |
| 7-Zip | winget 7zip.7zip |
| WinDbg | winget Microsoft.WinDbg |
| Installer script | C:\Users\tester808\win11_lab_tools_install.ps1 |
Full inventory: Lab tools inventory.
Re-install:
powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\tester808\win11_lab_tools_install.ps1
GUI access (2026-09-01)
| Method | Port | Status | Notes |
| SSH | 22 | Working | ssh tester808@192.168.50.114 |
| RDP | 3389 | Working | Microsoft Remote Desktop → 192.168.50.114; lab subnet only |
| TightVNC | 5900 | Working | Fallback; set password via tvnserver -controlservice -setpassword |
Scripts: win11_lab_enable_rdp_audit.ps1, win11_lab_post_gui_ad.ps1
Advanced audit policy (2026-09-01)
Enabled via win11_lab_enable_rdp_audit.ps1:
- Process Creation / Termination (4688 with command line)
- Logon / Special Logon / Account Management categories
auditpol /get /category:*
# Full audit (admin)
powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\tester808\win11-full-audit.ps1
# Quick health
Get-MpComputerStatus | fl *
fltmc
Get-Service WinDefend, WdNisSvc, Sense
From MiniMac:
ssh tester808@192.168.50.114
Navigation
← MOC · Defender · Evidence & EVTX