# Windows Security Fundamentals

> Chapter 6 of the Courseiva A-PLUS-220-1202 curriculum — https://courseiva.com/learn/a-plus-220-1202/windows-security-fundamentals

**Official objective:** 2.1 — Given a scenario, apply common security settings and features on Windows systems.

## Introduction

Windows security fundamentals are the set of built-in tools and settings that protect a computer from unauthorised access, malware, and data loss.  This matters for the 220-1202 exam because examiners want to know you can configure these controls in a real business scenario — not just memorise terms.  Understanding this concept separates someone who can pass a test from someone who can actually lock down a compromised workstation.

## The Front Door Lock Analogy

When you first lock your front door, you are controlling who can enter your home directly.  This step leads to a fundamental shift: your home is no longer open to anyone; only people with a key can get in.  Windows security works the same way.  A user account, protected by a password, is that initial key.  If a stranger walks up to your front door and it is unlocked, they can walk right in.  Similarly, an unsecured Windows system lets anyone who can reach it over a network access its files and settings.  

Now think about giving a spare key to a neighbour.  You trust them, but you might not want them to enter your bedroom.  On Windows, you give someone a user account, but you control their permissions.  You can allow them to read a file (like looking in your living room) but not delete it (like throwing away your furniture).  The Windows security model is a series of locks, keys, and rules that decide exactly what each person or program can do.  It is not just about the password; it is about the entire system of checks that happens after the door opens.  This is why an IT professional must configure user accounts, set folder permissions, and enable firewalls — they are installing locks on every internal door, not just the front one.  If you leave a back window open, a thief can crawl in.  If you leave a network port open, a malicious program can slip in the same way.  The analogy holds because real security is a layered defence, not a single barrier.

## Core explanation

Windows security is about controlling who can do what on a computer.  The foundation of this is the user account.  Every person who uses a Windows computer has a user account, which is a digital identity that holds their settings and permissions.  A permission is a rule that says whether a user can read, write, or delete a file or folder.  There are two main types of accounts: standard user and administrator (often called 'admin').  A standard user can run everyday programs but cannot change system settings or install new software.  An administrator can do everything — install programs, change security settings, and access all files.  This separation is critical.  If you use an admin account for everyday tasks and accidentally run a malicious program, that program has full control of your computer.  If you use a standard account, the program is limited by your permissions.

Beyond user accounts, Windows uses a feature called User Account Control (UAC).  UAC is a pop-up prompt that appears when a program tries to make a system-level change.  It asks for permission or an admin password.  This is your computer saying, 'Are you sure you want to do that?'  UAC prevents unauthorised changes from being made silently.

Another core component is the Windows Firewall.  A firewall is a software barrier that monitors network traffic.  It decides which data is allowed to enter or leave your computer based on a set of rules.  For example, the firewall can block all incoming connections unless they are responses to a request you initiated.  This stops hackers from directly connecting to your computer.

File and folder permissions are managed through something called NTFS permissions.  NTFS stands for New Technology File System, which is the file system Windows uses to organise data on a hard drive.  These permissions let you control who can open, modify, or delete specific files.  You can set permissions for individual users or groups (collections of users with the same needs).  For example, you could create a 'Sales' group and give them read-only access to the 'Customer List' file, while giving the 'Managers' group read-write access.

Windows also includes a tool called BitLocker Drive Encryption.  Encryption is a process that scrambles data so that it cannot be read without a special key or password.  BitLocker encrypts the entire drive (like a whole hard drive or USB stick) so that if the device is stolen, the thief cannot access the files.  Without the correct BitLocker recovery key, the data remains scrambled.

Security policies are another layer.  These are rules set by an IT administrator that control many aspects of the system.  Password policies enforce rules like minimum length (how many characters a password must have) and complexity (requiring uppercase, lowercase, numbers, and symbols).  Account lockout policies determine how many times you can enter a wrong password before the account is temporarily locked.  These policies prevent brute-force attacks, where an attacker tries thousands of passwords automatically.

Finally, Windows Defender (now called Microsoft Defender Antivirus) is a built-in antivirus program.  It scans files and running programs for known malware (malicious software) and blocks or removes them.  It also includes real-time protection, meaning it constantly monitors the system for suspicious activity.

In summary, Windows security fundamentals are a layered system: user accounts and UAC control access to the computer; the firewall controls network traffic; NTFS permissions control access to files; BitLocker protects data at rest; security policies enforce rules; and antivirus software detects threats.  Understanding each layer and how they work together is essential for the 220-1202 exam.

## Real-world context

Imagine you are a junior IT support technician for a small company called 'GreenLeaf Accounting'.  You get a ticket: 'User cannot access the financial reports folder on the file server.'  You walk through the steps of Windows security to solve this.

