Windows Server is a popular platform that offers a range of features to help businesses manage their enterprise networks.  It is not a single operating system but rather a group of operating systems that can be used in various ways.  This lab focuses on installing Windows Server for the first time and configuring the most common features.

Estimated time for completion: 30 minutes (not including download)

Learning Objectives

• Using an image of Windows Server, install and configure Windows Server as a virtual machine in the GNS3 workspace

Prerequisites

• VirtualBox installed (tested with version 7.2.6)
• GNS3 Workspace Installed  (tested with version 2.2.59)
• Adding a VM to GNS3

Deliverables

• None – this is a preparatory lab that supports other labs in this book

Resources

• Most students at colleges and high schools can download Windows Server (with a license key) through Azure for Education.  Ask your instructor for details or a copy of the Windows Server ISO file.

Contributors and testers

• Anthony Rizza

Phase I – VirtualBox

Virtual Machine Configuration

The table below shows the minimum hardware specifications needed to install Windows Server, as outlined in Microsoft’s official documentation. These specifications are sufficient to complete the labs in this textbook, but if you encounter performance issues, you should address any bottlenecks as appropriate.

1. Download the ISO image for the version of Windows Server you intend to install
2. Open Oracle VirtualBox Manager, then select New from the toolbar to open the New Virtual Machine window
   

   

3. Under Virtual Machine Name and Operating System, enter the path to the downloaded ISO image. OS, OS Edition, and OS Version should be detected automatically. Uncheck Proceed with Unattended Installation
   

   

4. Expand Specify virtual hardware and adjust the allocated memory and vCPUs to match the minimum specs table above
   

   

5. Expand Specify virtual hard disk and set the size of the primary drive
   

   

   NOTE: 35 GB is the absolute minimum required to install, so increasing to 50 GB is usually sufficient for the labs in this textbook. If you are pushing things, you might want to increase the size. Remember, it is always easier to increase the size of a disk than to reduce it.

6. Press Finish to create the virtual machine and return to VirtualBox Manager

Windows Setup Wizard

1. In VirtualBox Manager, select the Windows Server virtual machine, then click Start on the toolbar
   

   

2. On the setup screen, leave the default values selected, then click Next
   

   

3. Select Install now
4. Highlight Standard Evaluation (Desktop Experience) and press Next
   

   

   NOTE: Desktop Experience installs the graphical user interface used throughout this textbook. The other option installs Server Core, which uses fewer resources but is managed primarily through command-line and remote administration tools.

5. Accept the license terms and click Next
6. Select Custom: Install Windows only (advanced) to perform a fresh installation on the empty virtual hard disk
   

   

7. Select the unallocated virtual hard disk, then click Next to start the installation. After a few minutes, Windows will finish installing, and the VM will reboot automatically
   

   

   NOTE: Do press any key during the restart, or the VM might boot from the installation media again.

8. Finish the VM setup by setting the local Administrator account password, then click Finish
   

   

First Login

1. Send the Ctrl+Alt+Delete secure attention sequence to the virtual machine by selecting Input -> Keyboard -> Insert Ctrl-Alt-Del from the VirtualBox menu bar
   

   

   NOTE: You can also send Ctrl+Alt+Delete by pressing Host+Delete. By default, the VirtualBox Host key is the Right Ctrl key.

2. Enter the password created for the local Administrator account, then sign in
3. When prompted to  allow the computer to be discoverable by other devices on the network, select Yes
   

   

4. Close any other introductory message or notifications. The Server Manager Dashboard should start automatically. Server Manager is the primary graphical console for viewing server status and managing many Windows Server roles, features, services, and remote servers
   

   

Changing Hostname

By default, Windows computers are given a randomly generated hostname of WIN followed by a random string of numbers and letters. Let’s change this to reflect a most specific purpose.

1. Press Win+R to open the Run dialog

   NOTE: Alternatively, right-click Start and select Run

2. Type the following executable, then press Enter to open the System Properties window

   SystemPropertiesComputerName.exe

   

3. In this example, the current hostname is WIN-QI3JFV3UAKK
   

   

4. Change it to SERVER01 by clicking Change… and typing the new name under Computer name, then click OK
5. When Windows informs you that you need to reboot to apply this change, click OK, then Close, then Restart Now
6. Verify that the new name was updated
   

   

Phase II – Configure Networking

1. Open the Run dialog and type the following command to open the Network Connections window in Control Panel

   ncpa.cpl

   

2. Right-click the interface you want to configure, then select Properties
   

   

3. Select Internet Protocol Version 4 (TCP/IPv4) and click Properties
   

   

   NOTE: I often uncheck TCP/IPv6 to disable dual-stack networking, as this book primarily focuses on IPv4 scenarios.

