Endpoint Security Assessment

Get-LocalUser '[USER]': PasswordRequired=False, PasswordExpires=Never, Enabled=True. Account is member of Administrators group. RDP (3389) bound to 0.0.0.0 and ::.

Set a strong password immediately:
net user [USER] <NewStrongPassword>

Also enforce minimum complexity:
net accounts /minpwlen:14 /maxpwage:90

Critical: With RDP exposed, this is remotely exploitable.

Get-MpComputerStatus: TamperProtection=False. All other Defender features are enabled (RealTimeProtection=True, BehaviorMonitor=True, IoavProtection=True, NISEnabled=True), but can be disabled by any admin process without Tamper Protection.

Enable Tamper Protection:
1. Open Windows Security → Virus & threat protection → Settings
2. Turn on Tamper Protection

Note: This must be done via the UI or Intune — registry/GPO cannot enable it (by design).

Excluded paths: C:\GIT, C:\Users\[USER]\.ccs, C:\Users\[USER]\.claude, C:\Users\[USER]\.npm-global, fnm_multishells, Temp, claude temp, fnm, npm-cache, node_modules. Excluded processes: [Sync-Tool]\Bin\*, npm-global\node_modules\*, fnm node.exe (2 paths), Everything.exe, git-remote-https.exe, git.exe, node.exe, npm.cmd, npx.cmd, ssh.exe.

Review and reduce exclusions:
1. Remove C:\Users\[USER]\AppData\Local\Temp — high-risk malware staging area
2. Replace broad path exclusions with specific process exclusions where possible
3. Consider using Controlled Folder Access to compensate
4. Audit C:\GIT exclusion — consider per-repo exclusions instead of blanket

ScriptBlockLogging: enabled=false. ModuleLogging: enabled=false. Transcription: enabled=false. LanguageMode: FullLanguage (no Constrained Language Mode).

Enable all three PowerShell logging mechanisms:

1. Script Block Logging (most important):
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 /f

2. Module Logging:
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" /v EnableModuleLogging /t REG_DWORD /d 1 /f

3. Transcription (saves to disk):
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" /v EnableTranscripting /t REG_DWORD /d 1 /f

High-risk services on all interfaces:
- RDP (3389): svchost, bound to 0.0.0.0 + ::
- PostgreSQL (5432): postgres, bound to 0.0.0.0 + ::

Additional notable listeners: [Remote-Access-Tool] relay (21115-21119), Hyper-V (2179), VMware (902, 912), [VPN-Client], Obsidian (6699), Print Spooler.

Firewall profiles: Domain/Private/Public all enabled but inbound/outbound defaults = NotConfigured.

1. Restrict RDP via Windows Firewall to specific IPs:
netsh advfirewall firewall add rule name="RDP Restrict" dir=in action=allow protocol=TCP localport=3389 remoteip=<TRUSTED_IP>
netsh advfirewall firewall add rule name="RDP Block" dir=in action=block protocol=TCP localport=3389

2. Bind PostgreSQL to localhost: Edit postgresql.conf → listen_addresses = 'localhost'

3. Review if [Remote-Access-Tool] relay (21115-21119) and VMware (902, 912) need external exposure

net accounts: MinimumPasswordLength=0, MaximumPasswordAge=42 days, LockoutThreshold=10, LockoutDuration=10 minutes.

Enforce minimum password length:
net accounts /minpwlen:14

Also consider complexity requirements via Local Security Policy:
secpol.msc → Account Policies → Password Policy → Password must meet complexity requirements: Enabled

Windows Update service: Status=Stopped, StartType=Manual.

Verify Windows Update is functioning:
Get-Service wuauserv | Start-Service
Set-Service wuauserv -StartupType Automatic

Check for pending updates:
Install-Module PSWindowsUpdate -Force; Get-WindowsUpdate

Win32_DeviceGuard: VirtualizationBasedSecurityStatus=2 (Running). SecurityServicesRunning=[0] (None). SecurityServicesConfigured=[0] (None). Note: LSA Protection (RunAsPPL) IS enabled (mitigating factor).

Enable Credential Guard via Group Policy:
Computer Configuration → Admin Templates → System → Device Guard → Turn On Virtualization Based Security
Set 'Credential Guard Configuration' to 'Enabled with UEFI lock'

Or via registry:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags /t REG_DWORD /d 1 /f

Requires reboot.

