Windows system security troubleshooting

The contents of Windows system security troubleshooting mainly include the following:

Check whether there is illegal account information in the user's information.

Command: NET LOCALGROUP\ NET USER\ NET GROUP

Check if there are maliciously added service items in the system service?

Check whether the system process is abnormal

Command: TASKLIST / SVC

Check the Syslog for abnormal login operations?

Login success event ID:4648

Troubleshoot scheduled tasks for suspicious scheduled tasks?

Command: SCHTASKS / Query / FO CSV

Troubleshoot registry content for malicious registry information?

Command: REG QUERY

Troubleshoot the operating system for malicious auto-boot messages?

C:\ Windows\ win.ini C:\ Windows\ system.ini

Check to see if shared information exists?

Command: NET SHARE

Check to see if the Windows server carries out relevant security reinforcement?

Security policy, password policy, sharing, open ports, redundant services, etc.

Check if there are any anomalies in the Windows publishing application system?

* files, compressed files, configuration files, etc.

Continue to update later.