Final lab: Prepare a Windows server for production and solve an incident with correction

What you will learn in this TP

• Apply updates and a security baseline
• Encrypt with BitLocker and back up with wbadmin
• Restore and troubleshoot methodically

Introduction #

What you will learn in this section

• Apply updates and a security baseline
• Encrypt with BitLocker and back up with wbadmin
• Restore and troubleshoot methodically

Context. A new application server goes into production on Monday. You apply the operations checklist, then handle a first incident.

Prerequisites: a Windows Server 2025 VM with a second 30 GB disk for backups  ·  Estimated duration: 90 min

An up-to-date, hardened, encrypted and backed-up server, a successful restore and an incident report.

Setup #

Guided steps, with their solution.

1. 1. Update

   Why? A server going into production without the latest fixes is already vulnerable.

   Install the PSWindowsUpdate module, apply the available updates and check whether a restart is needed.
   See the correction

   Install-PackageProvider NuGet -Force ; Install-Module PSWindowsUpdate -Scope AllUsers -Force
   Get-WindowsUpdate
   Install-WindowsUpdate -AcceptAll -IgnoreReboot
   Get-WURebootStatus
   Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 3

2. 2. Harden

   Why? Reducing the attack surface before network exposure.

   Check that SMBv1 is absent, require SMB signing, check Defender, enable the firewall on all three profiles with blocked-traffic logging and disable the Guest account.
   See the correction

   Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol | Select-Object State
   Set-SmbServerConfiguration -RequireSecuritySignature $true -Force
   Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusSignatureLastUpdated
   Update-MpSignature
   Set-NetFirewallProfile -Profile Domain, Private, Public -Enabled True -LogBlocked True
   Get-LocalUser | Where-Object SID -like '*-501' | Disable-LocalUser
   Get-LocalUser | Select-Object Name, Enabled

3. 3. Encrypt the system disk

   Why? BitLocker protects data if the disk or VM is stolen.

   Enable BitLocker on C: (with a virtual TPM, or a recovery password only in a lab), show the status and keep the recovery key somewhere safe.
   See the correction

   Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -Restart
   Get-Tpm | Select-Object TpmPresent, TpmReady
   Enable-BitLocker -MountPoint 'C:' -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector
   Add-BitLockerKeyProtector -MountPoint 'C:' -RecoveryPasswordProtector
   (Get-BitLockerVolume C:).KeyProtector | Where-Object KeyProtectorType -eq RecoveryPassword | Select-Object KeyProtectorId, RecoveryPassword
   manage-bde -status C:

4. 4. Back up

   Why? Without a tested backup, the server is not ready for production.

   Prepare the second disk as E:, install Windows Server Backup, create a C:\AppData folder with files, run a full backup and schedule it nightly.
   See the correction

   Get-Disk | Where-Object PartitionStyle -eq RAW | Initialize-Disk -PartitionStyle GPT -PassThru |
       New-Partition -UseMaximumSize -DriveLetter E | Format-Volume -FileSystem NTFS -NewFileSystemLabel Sauvegarde -Confirm:$false
   Install-WindowsFeature Windows-Server-Backup
   New-Item C:\AppData -ItemType Directory ; 1..20 | ForEach-Object { Set-Content "C:\AppData\fichier$_.txt" "donnée $_" }
   wbadmin start backup -backupTarget:E: -include:C: -allCritical -quiet
   wbadmin get versions -backupTarget:E:

5. 5. Restore a folder

   Why? A backup only truly exists once restored.

   Delete C:\AppData, then restore it from the latest backup version into C:\Restau and compare the number of files.
   See the correction

   Remove-Item C:\AppData -Recurse -Force
   $v = (wbadmin get versions -backupTarget:E: | Select-String 'Version identifier|Identificateur de version' | Select-Object -Last 1).Line.Split(':', 2)[1].Trim()
   wbadmin start recovery -version:$v -itemType:File -items:C:\AppData -recoveryTarget:C:\Restau -recursive -quiet
   (Get-ChildItem C:\Restau -Recurse -File).Count

6. 6. Solve an incident

   Why? Method: symptom, logs, cause, fix, verification, report.

   Your colleague “optimized” the server: the W32Time service no longer starts. Reproduce the failure with the first command, then troubleshoot without rereading it: status, System log, service configuration, fix and verification.
   See the correction

   Stop-Service W32Time -Force ; Set-Service W32Time -StartupType Disabled      # panne simulée
   # Diagnostic
   Get-Service W32Time | Select-Object Status, StartType
   Start-Service W32Time                                   # échoue : service désactivé
   Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 7000, 7022, 7023, 7040; StartTime = (Get-Date).AddHours(-1) } -ErrorAction SilentlyContinue | Select-Object TimeCreated, Id, Message
   Get-CimInstance Win32_Service -Filter "Name='W32Time'" | Select-Object StartMode, StartName, PathName
   # Correction et vérification
   Set-Service W32Time -StartupType Automatic ; Start-Service W32Time
   w32tm /query /status
   # Compte rendu : symptôme, cause (type de démarrage Désactivé, événement 7040), correction, prévention (changements tracés)

Difficulty level : ●●●●○ (4/5)