Lab Activity : Investigate Restore & Recover Tools for System Integrity
Purpose: Assess and Document Tools to Restore and Recover System Integrity for Windows 10 Workstations.
1. Assess and document selected uses of the Windows 10Control Paneltoolduring the incident response process.
2. Assess and document selected uses of the Windows 10Windows Settings tool during the incident response process.
Your Task:
Prepare draft incident response guidance to be included in the Sifers-Grayson Incident Responder's Handbook. Your draft guidance will explain the use of Windows 10 operating system features (utilities)and describe how each could be used as part of an incident response process.
The guidance documents to be completed under this task are:
(a) Creating, Using, and Removing System Restore Points and System Image Backups
(b) Managing Installation, Removal, and Updating of Programs, Applications, and Operating System Features for Windows 10
Instructions
Part (a): Creating, Using, Removing System Restore Points for Windows 10
1. Identify appropriate sources of information andinstructions for using the Windows 10 Control Panel andSystem Restoretool. Using those sources, research the procedures required to perform the following tasks:
a. Create a system restore point for a Windows 10 system
b. Use a specific system restore point to roll-back changes made to a Windows 10 system
c. Deletesystem restore points from a Windows 10 system
2. Identify how the System Restore tool could be used during the incident response and recovery process (it may be useful in more than one phase). Typical uses include:
a. Prepare a known-good backup for operating system files and data structures (e.g. the system registry and the information stored within it)
b. Removeunauthorized configuration changes
c. Restore the system to full operating status after an attack or suspected attack
d. Remove failed software installations and/or unwanted changes to the operating system, applications software, and/or files.
3. Write a guidance document that identifies the tool, explains the capabilities it provides, and thenlists and briefly describes the recommended uses identified under item #2.
Add a list of resources that can be consulted for additional information. Next, summarize the procedures required to perform the tasks listed under item #1 (do not provide step-by-step instructions).
Close your guidance document with a Notes / Warnings / Restrictions section that answers the question "Is there anything else the incident responder needs to be aware of when using this tool?"
Part (b): Using Windows Features toManageInstallation, Removal, and Updating of Programs, Applications, and Operating System Features for Windows 10
1. Identify appropriate sources of information and instructions for usingPrograms and Features(accessed via Control Panel) and Update and Security (accessed via Windows Settings). Using those sources, research the procedures required to perform the following tasks:
a. Turn Windows 10 Features On or Off
b. Modify, Repair, or Uninstall a program or application from a Windows 10 system
c. Control Installation of Updates for Windows 10
d. Control Installation of Updates for Windows 10 Applications
2. Identify and research how the Programs and Features and Update and Security tools could be used during the incident response and recovery process. Typical uses include:
a. Turn off undesired Windows features, e.g. location services or remote access
b. Turn off features to implement a containment strategy
c. Remove unauthorized programs
d. Remove unwanted changes to operating system utilities or features, applications software, and/or patches / updates
e. Manually apply updates ("patches") for installed programs
3. Write a guidance document that identifies the tool, explains the capabilities it provides, and thenlists and briefly describes the recommended uses identified under item #2.
Add a list of resources that can be consulted for additional information. Next, summarize the procedures required to perform the tasks listed under item #1 (do not provide step-by-step instructions).
Close your guidance document with a Notes / Warnings / Restrictions section that answers the question "Is there anything else the incident responder needs to be aware of when using this tool?"