4. To configure the interface for DHCP, ensure that the Obtain an IP address automatically radio button is selected. Optionally, you can choose whether DNS servers are automatically assigned or select them yourself
   

   

5. Alternatively, select the Use the following IP address radio button to manually configure interface settings
   

   

   NOTE: If Validate settings upon exit is checked, Windows Network Diagnostics will start to ensure that your IP address is usable and that your gateway and DNS servers are reachable. In lab environments, it is often recommended to leave this unchecked while the network is still being built.

6. To verify network settings, return to the Network Connections window and double-click the network adapter to open its status window
   

   

7. Select Details… to see the current IP configuration
   

   

Phase III – Local Users and Groups

Background Information

Types of user accounts

Windows supports multiple types of user accounts. A local user account exists only on the computer where it was created and authenticates using that computer’s local account database. A local account can be used to sign in interactively, access files and applications, run services, and perform administrative tasks, depending on the permissions assigned to it.

Local accounts differ from domain accounts, which are centrally managed by Active Directory and can be used across multiple domain-joined computers. This section focuses on accounts stored locally on an individual Windows Server computer.

Security Principals

Windows considers objects that can be authenticated and granted permissions (such as users, groups, and computers) as security principals. Although users usually recognize a principal by a human-readable username, Windows internally assigns a unique Security Identifier (SID) to each account. This is similar to using a DNS name instead of an IP address for computers on a network, but unlike DNS names, an SID is permanently linked to a specific security principal and cannot be reused.

For example, suppose a local user named “johnB” is granted permission to access a folder. If the account is later deleted and another account is created with the same username, the new account will receive a different SID. Because the permissions were assigned to the original SID, the new “johnB” account will not inherit the original account’s permissions. This is why deleted users sometimes appear in ACLs as an unresolved SID rather than a username.

SID Structure

SIDs are structured in the following way:

S-1-5-21-1714777658-205909548-1634555351-500

For locally created accounts, the Domain Identifier identifies the Windows computer on which the account was created. The final number is the account’s Relative Identifier (RID) which distinguishes that account from other principals stored on the same computer. Most manually created accounts receive RIDs beginning at 1000, although the exact number depnds on the accounts that have already been created and deleted.

Well-Known Accounts and RIDs

Built-in Windows accounts use well-known RID values that remain constant across all Windows installations. Here are a few examples:

Common RID values are useful to know and remember when enumerating a Windows computer, as they help quickly identify which accounts or groups you find and their permissions.

The LSA and SAM

Local authentication involves several Windows security components. The Local Security Authority (LSA) is responsible for enforcing local security policies and participating in the authentication process. It evaluates logon requests, creates access tokens, and determines which rights and privileges are assigned to a user after authentication.

The Security Accounts Manager (SAM) maintains the local account database. It stores information about local users and groups, including account names, SIDs, group membership, and password hashes.  The SAM database is stored at:

Windows protects this file while the operating system is running, and ordinary users cannot read it directly. Because it contains authentication information for local accounts, the SAM is a high-value target during attacks against Windows systems. The SAM is conceptually similar to /etc/shadow on Linux operating systems.

Built-in Local Accounts

Windows Server creates several built-in accounts during installation, which all system administrators should be aware of.

Administrator

The built-in Administrator account has an RID of 500, has full, unrestricted permissions on the computer, and is enabled by default. Because of this, it should be monitored closely. Best security practices include assigning it a strong password, disabling it, and instead creating separate administrative accounts for tasks that require elevated permissions.

Guest

The built-in Guest account has an RID of 501. It is intended to provide temporary access to users who do not have individual accounts. The Guest account has very limited permissions and is disabled by default. It should remain disabled because anonymous accounts provide poor accountability. Each person who requires access should instead receive an individually identifiable account.

DefaultAccount

DefaultAccount, with RID 503, is a system-managed account used internally by Windows. It is not intended for normal interactive logons and is typically disabled. Administrators should not repurpose this account or enable it for ordinary users.

Local Users and Local Groups

Permissions can be assigned directly to a user, but Windows administration is usually easier and more consistent when permissions are assigned to security groups. A user becomes a member of one or more local groups, and those groups grant the user particular rights. Common built-in groups include:

A more extensive list of default security groups and their descriptions is available here. A newly created local user is normally added to the Users group. Adding the accounts to Administrators grants it substantially more authority and should be done only when required. The best security practice is to follow the Principle of Least Privilege, where users receive only the permissions necessary to perform their assigned tasks. Accounts with administrative privilege should be monitored closely for abuse.

Local Account Naming

A local account is associated with the computer on which it was created. It can be referenced using the following format:

For example:

The shorthand “.\” can also be used to refer to the local computer:

This notation is particularly useful on domain-joined systems because it distinguishes a local account from a domain account with the same username. For example:

is a domain account in the “example.org” Active Directory domain, while:

refers to a local user account.

