Windows Lab — First Login: Admin Readiness Checks- CyberHer Africa Labs: System Administration 101

CTF Room Windows Lab

Bridget

8 min read

·

Oct 10, 2026

--

Listen

Share

Press enter or click to view image in full size

Introduction

After working through the Linux Server Administration Baseline Lab, the next step was to do something similar on a Windows server.

One thing I’m starting to appreciate while learning cybersecurity is that you don’t always begin by looking for vulnerabilities. Before troubleshooting, securing, or changing a system, you first need to understand what you are actually working with.

This lab puts us in the role of a system administrator who has just been given access to a Windows Server supporting an active workload. The task is to build a basic picture of the server before making any changes.

So, let’s get into it.

Press enter or click to view image in full size

Solution

The first step is to start the lab. Once the server is running, we are given the IP address and credentials needed to access it through RDP.

Unlike the previous Linux lab where we connected using SSH, this time we are using Remote Desktop Protocol (RDP) to access the Windows server.

Press enter or click to view image in full size

Once connected, we are presented with the Windows desktop and can start working through the assessment.

Press enter or click to view image in full size

Before answering the questions, let’s first break down what we need to investigate:

• Identify the Windows version and system information.
• Check the filesystem and important directories.
• Inspect files and their properties.
• Check the server’s RAM and disk capacity.
• Verify that the expected services and processes are running.

We will be using powershell to run our commands

With that in mind, let’s start with the first task.

Checking User Accounts

The first thing we need to establish is who can log into the server. Since this is a Windows Server, we can use PowerShell to list the local user accounts.

I used:

Get-LocalUser

Press enter or click to view image in full size

This command lists the local user accounts configured on the machine, including their names and whether they are enabled.
The investigation identified three enabled accounts:
- Administrator
- interntom
- internjane
Knowing which accounts exist is a useful first step when reviewing access to a server. However, an enabled account does not automatically mean that someone is currently logged in or actively using it.

Question 1

You’ve just been granted access to a Windows Server that supports a production workload. Before you make any changes, you want to understand who can log into it. How many user accounts are on the machine?

3

Checking administrator privileges

Next, I needed to determine how many accounts had local administrator privileges.

Administrator accounts have elevated permissions that can allow them to install software, change system configurations, and manage other users. If these privileges are assigned too broadly, they can increase the potential impact of a compromised account.

The assessment found that one account had local administrator privileges.

Question 2:

To confirm the access model is appropriate for operations and support, you review privileged access. How many of the user accounts have local administrator privileges? Enter numerical value eg 3

1

This check highlights why account enumeration and privilege reviews are important parts of a server’s security baseline.

Identifying the Operating System and Hostname

The next step was to establish the server’s identity.

Knowing the exact operating system helps when selecting compatible security tools, checking patch requirements, and investigating operating-system-specific vulnerabilities.

I used PowerShell to retrieve the operating system information:

systeminfo | findstr /B /C:"OS Name"

The output identified the operating system as Microsoft Windows Server 2022 Datacenter

Question 3:

You’re updating the server inventory and the record requires an exact OS identifier. What is the operating system name of the server? (Enter the full name in lower case.)

microsoft windows server 2022

Finding the hostname

I also needed the server’s hostname.

A hostname provides an identifier that administrators can use when managing machines, reviewing logs, and investigating alerts across an environment.

I ran:

hostname

Question 4:

Your monitoring and configuration tools rely on hostnames, so you need the exact machine identity. What is the system name (hostname) of the Windows Server? (Enter the name in lower case.)

ec2amaz-zrqv5pa

These two checks establish the basic identity of the machine: the operating system it runs and the name used to identify it.

Checking RAM and Disk Capacity

Once I had established the server’s identity, I moved on to its hardware resources.

Resource information is useful when investigating performance issues. A server experiencing slowdowns may be under-provisioned, running resource-intensive applications, or dealing with other configuration problems.

Checking RAM

I used PowerShell to retrieve the total physical memory:

Get-CimInstance Win32_ComputerSystem |
Select-Object @{Name="RAM_GB";Expression={$_.TotalPhysicalMemory / 1GB}}

The result was approximately 4 GB of RAM.

Question 5:

Users report slow performance during busy hours, so you start by checking whether the server is under-provisioned. What is the total RAM on the server? (Enter only the numerical value.)

3.99961853027344

Checking hard disk capacity

Next, I checked the server’s disk capacity.

