Endpoint Protection · Topic 1 of 9
Windows Security Components, Features and Baselines
Learn how Windows security works: LSASS, SAM, access tokens, Defender, BitLocker, UAC, Credential Guard and baselines from CIS, STIG and Microsoft.
- 4 min
- The access token holds SIDs and privileges, and the SRM checks it against the ACL.
- LSASS handles logon and password verification, and the SAM holds local hashes.
- UAC limits silent use of administrator rights, and BitLocker encrypts volumes.
What it is
Windows is the most common enterprise endpoint operating system, so it is the most common target. A network defender must know which built-in components make security decisions, which features reduce risk, and what a secure starting configuration looks like.
A security baseline is a documented set of settings that every Windows system of a given role should start from. It is the answer to the question "what does secure look like here?"
How it works
Windows OS and its security concerns
Windows runs many services, supports legacy protocols and is installed on huge numbers of machines. Typical concerns are unpatched vulnerabilities, weak or reused passwords, excessive local administrator rights, legacy protocols such as SMBv1 and NTLM, and malware delivered by email or the web.
Defenders reduce these concerns by patching, by limiting privileges, by turning off what is not needed and by monitoring logs.
Windows security components
| Component | What it does |
|---|---|
| Security Identifier (SID) | A unique value that identifies a user, group or computer |
| Access token | Created at logon. Holds the user's SID, group SIDs and privileges. |
| Security Reference Monitor (SRM) | Kernel component that checks a token against an object's access list |
| Local Security Authority (LSA) and LSASS | Enforces local security policy and handles logons and password checks. The process is lsass.exe. |
| Security Accounts Manager (SAM) | Database of local account names and password hashes |
| Winlogon | Handles the interactive logon and logoff |
| Active Directory | Central directory of domain accounts, using Kerberos by default |
| Access control list (ACL) | Attached to an object. Its entries (ACEs) allow or deny a SID. |
| Event log service | Records security events for auditing |
Authentication proves who you are. Authorization compares your token to the ACL. Auditing records the result. Kerberos is the default domain protocol, and NTLM is the older challenge response protocol used as a fallback.
Windows security features
| Feature | Purpose |
|---|---|
| Windows Update | Delivers security patches |
| Microsoft Defender Antivirus | Built in malware protection |
| Windows Defender Firewall | Host based firewall with inbound and outbound rules |
| User Account Control (UAC) | Prompts before an action needs administrator rights |
| BitLocker | Full volume encryption, often with a TPM |
| Encrypting File System (EFS) | Encrypts individual files and folders |
| Secure Boot and Trusted Boot | Allow only signed boot software |
| Windows Hello | Biometric or PIN sign in |
| SmartScreen | Warns about malicious sites and downloads |
| Credential Guard | Isolates secrets such as NTLM hashes and Kerberos tickets using virtualization based security |
| AppLocker and App Control for Business | Allow only approved applications to run |
| Audit policy | Controls which events are logged |
Most of these are managed centrally through Group Policy or a device management service.
Windows security baseline configurations
A baseline turns many settings into one repeatable standard. Sources include:
- Microsoft security baselines, published with the Security Compliance Toolkit.
- CIS Benchmarks from the Center for Internet Security, with levels that trade strictness against usability.
- DISA STIGs from the US Department of Defense.
The process is to pick a baseline, apply it with Group Policy to a test group, fix what breaks, deploy it, and then measure drift by scanning machines against it. Any approved deviation is documented as an exception.
A worked example
A company deploys 500 new laptops. The administrator applies the CIS Benchmark through Group Policy, enables BitLocker with a TPM, turns on Credential Guard and sets Defender Firewall to block inbound connections by default. A weekly compliance scan reports any laptop whose settings differ from the baseline.
How the exam asks about this
- "Which Windows component stores local account password hashes?" → The Security Accounts Manager (SAM).
- "Which feature isolates credentials using virtualization based security?" → Credential Guard.
- "What is a documented set of approved secure settings called?" → A security baseline (for example a CIS Benchmark).
What to remember for the exam
- The access token holds SIDs and privileges, and the SRM checks it against the ACL.
- LSASS handles logon and password verification, and the SAM holds local hashes.
- UAC limits silent use of administrator rights, and BitLocker encrypts volumes.
- Baselines come from Microsoft, CIS and DISA, and are enforced with Group Policy.
- Scanning against the baseline finds configuration drift.
BitLocker protects data at rest, but a running, unlocked machine still exposes its data. Do not choose encryption as the answer to a malware question.
Common mistakes
Mixing up the SAM and Active Directory. The SAM holds local accounts on one machine. Active Directory holds domain accounts on domain controllers.
Treating UAC as antivirus. UAC only asks for approval before elevation. It does not detect malware.
Applying a baseline without testing. A strict baseline can break applications, so it is piloted before wide rollout.
Check yourself
What does the Security Reference Monitor do?
It compares a user's access token to an object's ACL to allow or deny access.
Which feature allows only approved programs to run?
Application control, such as AppLocker or App Control for Business.
Name three sources of Windows security baselines.
Microsoft security baselines, CIS Benchmarks and DISA STIGs.
Topic 1 of 9 in Endpoint Protection
Test yourself on Endpoint Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.