Windows Automation and Auditing practice questions

Microsoft Endpoint Configuration Manager

Why it fails: While MECM can manage configurations, it is primarily an enterprise-grade deployment system requiring significant infrastructure overhead. For a targeted task like password complexity, it is overkill compared to lightweight scripting methods that interact directly with the local SAM database on workstations.

Windows Admin Center

Why it fails: Windows Admin Center provides a GUI interface for managing servers and workstations, but it is not optimized for bulk automated enforcement of security settings across 500 nodes. It serves better as a dashboard than an automation engine for mass configuration deployments.

Task Scheduler with manual regedit

Why it fails: Registry modification is brittle and error-prone for managing password policies, which should be handled by local security databases. Task Scheduler is designed for execution timing rather than configuration management, making it an inappropriate and unstable choice for enforcing security compliance across a large fleet.

Get-Service -StartupType Automatic

Why it fails: Get-Service does not have a -StartupType parameter. The ServiceController objects it returns do not include startup type information. This parameter is not valid, so the command would fail. To filter by startup type, you must use WMI/CIM classes such as Win32_Service, which provide the StartMode property.

Get-Service | Where-Object {$_.StartType -eq 'Auto'}

Why it fails: Get-Service retrieves service objects, but the StartType property is not directly available; it is part of the Win32_Service WMI class. This command would produce an error because StartType is not a property of the ServiceController objects returned by Get-Service. To get StartType, you need to use Get-CimInstance or Get-WmiObject. Thus, this command does not work as intended.

Get-WmiObject Win32_Service | Select-Object Name, StartMode

Why it fails: This command lists all services with their StartMode, but it does not filter for automatic services. It would display all services regardless of start mode. While it provides the necessary data, it does not meet the requirement to quickly identify only those that start automatically. Additional filtering would be needed.

Scripts that are part of a module must be signed, but individual functions within the module do not require separate signatures.

Why it fails: Under AllSigned, all script files, including module files (.psm1) and any nested scripts, must be signed. While individual functions within a signed module are covered by the module's signature, the module file itself must be signed. However, the statement implies that only the module needs signing and functions are exempt, which is misleading. In reality, any script file executed must be signed, and functions are not separately signed but are protected by the module signature.

A script signed with a certificate that has expired will still run if the signature was valid at the time of signing.

Why it fails: PowerShell validates the certificate's validity at the time of script execution, not at signing. If the certificate has expired, the script will not run unless a timestamp is present and the timestamp proves the signature was created while the certificate was valid. However, without a valid timestamp, an expired certificate will cause the script to be blocked. This is a subtle point and not generally true without timestamping.

Interactive commands typed at the PowerShell prompt are blocked unless they are part of a signed script.

Why it fails: Execution policy applies only to script files (.ps1, .psm1, etc.) and not to interactive commands entered directly at the console. Commands typed manually are always allowed because they are not subject to script execution policy. This is a common misconception; AllSigned does not restrict interactive use, only the execution of script files. Therefore, this statement is incorrect.

The security log has been cleared, but the event was not recorded because auditing is disabled.

Why it fails: Event ID 1102 is logged when the security log is cleared. If the log was cleared, this event would be recorded if auditing for log clear is enabled. The absence of the event could mean either the log was never cleared or the event was not recorded due to auditing being disabled. However, the statement combines both, but the scenario does not indicate auditing is disabled. The most direct interpretation is that the log has not been cleared.

The security log has been cleared, but the event was overwritten due to log size limits.

Why it fails: If the log was cleared, Event ID 1102 would be the first event logged after the clear. It would not be overwritten unless the log was subsequently filled and overwritten according to retention settings. However, if the log was cleared and then filled, the 1102 event could be overwritten if the log wraps. But the scenario does not provide evidence of log wrapping. The more straightforward explanation is that the log was never cleared.

The security log has not been cleared since the last system restart.

Why it fails: Event ID 1102 is not tied to system restarts. It is logged when the audit log is cleared manually or programmatically. The absence of the event simply means the log has not been cleared at all since the event log was created. System restarts do not generate 1102. Therefore, this interpretation is incorrect.

Security log, Event ID 4624 (An account was successfully logged on)

Why it fails: Event ID 4624 records successful logons but does not indicate what actions were performed after logon. It cannot show whether the account modified group membership or performed other privileged operations. While it can be used to track logon activity, it lacks the specific detail needed to identify privileged operations such as adding a member to Domain Admins.

Security log, Event ID 4740 (A user account was locked out)

Why it fails: Event ID 4740 is generated when a user account is locked out due to too many failed logon attempts. It is not related to privileged operations or group membership changes. Focusing on this event would not help identify accounts performing privileged actions; it would instead show accounts that are locked out, which is a different security concern.

