2.5 – Windows Security - Defender Antivirus

• To use most operating systems, you must log in and Windows is no exception.
• There are different options for logging in.

Login Options

• One option is with accounts stored on the local device, referred to as local accounts, providing access to that specific Windows device.
• Alternatively, a Microsoft account, configured on the Microsoft Cloud, can be used to log in to the local device.
• Microsoft account logins integrate with Microsoft technologies like Skype, Office, and OneDrive.
• In offices or enterprises, users log in with their Windows domain credentials.

Account Storage

• Local account details are stored under local users and groups.
• This includes a list of users who can log in to the device, along with their rights and permissions.
• Users can be added to groups to grant them specific rights and permissions.
• Adding a user to the administrators group grants them administrative access on the device.
• Other groups include event log readers and remote management users.
• The most common login credentials are a username and password.

Authentication Options

• After logging into Windows, other authentication options are available, like a personal identification number (PIN).
• Windows includes biometrics for logging in, such as facial recognition if the device has a camera.
• On a Windows domain, single sign-on eliminates the need to re-enter credentials when connecting to other resources.

Managing Login Methods

• To add or change login methods, access the settings under accounts and sign-in options.
• Options include facial recognition, fingerprint recognition, PIN, security key with USB, password, or picture password.

NTFS Permissions

• On a local device, file rights and permissions are based on the permissions associated with NTFS.
• Every file or folder in NTFS has a Security tab to specify the groups/users with access and their associated rights/permissions.

Share Permissions

• When connecting across a network, access is subject to share permissions and NTFS permissions.
• Share permissions are associated with access to a share across the network.
• The most restrictive access between share permissions and NTFS permissions takes priority.
• If a share has full access, but NTFS permissions are set to read-only, access will be read-only.

Inheritance

• NTFS permissions are inherited from the parent folder.
• Assigning permissions to a folder applies those permissions to its subfolders and files, unless otherwise specified.
• Moving an NTFS file/folder to a different folder on the same volume retains its original permissions.

Permission Types

• NTFS permissions offer configuration options like full control, modify, read and execute, and list folder contents.
• Share permissions allow assigning users and groups with options for full control, change, and read.
• Explicit permissions are assigned to objects in the file system.
• Inherited permissions are automatically associated with an object based on its parent.

Elevated Accounts

• By default, not every user has access to every part of the operating system.
• Elevated or administrator rights are needed to edit system files, install services, and perform enhanced functions.
• Even with assigned administrator rights, they take effect only when explicitly requested.
• To run an application with elevated rights, right-click and choose "Run As Administrator."

User Account Control

• Windows includes User Account Control (UAC), which limits user capabilities until approval is granted.
• Standard users may see a UAC window to use the network or change a password.
• Administrators may see a UAC window when installing applications or updating device drivers.
• The secure desktop UAC window provides information about changes and potential risks.
• An unexpected UAC window for a normal application requires careful consideration.

BitLocker

• A powerful security feature in Windows is the ability to encrypt an entire volume using BitLocker.
• BitLocker encrypts everything, including personal files and the operating system.
• Encrypting safeguards data if a laptop is lost or stolen, even if the storage drive is moved to another system.
• BitLocker To Go encrypts data written to a USB flash drive.

Encrypting File System

• Encrypting File System (EFS) can encrypt specific files or folders.
• EFS only exists in NTFS meaning most versions of Windows have the feature
• EFS works in all Windows editions except the home editions.
• The encryption key used for EFS is based on the user's username and password.
• Resetting a user's password administratively may cause loss of access to EFS encrypted data.