Windows Internals for Security Work

About this course

This course explains the Windows operating system from a security point of view, built around a safe, isolated lab you set up yourself. You begin with the NT kernel and the user-mode versus kernel-mode boundary, then study accounts, SIDs, groups, access tokens and User Account Control. You learn how NTFS ACLs and the registry decide what runs and as whom, and how services, scheduled tasks and auto-start locations work. Networking lessons cover SMB, RDP, WinRM and the ports that matter, followed by Active Directory and Kerberos basics. The final lessons focus on logging, Event IDs and Microsoft Defender, plus how misconfiguration, not exploits, usually enables privilege escalation. Each lesson ends with a hands-on challenge and a check, with a final exam toward the certificate.