First, you check the user's account type.  You open Settings > Accounts and see the user, Sarah, is a standard user.  This is correct for an accountant — she should not have admin rights.  You then look at the shared folder.  It is located on a Windows Server machine that acts as a file server.  You right-click the folder, select 'Properties', then the 'Security' tab.  Here you see the NTFS permissions.  You notice that the 'Sales' group has 'Read' permission, but Sarah is in the 'Accounting' group.  The 'Accounting' group has no permission listed.  This is the problem.  You add the 'Accounting' group and grant 'Read & execute' and 'List folder contents' permissions.  The user's problem is solved.

Next, the company has a policy that all laptops must have BitLocker enabled.  You receive a new laptop for a new hire.  You go into Control Panel > BitLocker Drive Encryption and turn it on.  The system generates a recovery key.  You save a copy of this key in Microsoft Entra ID (the cloud-based identity service) and also print a copy to put in a secure physical safe.  You explain to the new hire that if they forget their password, the recovery key is the only way to unlock the drive.

Another day, a user reports a pop-up saying 'Windows Firewall has blocked a suspicious connection.'  You open Windows Defender Firewall and see a rule that blocks inbound connections from an unknown IP address.  You verify this is not a program the user needs, so you leave the block in place.  You also check the firewall logs to see if other connection attempts were made from that IP.

When setting up a new workstation for a remote worker, you apply local security policies.  You open the Local Group Policy Editor (gpedit.msc) and navigate to Password Policy.  You set:

- Minimum password length: 8 characters
- Password must meet complexity requirements: Enabled
- Maximum password age: 90 days

You also set an account lockout policy: 5 invalid login attempts, then lock the account for 30 minutes.  This prevents attackers from guessing passwords remotely.

Finally, a user clicks a link in a phishing email and their computer starts acting strangely.  You run a full scan with Microsoft Defender Antivirus.  It detects a trojan (a type of malware disguised as a legitimate program).  Defender quarantines the file — meaning it isolates it so it cannot run — and alerts you.  You then force a password reset for the user's account because the trojan may have captured their credentials.

In a real IT role, you do not just configure these settings once.  You verify them regularly, especially after updates or when new users join.  For the exam, you need to know the step-by-step procedures and the reasoning behind each security setting.

## Exam focus

The 220-1202 exam tests Windows security fundamentals in a very specific way.  You will see scenario-based multiple-choice questions.  They do not ask 'What is BitLocker?' directly.  Instead, they give a situation like 'A laptop with sensitive customer data has been stolen.  Which security feature prevents data access?'  The correct answer is 'BitLocker Drive Encryption'.  Another common trap is asking about the difference between a standard user and an administrator account.  The exam will describe a user who cannot install a program.  The answer is that they are logged on as a standard user.

Key concepts that appear frequently:

- User Account Control (UAC): Know that UAC prompts appear when an admin action is attempted.  A common question is 'What is the purpose of UAC?'  The answer is 'To prevent unauthorised system changes by requiring explicit permission.'

- NTFS vs Share permissions: NTFS permissions apply to local and network access; share permissions only apply to network access.  The exam often asks which permission takes precedence when both are set.  The more restrictive permission wins.

- BitLocker recovery key: Know where it is stored (Microsoft Entra ID, Active Directory, or a printed copy).  A question may ask 'What do you need to access a BitLocker-encrypted drive if the user forgets their PIN?'  Answer: the recovery key.

- Windows Defender Firewall: Know that you can create inbound and outbound rules.  A question may present a scenario about a program not connecting to the internet, and the answer is to create an outbound rule to allow the program through the firewall.

- Password policies: Be able to identify a password that meets complexity requirements (e.g., 'Pa$$w0rd' is acceptable because it has uppercase, lowercase, number, symbol).  A trap could be a password like 'Password1' which has uppercase and a number but no symbol — it may or may not be valid depending on policy, but complexity requires three of four character types.

- Malware types: Ransomware, trojans, worms, and spyware appear.  You must know which Windows tool (Defender) detects them.  A scenario may describe a user whose files are being encrypted.  The answer is ransomware, and the first step is to disconnect the network.

- EFS (Encrypting File System) vs BitLocker: BitLocker encrypts the entire drive; EFS encrypts individual files.  The exam tests which one to use for a scenario.  If a file needs to be shared and encrypted on a USB drive, BitLocker To Go is for USB.

The exam loves to set traps by offering similar-sounding options.  For example, they might list 'BitLocker' and 'EFS' in the same question.  You must read the scenario carefully to see if the issue is about an entire drive or just a folder.  Another trap is confusing 'Microsoft Defender Antivirus' with 'Windows Defender Firewall'.  Remember: one protects against files, the other protects against network traffic.