Account Management Considerations

Accounts should be created for a specific purpose and removed or disabled when they are no longer needed. Shared accounts should be avoided because they make it difficult to determine which person performed a particular action. In the following exercise, you will create a local user, examine its group membership, and verify the account’s SID using both Windows GUI management and PowerShell.

local accounts

security identifier

Creating a New Local User

1. Open the Run dialog and type the following command to open the Local User and Groups management interface

   lusrmgr.msc

   

2. Right-click Users and select New User…
   

   

3. Fill out the new user’s details. In this example, the user is johnB:Security1!
   

   

   NOTE: Many organizations’ password security policies require that passwords expire after a fixed period. However, for testing purposes, I would select Password never expires.

4. Click Create, then Close, and return to the Local User and Groups management interface. You should see that the new user is listed with the other default accounts
5. Create a second account. In this example, the second user is aliceG:Password123
6. Congratulations, we now have two new local users who can log in and interact with the system
   

   

7. Returning to the sign-in page shows all local accounts available to log into the system
   

   

Adding Users to Security Groups

New users are automatically added to the built-in Users group, which gives them basic functionality on the computer, including running programs, installing certain applications, and using local printers.

Listing Group Membership

Let’s verify that our two new user accounts are members of the Users security group.

1. Return to the Local Users and Groups management interface and click Groups
2. Right-click Users and select Properties
   

   

3. Notice how both “johnB” and “aliceG” are listed as group members. Any permissions applied to Users will be applied to both accounts
   

   

Adding Users to Security Groups

Let’s say that johnB was just promoted to be a system administrator of this computer. Let’s give him elevated permissions by adding him to the Administrators security group and disable the built-in Administrator account.

1. Right click Johnny’s user account and select Properties
   

   

2. Navigate to the Member Of tab and click Add…
3. Under the Select Groups windows, type Administrators and click Check names. This should automatically fill as SERVER01\Administrators group object
   

   

4. Click OK to add the johnB user as a member of Administrators
   

   

5. Highlight Users, then click Remove to remove johnB as a member
   

   

6. Click OK to apply changes

Now that we have an administrator account tied back to a specific user, lets disable the built-in Administrator user.

1. Right-click Administrator, then click Properties
2. Select Account is disabled, then click OK
   

   

   NOTE: A quick way to identify which objects are disabled is to look for the small downward arrow next to the user (or group or computer) icon.

3.  Signing out of the current Administrator session, go back to the login page. Notice how Alice and Johnny are the only accounts listed
   

   

Phase IV – Introduction to PowerShell

Command Prompt

Command Prompt is an older CLI implementation left over from Microsoft’s early MS-DOS from the 80’s. It is fast and lightweight but supports only a limited number of commands. It also supports running scripts (known as Batch files) of DOS commands. However, it does have some features that might make it appealing in a Red Team scenario, such as limited logging capabilities. Command Prompt is located at:

1. In the Run dialog, enter the following executable to open Command Prompt

   cmd.exe

2. Type HELP to list the available commands
   

   

   NOTE: To see a full list of CMD commands, look here.

3. To learn more about a command, type HELP, then the command name. For example, to learn how to use the FIND command, type HELP FIND
   

   

4. Some commands do not work with HELP, such as ipconfig. Instead, try appending “/?” to the end of the command

   ipconfig /?

   

System Enumeration with CMD

Situational awareness in the context of cybersecurity refers to the ability to observe a target environment, gather information, and identify risks and opportunities to meet some objective. When landing on a Windows machine as a penetration tester, it is important to quickly understand your environment. The following steps cover basic commands for enumerating a system and its configuration.

1. Show detailed information about the system’s interface configuration to see domain information and what network(s) this computer is connected to

   ipconfig /all

   

2. Display the ARP table to identify recent computers the system interacted with on the LAN (if any)

   arp -a

   

3. Display detailed OS information

   SYSTEMINFO

   

4. Display the current user and their SID

   WHOAMI /USER

   

5. List the security groups of which the current user is a member

   WHOAMI /GROUPS

   

6. List the security privileges of the current user

   WHOAMI /PRIV

   

7. Display all connections and listening ports

   NETSTAT -a

   

8. View recent command history stored in memory

   DOSKEY /HISTORY

PowerShell

Introduced in 2006, PowerShell has become Microsoft’s staple for command-line management, scripting, and automation on Windows. In addition to supporting all CMD/DOS commands, PowerShell has its own unique set of modular functions, known as command-lets (cmdlets). Imported from modules, cmdlets have a standardized structure of [verb]-[noun] to describe what each cmdlet does. PowerShell and its cmdlets are feature-rich and can interact with most parts of the Windows OS.

Career Connection

Windows Server remains one of the most widely deployed enterprise server platforms across government, education, healthcare, and commercial organizations. Systems administrators, network engineers, cloud engineers, and cybersecurity professionals use Windows Server to provide centralized authentication, network services, policy management, and application hosting. The skills developed in this chapter establish the foundation for administering Microsoft enterprise environments and support many of the networking, infrastructure, and security technologies explored later in this textbook.

End of Lab