Security log, Event ID 4672 (Special privileges assigned to new logon)

Why it fails: Event ID 4672 indicates that a logon was granted special privileges, such as SeDebugPrivilege. While it can show which accounts have elevated privileges, it does not record modifications to group membership. It is useful for identifying accounts with administrative rights but not for tracking changes to domain admin group membership. Therefore, it does not directly answer the question.

Event ID 4624

Why it fails: Event ID 4624 records a successful logon, but it does not specifically distinguish between standard user sessions and those with administrative privileges. While useful for general traffic analysis, it lacks the specificity needed to pinpoint instances where elevated rights were granted to a session.

Event ID 4720

Why it fails: Event ID 4720 signifies that a new user account has been created within the local security database. While account creation is a sensitive event, it does not confirm that the user has successfully logged in or utilized elevated privileges during their session.

Event ID 1102

Why it fails: Event ID 1102 indicates that the security audit log has been cleared by an administrator. While this is a high-priority security event that warrants investigation, it does not provide visibility into which users have exercised elevated privileges prior to the log clearing event.

Only failure events are being audited

Why it fails: The output explicitly shows that both Success and Failure are configured. A failure-only configuration would likely display 'Failure' without the 'Success' indicator, whereas this output shows the category is fully enabled for the credential validation subcategory, indicating a comprehensive auditing stance.

Auditing is completely disabled for this category

Why it fails: If auditing were disabled, the subcategory would display 'No Auditing' or be absent from the list. The presence of 'Success and Failure' confirms that the policy is active and capturing the necessary authentication data for security monitoring purposes.

Only success events are being audited

Why it fails: The policy output clearly states 'Success and Failure', meaning auditing is not restricted to successful logins. Security policies that only audit successes would leave a massive gap in visibility, failing to detect failed brute-force attempts or credential stuffing attacks.

Get-Process -IncludeUserName

Why it fails: While this command identifies running processes and their owners, it does not reveal the configuration of local groups or persistence mechanisms. It is useful for identifying rogue binaries but falls short of the specific requirement to audit groups and tasks.

Get-Service | Where-Object {$_.Status -eq 'Running'}

Why it fails: This command audits running services, which is useful for identifying unexpected background activity. However, it does not provide information about user account membership or persistence via tasks, which are the primary focus of the requested audit requirements.

Get-WinEvent -LogName Security

Why it fails: This command accesses the security event log. While useful for finding historical data, it does not directly query the static configuration of group memberships or scheduled tasks, which are better served by the specific cmdlets designed for system management and configuration auditing.

Set-ExecutionPolicy RemoteSigned

Why it fails: RemoteSigned allows scripts created locally to run unsigned, while only downloaded scripts require a signature. This is less secure than AllSigned, as it leaves the system vulnerable to locally staged scripts that an attacker might drop onto the disk.

Set-ExecutionPolicy Unrestricted

Why it fails: Unrestricted allows all scripts to run without any verification. This is a highly dangerous configuration that nullifies the security benefits of the PowerShell execution policy, leaving the machine entirely exposed to arbitrary script execution by local or remote attackers.

Set-ExecutionPolicy Bypass

Why it fails: Bypass removes all restrictions, effectively disabling the security policy of PowerShell. This is used only for testing and should never be implemented in a production environment, as it invites security compromises through unverified and potentially malicious script execution.

Windows Registry

Why it fails: The Registry is a local database for configuration settings, but it is not designed for centralized management or distribution across domain-joined machines. Using the Registry for mass configuration changes is inefficient and impossible to maintain compared to centralized policy management tools.

Task Scheduler

Why it fails: Task Scheduler is a local execution engine for running scripts or programs at specific times. It lacks the policy-based management, versioning, and enterprise-wide deployment capabilities that GPOs provide, making it inappropriate for managing global security configurations across a domain.

Microsoft Management Console

Why it fails: The MMC is a container for administrative snap-ins used to manage individual local or remote systems. While it can be used to view settings, it does not provide the automated, centralized, domain-wide policy distribution capabilities inherent to Group Policy Objects.

Audit every single file access on the system

Why it fails: Auditing every file access causes massive log bloat, potentially leading to performance degradation and the rapid loss of important data due to log overwriting. Security auditing should be focused on sensitive files and directories rather than all system data.

Require domain admins to clear logs daily

Why it fails: Clearing logs is an destructive action that eliminates potential forensic evidence. Security policies should strictly prohibit the routine clearing of logs, as this prevents the tracking of past activities and makes it trivial for attackers to hide their footprints after a compromise.