Suspicious outbound: [Remote-Access-Tool] (PID 7944) → [EXT-RELAY-IP]:21117. Local [Remote-Access-Tool] relay: hbbs on 21115/21116/21118, hbbr on 21117/21119. All bound to :: (all interfaces).

If [Remote-Access-Tool] is intentional:
1. Verify [EXT-RELAY-IP] is a known [Remote-Access-Tool] relay server
2. Restrict relay server to listen on localhost or VPN interface only
3. Document as accepted risk

If not intentional:
1. Stop services: Stop-Service [Remote-Access-Tool]*
2. Remove: winget uninstall [Remote-Access-Tool]
3. Block ports 21115-21119 in Windows Firewall

HKCU Run keys (10): [Chat-App], Backblaze, [Media-App], Claude, [Email-Client], [VoIP-Client], Teams, [Task-App], [VPN-Mesh-Client], (default).
HKLM Run keys (1): [Chat-App] (SquirrelMachineInstalls).
Startup folder (7): [Time-Tracker], DDM2.0, Send to OneNote, [Screenshot-Tool], Dell Display Manager, [Remote-Access-Tool] Tray, [VPN-Client].
WMI subscription: SCM Event Log Filter.

Review and remove unnecessary autostart entries:
1. (default) entry in HKCU Run — likely garbage, remove
2. [Chat-App] appears twice (HKCU + HKLM) — remove one
3. Evaluate if [Time-Tracker], DDM2.0, Send to OneNote need autostart
4. WMI SCM Event Log Filter — verify this is legitimate

Use: msconfig → Startup tab, or Task Manager → Startup

AsSysCtrlService: Path='C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe' (unquoted, contains spaces). State=Stopped, StartMode=Disabled.

Quote the service path:
sc config AsSysCtrlService binPath= "\"C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe\""

Or if unused, remove the service entirely:
sc delete AsSysCtrlService

Service: Cloudflared, Path=C:\Users\[USER]\cloudflared.exe, State=Running.

Move cloudflared to a protected location:
1. Stop the service
2. Move to C:\Program Files\cloudflared\cloudflared.exe
3. Update service path: sc config cloudflared binPath= "C:\Program Files\cloudflared\cloudflared.exe"
4. Restart service

SYSTEM tasks:
1. GoogleUpdaterTaskSystem147.0.7703.0 — updater.exe --wake --system
2. SpaceManagerTask — spaceman.exe /Work (Windows built-in)
3. PerformRemediation — WaaSMedic (Windows Update self-heal)

9 total custom tasks. 6 non-Microsoft user-level tasks (Monthly Doc Audit, Vivaldi Update, Zoom Update, Google Updater x2, Backblaze).

Review SYSTEM tasks:
1. Google Updater — Consider if SYSTEM privileges are necessary; could run as user
2. SpaceManagerTask and WaaSMedic — Legitimate Windows tasks, no action needed

Monitor for new SYSTEM tasks: Get-ScheduledTask | Where-Object {$_.Principal.UserId -eq 'SYSTEM' -and $_.Author -notmatch 'Microsoft'}

Firewall profiles:
- Domain: Enabled=1, InboundDefault=NotConfigured, OutboundDefault=NotConfigured
- Private: Enabled=1, InboundDefault=NotConfigured, OutboundDefault=NotConfigured
- Public: Enabled=1, InboundDefault=NotConfigured, OutboundDefault=NotConfigured

Explicitly set firewall defaults:
Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultInboundAction Block -DefaultOutboundAction Allow

For enhanced security, consider restricting outbound:
Set-NetFirewallProfile -Profile Public -DefaultOutboundAction Block
Then add specific outbound allow rules.

LSA Protection: RunAsPPL=True. WDigest: UseLogonCredential=0, PlaintextPasswords=False.

No action required. This is properly configured and represents best-practice credential protection.

Defender status: AntivirusEnabled=True, RealTimeProtection=True, BehaviorMonitor=True, IoavProtection=True, NISEnabled=True, AntispywareEnabled=True. SignatureAge=0 days. ProductStatus=4.18.26010.5. CloudProtection=Unknown.

Verify cloud protection: Get-MpComputerStatus | Select CloudEnabled, CloudExtendedTimeout
If disabled: Set-MpPreference -MAPSReporting Advanced

ADS count: 0. Hidden executables: 0.

No action required. Clean result.