## Step by step

1. **Create a Standard User Account** — Open Settings > Accounts > Family & other users.  Click 'Add someone else to this PC' and choose 'I don't have this person's sign-in information'.  Then select 'Add a user without a Microsoft account'.  Enter a username and password.  Set the account type to 'Standard User'.  This limits the account's ability to make system changes, which is the first line of defence against accidental or malicious modifications.
2. **Enable User Account Control (UAC)** — Go to Control Panel > User Accounts > Change User Account Control settings.  Move the slider to 'Always notify' (the top setting).  This makes UAC prompt for permission whenever any program tries to install software or change system settings.  It is the default and recommended setting for security.
3. **Configure NTFS Permissions on a Folder** — Right-click the folder > Properties > Security tab > Edit.  Click 'Add', type the username or group name, then click 'Check Names' to verify.  In the 'Permissions for' list, check the boxes for the desired access (e.g., Read & execute, Write).  Click OK.  This enforces who can read, write, or delete files inside that folder.
4. **Turn on BitLocker Drive Encryption** — Open Control Panel > BitLocker Drive Encryption.  Click 'Turn on BitLocker' next to the OS drive.  Choose how to unlock the drive (password or smart card).  Save the recovery key to a Microsoft account, USB drive, or printed document.  Then encrypt the drive.  This ensures that if the computer is stolen, the data is inaccessible without the key.
5. **Apply a Password Policy Using Local Group Policy** — Press Win+R, type 'gpedit.msc', and press Enter.  Navigate to Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy.  Double-click 'Minimum password length', set it to 8.  Enable 'Password must meet complexity requirements'.  Set 'Maximum password age' to 90 days.  These settings enforce stronger, regularly changed passwords.

## Comparisons

### Standard User Account vs Administrator Account

**Standard User Account:**
- Cannot install most software or drivers.
- Cannot change system-wide security settings.
- Safer for daily tasks as malware has limited reach.

**Administrator Account:**
- Can install software, drivers, and updates.
- Can change firewall, UAC, and other security settings.
- Should only be used for administrative tasks to reduce risk.

### NTFS Permissions vs Share Permissions

**NTFS Permissions:**
- Apply to local and network access.
- Control read, write, execute, delete, and more.
- Configured on the Security tab of folder properties.

**Share Permissions:**
- Only apply to network access.
- Control full control, change, and read only.
- Configured on the Sharing tab of folder properties.

### BitLocker Drive Encryption vs Encrypting File System (EFS)

**BitLocker Drive Encryption:**
- Encrypts the entire drive (volume).
- Requires a recovery key to unlock.
- Protects against physical theft of the drive.

**Encrypting File System (EFS):**
- Encrypts individual files and folders.
- Tied to the user's account certificate.
- Protects files on a drive that is already accessible.

### Windows Defender Firewall vs Microsoft Defender Antivirus

**Windows Defender Firewall:**
- Monitors and filters network traffic.
- Creates inbound and outbound rules.
- Blocks unauthorised network connections.

**Microsoft Defender Antivirus:**
- Monitors files and running programs.
- Detects and removes malware (viruses, trojans, etc.).
- Provides real-time protection against malicious code.

### Local Security Policy vs Group Policy (from Active Directory)

**Local Security Policy:**
- Applies to a single local machine only.
- Configured via gpedit.msc or secpol.msc.
- Used in workgroup environments without a domain.

**Group Policy (from Active Directory):**
- Can apply to many computers across a network.
- Configured via Group Policy Management Console on a domain controller.
- Used in business environments with Active Directory.

## Diagram

_This flowchart shows the layered security path from a user account to the final file access controls in Windows._

```mermaid
flowchart TD
    U[User] --> A[User Account]
    A --> S[Standard User]
    A --> AD[Administrator]
    S --> UAC[User Account Control]
    AD --> UAC
    UAC --> SYS[System Changes Allowed?]
    SYS -->|Yes| FW[Windows Firewall
Block/Allow Network]
    SYS -->|No| BLK[Change Blocked]
    FW --> DEF[Microsoft Defender Antivirus
Scan for Malware]
    DEF --> BIT[BitLocker Drive Encryption
Protect Data at Rest]
    BIT --> PER[NTFS Permissions
Control File Access]
```