Get-AuditPolicy

Why it fails: There is no native PowerShell cmdlet named Get-AuditPolicy. While users often look for PowerShell-specific equivalents for system tasks, the auditing framework still relies on the auditpol.exe utility for both querying and setting the advanced auditing policy configuration.

Get-SecurityPolicy -Advanced

Why it fails: This cmdlet does not exist in the default Windows PowerShell module set. Relying on incorrect commands can lead to wasted time during an audit. Administrators should use the built-in auditpol.exe utility, which is designed specifically for managing and inspecting the system's auditing configuration.

Get-EventLog -List

Why it fails: This cmdlet lists the available event logs on the system, such as System, Application, and Security. It provides information about the logs themselves, but it does not reveal the audit policy settings that dictate which specific security events are actually being captured.

Enable the "Audit Handle Manipulation" subcategory to capture file access attempts.

Why it fails: Audit Handle Manipulation logs when a handle to an object is created or closed, which can be useful for troubleshooting but generates a high volume of low-value events and does not directly record read/write access to files. It is not the correct subcategory for monitoring file reads and writes; Audit File System is the appropriate choice for object access auditing.

Configure a basic audit policy by enabling "Audit object access" in the Local Security Policy.

Why it fails: Basic audit policies aggregate multiple subcategories into one setting and can generate excessive events, making it harder to isolate file access on a specific share. They also lack the granularity of advanced audit policies, which are recommended for targeted monitoring. While it may work, it is not the best first step because it does not provide the precision needed to minimize unrelated events.

Create a new Data Collector Set in Performance Monitor to track file access on the shared folder.

Why it fails: Performance Monitor Data Collector Sets are designed for performance metrics such as disk I/O or CPU usage, not security auditing of file access. They cannot record individual file read/write operations by user. This approach would not provide the required security event logs and would fail to meet the investigation's need to track who accessed specific files.

Enable the "Audit: Force audit policy subcategory settings" policy and set the Security log to archive when full.

Why it fails: Forcing audit policy subcategory settings ensures advanced audit policies override basic ones, but it does not forward events. Archiving the log when full automatically saves the log before overwriting, but this is a local retention feature, not a forwarding solution. Neither setting addresses the requirement for centralized collection and tamper resistance across the domain.

Deploy a custom PowerShell script via Group Policy that runs at startup to copy the Security.evtx file to a network share.

Why it fails: Copying the entire Security.evtx file periodically is inefficient and can miss events between copies. It also requires the share to be writable by all workstations, introducing security risks. This method lacks real-time forwarding and does not use the built-in Windows Event Forwarding mechanism, making it less reliable and harder to manage at scale.

Configure the "Maximum Log Size" for the Security log to a large value and enable "Overwrite events as needed".

Why it fails: Increasing log size and enabling overwrite helps retain more events locally but does not forward them to a central collector. This approach leaves logs vulnerable to tampering or loss if the workstation is compromised. It also does not provide correlation across multiple machines, which is a key requirement for centralized monitoring and incident response.

Event ID 4648

Why it fails: Event ID 4648 is logged when a process attempts an explicit logon using credentials for another user. This is not an interactive logon but rather a runas or scheduled task scenario. It does not capture normal interactive logons, so it would not help identify accounts used to log on interactively to the server.

Event ID 4672

Why it fails: Event ID 4672 is logged when special privileges are assigned to a new logon session, such as administrator privileges. It does not indicate the type of logon or the account used for interactive logon. It is useful for auditing privilege use but does not answer the scenario's question about interactive logon accounts.

Event ID 4634

Why it fails: Event ID 4634 is logged when a logon session is destroyed. It does not indicate the type of logon or which user account was used. While it can be correlated with logon events, it does not directly show interactive logons. Thus, it is not the correct event to examine for identifying interactive logon accounts.

Set up a Windows Management Instrumentation (WMI) event subscription to monitor file changes.

Why it fails: WMI event subscriptions can monitor file changes, but they are not part of the Windows auditing feature set. They require custom scripting and are not the standard method for file auditing. The question specifies using Windows auditing features, so WMI is not the correct approach. Additionally, WMI subscriptions can be complex and are not enabled by default.

Enable the 'Audit process tracking' policy.

Why it fails: Audit process tracking logs events like process creation and termination, which is unrelated to file modification auditing. It does not capture file access or changes. While it can be useful for other security monitoring, it does not fulfill the requirement to audit changes to critical files. Therefore, it is not a necessary step for this scenario.

