Checking Security Features and Detection Settings
Check malware protection, auditing, and credential protection settings. These checks help identify what information an investigation can reveal and which operations may be restricted.
Auditing and log forwarding
Section titled “Auditing and log forwarding”Audit settings show which actions will be recorded in event logs.
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\AuditIf Windows Event Forwarding (WEF) is in use, check where logs are forwarded.
reg query HKLM\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManagerCredential protection features
Section titled “Credential protection features”LAPS manages and regularly rotates each device’s local Administrator password. See the LAPS guide for how it works, including storage and read permissions.
WDigest
Section titled “WDigest”WDigest settings affect whether plaintext passwords remain in LSASS. Check the setting and compare it with the WDigest guide.
reg query 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest' /v UseLogonCredentialLSA Protection
Section titled “LSA Protection”LSA Protection restricts access to LSA by untrusted processes. Check the setting alongside the protection guide.
reg query 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA' /v RunAsPPLCredential Guard
Section titled “Credential Guard”Credential Guard reduces credential exposure that can lead to attacks such as pass-the-hash. Check the current setting alongside the feature guide.
reg query 'HKLM\System\CurrentControlSet\Control\LSA' /v LsaCfgFlagsCached credentials
Section titled “Cached credentials”Also check whether domain credentials are cached on the device. See the cached credentials guide for how they are stored and used.
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON" /v CACHEDLOGONSCOUNT