Microsoft Windows Security Assessment
Windows assessment focuses on identity, access, and configuration. Understand accounts and groups (local vs domain, built-in groups like Administrators, and privileged groups such as Domain Admins), authentication protocols (NTLM vs Kerberos), and where credentials are exposed. Know that SAM stores local password hashes and that LSASS holds credential material in memory - relevant to credential-dumping concepts. Understand SMB and its role in file sharing and lateral movement, and why SMB signing matters.
Know the security-relevant configuration areas: patch level, local security policy (password/lockout), user rights assignments, audit policy, and services. Group Policy enforces domain settings. Understand the concept of least privilege and privilege escalation paths via misconfigured service permissions or unquoted service paths. Recognize the value of Windows Event Logs for detection (logon events, privilege use).
Trap: confusing authentication (who you are) with authorization (what you can do), and assuming a disabled account cannot be re-enabled. Another trap is treating NTLM hash as equivalent to the plaintext password - it is not, though it can be relayed or cracked.
Rule of thumb: when asked to harden or assess a Windows host, work identity first (accounts, groups, privileges), then exposure (services, shares, patches), then logging.