Module 2: Introduction to Windows Security Fundamentals

Windows Security refers to the built-in features, tools, and best practices provided by Microsoft Windows operating systems to protect data, manage access, and defend against internal and external cyber threats.

Network Protection

Windows Defender Firewall with advanced security
IPSec for encrypted communication
Network Access Protection (NAP) (legacy) or Conditional Access in modern environments

Threat Detection and Response

Windows Defender Antivirus
Microsoft Defender for Endpoint (enterprise-grade threat detection)
SmartScreen, Exploit Guard, and Credential Guard

Microsoft's Defense-in-Depth Security Model:

A multi-layered approach that protects:

Physical layer
Network perimeter
Operating system and application layer
Identity and access
Data and content
User awareness

Introducing Security Features in Active Directory

Authentication and Authorization

Uses Active Directory, Kerberos, NTLM, and Azure AD
Controls who can access what and under what conditions
Enforced using Group Policy, role-based access control (RBAC)

How to Authenticate User Accounts in Windows Server: Methods and Best Practices

Authenticating user accounts in Windows Server refers to the process of verifying the identity of a user attempting to access a network resource. This ensures only authorized users can log in or perform specific actions. Authentication methods include password-based login, smart cards, biometrics, and multi-factor authentication using protocols like Kerberos or NTLM.

Securing Access to Resources in Windows Server: Best Practices for Network Security

Securing access to resources in Windows Server involves implementing security measures that control how users and groups interact with files, folders, printers, and other network services. It includes setting NTFS permissions, configuring shared access controls, applying Group Policy, and using role-based access to ensure only authorized users can access sensitive data or perform specific actions.

Access Control Mechanisms

NTFS Permissions for files and folders
User Account Control (UAC) to prevent unauthorized changes
Audit Policies for tracking access and changes

DACL	SACL
Specifies Access Permissions for a Resource	Specifies Users or Groups to Be Audited
ACEs List Actions That Users or Groups Can Perform	ACEs List Events to Be Audited Based on Successes or Failures

Introducing Encryption Technologies

Data Protection

BitLocker Drive Encryption for protecting drives
EFS (Encrypting File System) for securing individual files
Windows Information Protection (WIP) for business data isolation

Encrypting Stored and Transmitted Data

In the context of Windows Security Fundamentals, encrypting stored and transmitted data refers to the process of converting sensitive information into an unreadable format to protect it from unauthorized access—both when saved on disk (data at rest) and when being sent over a network (data in transit).

This ensures confidentiality, integrity, and security of critical files, user credentials, emails, and other data assets within a Windows-based infrastructure.

Introducing Public Key Infrastructure (PKI) Technology

In Windows Security Fundamentals, Public Key Infrastructure (PKI) is a framework that uses asymmetric cryptography (a public and private key pair) to secure communications, authenticate identities, and enable digital signatures.

It plays a key role in certificate-based security—such as enabling HTTPS, securing emails, and managing access in Windows environments through certificates issued by Certificate Authorities (CAs).