Configure a Discretionary Access Control List (DACL) to deny write access to all users.

Why it fails: A DACL controls who can access a file and what they can do, but it does not enable auditing. In fact, denying write access to all users would prevent modifications altogether, which might stop the need for auditing but does not help detect unauthorized changes if they occur through other means. The goal is to audit, not to block.

Enable the 'Policy Change' subcategory with Success auditing only.

Why it fails: Policy Change auditing tracks modifications to audit policy, trust relationships, and other security policy settings, such as Event ID 4719. It does not record the creation of local user accounts or changes to local group membership. While detecting policy changes is valuable, it would not capture the attacker's action of adding a local administrator, leaving the primary threat unmonitored.

Enable the 'Detailed Tracking' subcategory with Success auditing only.

Why it fails: Detailed Tracking auditing monitors process creation, process termination, and DPAPI activity, including Event ID 4688. It does not log account management events such as user creation or group modifications. Enabling it would generate a high volume of process-related events without providing the specific visibility needed to detect a new local administrator being added by a service account.

Enable the 'Logon/Logoff' subcategory with Failure auditing only.

Why it fails: Logon/Logoff auditing records authentication events like successful or failed logons (Event IDs 4624/4625), not account creation or group membership changes. Enabling only Failure auditing would miss successful logons by the attacker and would not capture the creation of a new local administrator. This option does not address the specific activity described and would leave the account management actions unlogged.

Configure a Group Policy Object to enable 'Audit process tracking' for all servers.

Why it fails: Audit process tracking logs process creation and termination, which can help detect malicious activity, but it does not provide individual accountability for administrative actions. The logs would still show the shared account as the user context. Therefore, it does not meet the requirement to trace actions back to individual administrators.

Enable the 'Audit: Force audit policy subcategory settings' policy.

Why it fails: This policy ensures that advanced audit policy subcategory settings take precedence over legacy audit policies. It does not address the issue of shared accounts. While it improves audit consistency, it does not enable traceability to individual administrators because the account name logged would still be the shared account. Thus, it does not meet the requirement.

Enable 'Audit: Shut down system immediately if unable to log security audits'.

Why it fails: This policy forces the system to shut down if it cannot log an audit event, ensuring no auditable event is lost. However, it does not provide individual accountability. If administrators share an account, the logs still show the shared account name. This policy addresses audit reliability, not attribution, so it is not the correct recommendation.

Get-Service -StartType Automatic | Where-Object {$_.Status -eq 'Stopped'}

Why it fails: The Get-Service cmdlet does not have a -StartType parameter. While you can filter by -Name or -DisplayName, StartType is not a valid parameter. This command would produce an error. Even if it worked, it only checks for 'Stopped' status, missing services that are in 'Paused' or 'StartPending' states. The correct approach uses Get-Service without that parameter and then filters with Where-Object.

Get-Service | Where-Object {$_.StartType -eq 'Automatic' -or $_.Status -eq 'Stopped'}

Why it fails: Using -or would return all automatic services regardless of status, plus all stopped services regardless of start type. This includes many services that are not automatic or not stopped, creating a large and inaccurate list. The goal is to find automatic services that are not running, so the condition must use -and, not -or. This command would not efficiently identify the desired services.

Get-Service | Where-Object {$_.StartType -eq 'Automatic' -and $_.Status -eq 'Stopped'}

Why it fails: This command filters for automatic services that are specifically 'Stopped'. While this might cover most cases, it excludes services that are in 'Paused', 'StartPending', or 'StopPending' states. The question asks for services not running, which includes any status other than 'Running'. Therefore, using -ne 'Running' is more accurate. This option is close but not fully correct.

EnableTranscripting (DWORD) set to 1

Why it fails: EnableTranscripting enables transcription, which records all PowerShell input and output to text files. It is configured under a different key and does not log script blocks to the event log. While transcription can be useful, it does not provide the same centralized logging as script block logging and is not the value under ScriptBlockLogging.

EnableScriptBlockInvocationLogging (DWORD) set to 1

Why it fails: EnableScriptBlockInvocationLogging is a related but separate setting that logs the start and stop of script block invocations. It is not the primary value for logging script block content. The correct value for capturing script content is EnableScriptBlockLogging. This option is a plausible distractor because it sounds similar but does not enable the desired logging.

EnableModuleLogging (DWORD) set to 1

Why it fails: EnableModuleLogging is used for module logging, which logs pipeline execution details for specified modules. It is configured under a different registry key and does not enable script block logging. Module logging captures cmdlet invocations but not the full script content. Setting this value would not achieve the goal of logging script blocks.