## Common misconceptions

- **Misconception:** Setting a strong password is enough to keep a Windows computer completely secure. **Reality:** A strong password is important, but security requires multiple layers: user account control, a firewall, antivirus software, and proper permissions.  A password alone cannot stop malware or a physical theft of the hard drive. (Many people think of security as a single lock, like a front door.  They do not realise that modern threats can bypass the password by tricking the user into running a program or by stealing the physical device.)
- **Misconception:** User Account Control (UAC) is annoying and should be turned off for convenience. **Reality:** UAC is a critical security feature that prevents unauthorised system changes.  Turning it off makes the system much more vulnerable to malware, because any program can make changes without asking for permission. (New users often disable UAC because the pop-ups interrupt their workflow.  They do not understand that those pop-ups are the only barrier between a malicious program and full control of the computer.)
- **Misconception:** If a file's NTFS permissions give a user 'Read' access, they can also copy the file to a USB drive. **Reality:** NTFS 'Read' permission allows a user to view and copy the file content when they have local access to the computer.  However, if the file is on a network share, share permissions may block copying.  The user's ability to copy depends on both NTFS and share permissions, plus any USB restriction policies. (Users assume 'Read' means 'view only' but do not understand that copying is a form of reading.  IT pros need to use additional controls like Group Policy to disable USB writes if they want to prevent data exfiltration.)
- **Misconception:** Windows Defender is a separate program you have to buy and install. **Reality:** Windows Defender (Microsoft Defender Antivirus) comes built-in with Windows 10 and 11.  It is free and automatically enabled unless a third-party antivirus is installed.  It provides real-time protection and regular updates through Windows Update. (Older versions of Windows (like Windows 7) did not have built-in antivirus.  People familiar with those older systems still think antivirus is an extra purchase, so they do not realise Defender is already active and protecting them.)

## Key takeaways

- User Account Control (UAC) is a security prompt that asks for permission before making system changes, preventing silent malware execution.
- Standard user accounts have limited permissions, while administrator accounts can change system settings and install software.
- NTFS permissions control access to files and folders at the file system level, and they work alongside share permissions for network access.
- BitLocker Drive Encryption scrambles the entire drive so that stolen hard drives cannot be read without the recovery key.
- The Windows Firewall creates inbound and outbound rules to control network traffic, blocking unauthorised connections.
- Password policies set minimum length, complexity, and age rules to prevent brute-force attacks on user accounts.

## FAQ

**What is the difference between a standard user and an administrator in Windows?**

A standard user can run applications and access files but cannot install software or change system settings.  An administrator has full control over the system, including installing programs, changing security settings, and accessing all files.

**How do I turn on Windows Defender Antivirus?**

Windows Defender Antivirus is on by default in Windows 10 and 11.  You can check its status in Settings > Update & Security > Windows Security > Virus & threat protection.  If it is turned off, click 'Turn on'.

**What is a BitLocker recovery key and how do I find it?**

A BitLocker recovery key is a 48-digit numeric key that unlocks a BitLocker-encrypted drive if you forget your password.  You can find it in your Microsoft account online (at account.microsoft.com/devices/recoverykey) or printed on paper if you saved it that way.

**Does Windows Firewall block outgoing traffic by default?**

No, Windows Firewall blocks incoming traffic by default but allows most outgoing traffic.  You can create outbound rules to block specific programs or ports if needed.

**What is the difference between NTFS permissions and share permissions?**

NTFS permissions control access to files and folders on the local system and across the network.  Share permissions only apply when accessing a folder over the network.  When both are set, the more restrictive permission is applied.

**Why does my Windows keep asking for permission every time I try to install a program?**

That is User Account Control (UAC) working.  It is asking for permission because the program is trying to make system changes.  Even if you are an admin, UAC requires you to confirm the action to prevent malware from installing unnoticed.

## Check your understanding

1. **When a standard user tries to install a program and a UAC prompt appears, what happens if they do not have the administrator password?**

   Answer: The installation is blocked because UAC requires the administrator password to elevate permissions, and a standard user cannot provide it.

2. **A company laptop with BitLocker encryption is stolen.  What must the attacker obtain to read the data on the hard drive?**

   Answer: The attacker must obtain the BitLocker recovery key, which is a 48-digit numeric key required to unlock the encrypted drive.

3. **What is the purpose of setting a password policy that requires a minimum of 8 characters and complexity requirements?**

   Answer: It makes passwords harder to guess or crack through brute-force attacks, thereby protecting user accounts from unauthorised access.

4. **A user can access a shared folder on the network but cannot delete a file inside it.  Which permission is likely set?**

   Answer: The NTFS permission is likely set to 'Read' (or 'Read & execute'), which allows viewing but not modifying or deleting files.

5. **What is the first step you should take when a user reports that a malicious program is encrypting their files?**

   Answer: Disconnect the computer from the network immediately to prevent the ransomware from spreading and to stop communication with its command server.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/a-plus-220-1202/windows-security-fundamentals