Exercise 2 – Manually inspecting an industrial computer
In this second exercise, we will be manually inspecting Microsoft Windows-based systems and learning how to gather information such as system/OS details, installed software, start up items, and users. This information is essential if, at some point, we want to have something to compare against. This allows us to, for example, compare configured users at some point in time against users we've configured previously, potentially allowing us to identify a new administrator account that's been added to the system.
Pulling Windows-based host information
Microsoft Windows OSes keep track of all kinds of information in a variety of locations. The trick is to find a way to extract this information in a convenient manner that works across a variety of Windows flavors. There are (external) utilities that can help with these efforts, but I believe that if it's not absolutely necessary, we shouldn't run external...
