Windows Accounts, Passwords, Patching and Access

What it is

Three everyday controls keep Windows safe: strong account and password management, timely patching and tight control over who can do what. Most real intrusions use a stolen password or an unpatched flaw, so these controls matter more than exotic tools.

How it works

User account and password management

Windows has local accounts on one machine and domain accounts in Active Directory. Good practice is one account per person, no shared accounts, the built in Guest account disabled, the built in Administrator renamed or disabled, and separate admin accounts for administrative work.

Password policy is set through Group Policy (domain) or local policy. Current NIST SP 800-63B guidance favors length and screening against known breached passwords over frequent forced changes and complexity rules. Many organizations still enforce traditional settings, so know both.

Further protections include multifactor authentication, Windows Hello, fine grained password policies (different rules for different groups in a domain) and Windows LAPS, which gives every machine a unique, rotating local administrator password.

Useful security events: 4624 successful logon, 4625 failed logon, 4740 account locked out, 4720 account created and 4723/4724 password change or reset attempts.

Windows patch management

Patch management is a repeatable cycle: inventory, assess, test, deploy, verify and report. Microsoft releases its regular security updates on the second Tuesday of each month, known as Patch Tuesday. Emergency out of band patches are issued for urgent threats.

Use deployment rings: a small pilot group first, then wider groups, then everyone. Critical systems get a defined maintenance window and a rollback plan. After deployment, verify with a compliance report, because a patch that failed to install protects nothing.

User access management

The guiding rule is least privilege: give only the rights needed for the job. Day to day users should not be local administrators.

• Groups over individuals: assign permissions to groups and put users in the groups (role based access control).
• Standard versus administrator: administrators approve changes, standard users cannot install system wide software.
• NTFS and share permissions: control access to files. When both apply, the more restrictive result wins.
• Account lifecycle: create on hire, change on role move, disable immediately on departure.
• Regular access reviews: remove stale accounts and excess rights.
• Auditing: log logons, privilege use and changes to groups (event 4672 special privileges assigned, 4732 member added to a local group).

A worked example

A help desk user is found to be a member of Domain Admins from an old project. The access review removes the membership, a separate administrative account is created for the rare admin tasks, and an alert is added for any additions to the privileged group. Meanwhile WSUS pilots the monthly patches on the IT group before rolling to the rest.

How the exam asks about this

• "Which Windows event ID records a failed logon?" → 4625.
• "Which tool approves and distributes updates inside an organization's own network?" → WSUS.
• "Which principle gives users only the permissions needed for their job?" → Least privilege.