Get-CimInstance Win32_LogicalDisk -Filter "DriveType=3" |
Select-Object DeviceID,
@{Name="Size_GB";Expression={[math]::Round($_.Size / 1GB, 2)}}

This command returned 50GB. Which was not the correct answer.

SO I wen staright to the local disck C and checked the exact disk space which was 49.9GB

Question 6:

A scheduled job is failing with storage-related warnings, so you verify the baseline capacity. What is the hard disk size of the server? (Enter only the numerical value.)

49.9

Identifying the First Downloaded File

The next task was to establish what had been downloaded to the server.

This is useful when validating software installations and reviewing the files present on a machine.

I used PowerShell to inspect the current user’s Downloads directory:

Get-ChildItem -Path "$env:USERPROFILE\Downloads" -File -Recurse |
Sort-Object CreationTime |
Select-Object -First 1 Name, FullName, CreationTime

Here’s what the command does:

• Get-ChildItem lists files in the specified directory.
• -File restricts the results to files.
• -Recurse includes files in subdirectories.
• Sort-Object CreationTime sorts the results by creation time.
• Select-Object -First 1 returns the first result.

The first file identified was jdk-24_windows-x64_bin.

Question 7:

You are validating what was installed on the server and want to confirm the first downloaded package. Which file was the first to be downloaded on the server?

jdk-24_windows-x64_bin

Finding a Password Stored in a Text File

While inspecting the server, I encountered another task: locating a text file in a user directory that contained a password.

Storing passwords in plain-text files is poor security practice. Anyone who can access the file may be able to read the credentials, depending on the permissions applied to it.

I started by searching for text files across the C: drive:

Get-ChildItem C:\ -Recurse -File -Filter *.txt -ErrorAction SilentlyContinue |
Select-Object FullName, Length

This command searches recursively for .txt files and displays their paths and sizes.

The -ErrorAction SilentlyContinue parameter suppresses many access-denied errors that can occur when searching system directories.

Once I identified the relevant file, I used Get-Content to inspect it:

Get-Content "C:\path\to\file.txt"

I replaced the example path with the actual file path found during the search.

The password stored in the file was:youaresystemcaptain

Question 8:

While standardizing user profile setup, you find a text file in a user directory that contains a password (not best practice). To remove it and rotate credentials, you first need the exact value. What is the password stored in that text file?

youaresystemcaptain

In a real environment, discovering a password in plain text should trigger a careful response. The file should be handled according to the organization’s security procedures, the exposed credential should be rotated, and the file’s permissions and storage location should be reviewed.

Identifying the Account Running MySQL

The final task involved a database process named mysqld.exe.

Knowing which account runs a service is important because services often need permissions to access files, databases, and other system resources. Running a service with excessive privileges can increase the impact of a compromise.

I used PowerShell to retrieve the process owner:

Get-CimInstance Win32_Process -Filter "Name = 'mysqld.exe'" |
ForEach-Object {
    Invoke-CimMethod -InputObject $_ -MethodName GetOwner
} |
Select-Object -ExpandProperty User

Here’s what happens:

1. Get-CimInstance retrieves information about the running mysqld.exe process.
2. Invoke-CimMethod calls the process's GetOwner method.
3. Select-Object -ExpandProperty User displays the username returned by the method.

The username identified in the lab was mariadb.

Press enter or click to view image in full size

This provides the service name, configured startup account, and current state.

Comparing the process owner with the configured service account can help when investigating permissions or auditing how a database service is running.

Question 9:

You notice a database process running (mysqld.exe) and need to confirm it’s running under the correct service account for permissions and auditing. Which username is running the mysqld.exe service? Answer in lowercase

mariadb

Conclusion

This lab was a practical reminder that system administration starts with understanding the environment.

Before changing anything on a Windows Server, I needed to establish who could access it, which accounts had elevated privileges, what operating system it ran, and how much memory and storage it had available.

I also investigated downloaded files, located a plain-text password, and checked the account associated with a running database process.

Although these tasks were relatively straightforward, they introduced commands and investigation techniques that can be useful in system administration, troubleshooting, and security operations.

My biggest takeaway is that you need a clear baseline of a system before you can meaningfully assess or secure it. Without that baseline, it becomes harder to distinguish normal behavior from a problem that needs attention.

This is another step in my CyberHer Africa learning journey as I continue building practical skills in cybersecurity and system administration.