Windows Security Fundamentals

An exhaustive technical deep dive into Windows enterprise internals, security reference monitoring, access tokens, NTFS ACLs, PowerShell hardening, security event log analysis, Active Directory architecture, Kerberos v5 authentication, Group Policy hardening, and defensive incident response triage.

INTERMEDIATE

36 hrs

12 modules · 72 lessons

Free · Locally runnable · Deterministic progression

Core Competencies & Objectives

Core architectural mechanisms, privilege boundaries, and access controls.

Attack vector analysis and living-off-the-land techniques without third-party abstraction.

High-fidelity security event logging, telemetry parsing, and forensic investigation.

Engineering defense baselines, system hardening, and automated verification scripts.

Curriculum Modules

Sequential progression enforced

Module 01

Module 01: Windows Security Architecture

6 lessons · 2 hrs 50 min

Windows kernel vs. user mode, Executive subsystems, Security Reference Monitor, access tokens, integrity levels, LSASS, and protected processes.

1.Windows Architecture: User Mode vs. Kernel Mode, the Executive, and Syscalls

30mStart

2.Security Reference Monitor (SRM) & Access Tokens: Token Structure, SIDs, and Privileges

30mLocked

3.Windows Integrity Levels: Mandatory Integrity Control (MIC) and Process Isolation

25mLocked

4.Local Security Authority Subsystem Service (LSASS): Authentication Brokerage and Credential Storage

30mLocked

5.Protected Processes (PP/PPL), Credential Guard, and Virtualization-Based Security (VBS)

30mLocked

6.Windows Defender Antivirus Architecture: Real-Time Protection, Cloud Delivery, and AMSI Integration

25mLocked

Module 02

Module 02: Windows Identity, Accounts and Access Control

Local accounts, built-in groups, SAM database, User Account Control (UAC) split tokens, service accounts, and User Rights Assignment.

6 lessons · 2 hrs 45 min

Ready to begin?

Jump into Module 01, Lesson 01 and begin building verifiable security skills.

Windows Security Fundamentals

Curriculum Modules

Module 01: Windows Security Architecture

Module 02: Windows Identity, Accounts and Access Control

Ready to begin?

Module 03: NTFS Permissions and Windows Authorization

Module 04: Windows Processes, Services and Persistence

Module 05: PowerShell Security and Execution Controls

Module 06: Windows Networking and Host Firewall

Module 07: Windows Logging, Auditing and Endpoint Defense

Module 08: Active Directory Architecture and Identity

Module 09: Kerberos, NTLM and Windows Authentication

Module 10: Group Policy, Privileged Access and AD Hardening

Module 11: Active Directory Attack Paths and Detection

Module 12: Practical Windows Security & AD Defense Labs