> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/03-windows-security-basics/windows-security-checkpoint.md).

# Windows Security Basics Checkpoint

Use this page to confirm that the first Windows security exercises are complete before moving into dedicated monitoring labs.

## Verify the Environment

Confirm that:

* `DC01` is running as the ZyberLab domain controller
* `CLIENT01` is joined to the domain
* the lab domain user can sign in successfully
* Event Viewer opens normally on both systems
* the Security log contains recent events

## Verify the Exercises

You should now be able to explain and demonstrate:

| Topic            | Expected result                                  |
| ---------------- | ------------------------------------------------ |
| Event Viewer     | Navigate Windows logs and inspect an event       |
| Security log     | Identify common security event fields            |
| Successful logon | Find Event ID 4624                               |
| Failed logon     | Find Event ID 4625                               |
| Account lockout  | Find Event ID 4740 after the controlled lab test |
| Windows Firewall | Review profiles and existing rules               |
| Account context  | Explain local vs domain accounts                 |
| Audit policy     | Explain why auditing controls event generation   |

## Questions to Answer

Before continuing, make sure you can answer these in your own words:

1. What is the Windows Security log?
2. What is the difference between Event ID 4624 and 4625?
3. Why is a single failed logon usually not enough to identify an attack?
4. Where would you look for a domain account lockout event?
5. Why should you avoid disabling Windows Firewall just to make a connection work?
6. What is the difference between `CLIENT01\user` and `ZYBERLAB\user`?
7. Why does audit policy matter to security monitoring?

## Take a Snapshot

If the environment is stable, create a VMware snapshot for both systems.

Suggested name:

```
Windows Security Basics Complete
```

This provides a clean recovery point before adding additional monitoring tools or changing audit configuration.

## Next Stage

The next section will use these fundamentals to perform small security monitoring exercises such as:

* reviewing authentication activity
* identifying account changes
* identifying group membership changes
* investigating suspicious Windows events
* building a simple event-based investigation workflow

The focus will remain manual and beginner-friendly before introducing larger monitoring platforms.