Windows security controls reference for AppLocker, credentials storage (SAM, LSASS, LSA, NTDS.dit), Defender, EFS, gMSA, LAPS, PowerShell constrained language mode, execution policy, SSPI, and UAC. Use this skill whenever the user needs to check, enumerate, or understand Windows security mechanisms, their configurations, or potential bypass techniques. Trigger for security assessments, hardening guidance, credential storage analysis, or when working with Windows security tools and policies.
Windows security controls reference for AppLocker, credentials storage (SAM, LSASS, LSA, NTDS.dit), Defender, EFS, gMSA, LAPS, PowerShell constrained language mode, execution policy, SSPI, and UAC. Use this skill whenever the user needs to check, enumerate, or understand Windows security mechanisms, their configurations, or potential bypass techniques. Trigger for security assessments, hardening guidance, credential storage analysis, or when working with Windows security tools and policies.
Windows Security Controls Reference
A comprehensive guide to Windows security mechanisms, their configurations, and how to enumerate them.
AppLocker Policy
AppLocker is Microsoft's application whitelisting solution that gives administrators control over which applications and files users can run. It provides granular control over executables, scripts, Windows installer files, DLLs, packaged apps, and packed app installers.
Check AppLocker Configuration
# Get effective AppLocker policy in XML format
Get-ApplockerPolicy -Effective -xml
# Get rule collections
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections
# Access rule collections programmatically
$a = Get-ApplockerPolicy -effective
$a.rulecollections
Registry path for AppLocker configurations:
HKLM\Software\Policies\Microsoft\Windows\SrpV2
AppLocker Bypass Considerations
Writable folders that may bypass AppLocker (if System32 or Windows directories are allowed):
# List antivirus products
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
wmic /namespace:\\root\securitycenter2 path antivirusproduct
# Query Defender service
sc query windefend
# Remove all Defender definitions (useful for offline machines)
"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Encrypted File System (EFS)
EFS uses symmetric File Encryption Keys (FEK) encrypted with the user's public key, stored in the file's $EFS alternative data stream.
Key EFS Concepts
FEK: Symmetric key for file encryption
Public key: Encrypts the FEK, stored in $EFS stream
Private key: Decrypts the FEK for access
Automatic decryption: Occurs when copying to FAT32 or transmitting over SMB/CIFS
Check EFS Information
# Check if user has used EFS
# Path: C:\users\<username>\appdata\roaming\Microsoft\Protect
# Check who has access to a file
cipher /c <file>
# Encrypt all files in folder
cipher /e
# Decrypt all files in folder
cipher /d
EFS Decryption Scenarios
As Authority System:
Requires victim user to be running a process
Use Meterpreter impersonate_token from incognito module
Or migrate to the user's process
With User Password:
Use tools like Mimikatz to decrypt EFS files
Group Managed Service Accounts (gMSA)
gMSAs simplify service account management with automatic password rotation and enhanced security.
gMSA Features
Automatic Password Management: 240-character passwords, auto-changed per policy
Enhanced Security: Immune to lockouts, no interactive logins
Multiple Host Support: Shared across servers
Scheduled Task Capability: Unlike regular managed service accounts
Simplified SPN Management: Auto-updates with sAMaccount/DNS changes
gMSA Password Storage
Stored in LDAP property: msDS-ManagedPassword
Auto-reset every 30 days by Domain Controllers
Encrypted as MSDS-MANAGEDPASSWORD_BLOB
Requires LDAPS or authenticated connection with 'Sealing & Secure'
Read gMSA Password
# Using GMSAPasswordReader
/GMSAPasswordReader --AccountName <accountname>
LAPS (Local Administrator Password Solution)
LAPS manages local Administrator passwords with randomized, unique, regularly changed credentials stored centrally in Active Directory.
Key points:
Passwords are randomized and unique per machine
Regularly changed according to policy
Stored in Active Directory
Access restricted via ACLs to authorized users
PowerShell Constrained Language Mode
Constrained Language Mode locks down PowerShell features, blocking COM objects and restricting .NET types.
Check Language Mode
$ExecutionContext.SessionState.LanguageMode
# Values: FullLanguage or ConstrainedLanguage
