Final lab: Prepare a Windows server for production and solve an incident

What you will learn in this TP

• Apply updates and a security baseline
• Encrypt with BitLocker and back up with wbadmin
• Restore and troubleshoot methodically

Introduction #

What you will learn in this section

• Apply updates and a security baseline
• Encrypt with BitLocker and back up with wbadmin
• Restore and troubleshoot methodically

Context. A new application server goes into production on Monday. You apply the operations checklist, then handle a first incident.

Prerequisites: a Windows Server 2025 VM with a second 30 GB disk for backups  ·  Estimated duration: 90 min

An up-to-date, hardened, encrypted and backed-up server, a successful restore and an incident report.

Setup #

Guided steps, with their solution.

1. 1. Update

   Why? A server going into production without the latest fixes is already vulnerable.

   Install the PSWindowsUpdate module, apply the available updates and check whether a restart is needed.

2. 2. Harden

   Why? Reducing the attack surface before network exposure.

   Check that SMBv1 is absent, require SMB signing, check Defender, enable the firewall on all three profiles with blocked-traffic logging and disable the Guest account.

3. 3. Encrypt the system disk

   Why? BitLocker protects data if the disk or VM is stolen.

   Enable BitLocker on C: (with a virtual TPM, or a recovery password only in a lab), show the status and keep the recovery key somewhere safe.

4. 4. Back up

   Why? Without a tested backup, the server is not ready for production.

   Prepare the second disk as E:, install Windows Server Backup, create a C:\AppData folder with files, run a full backup and schedule it nightly.

5. 5. Restore a folder

   Why? A backup only truly exists once restored.

   Delete C:\AppData, then restore it from the latest backup version into C:\Restau and compare the number of files.

6. 6. Solve an incident

   Why? Method: symptom, logs, cause, fix, verification, report.

   Your colleague “optimized” the server: the W32Time service no longer starts. Reproduce the failure with the first command, then troubleshoot without rereading it: status, System log, service configuration, fix and verification.

Difficulty level : ●●●●○ (4/5)