> For the complete documentation index, see [llms.txt](https://paul-gleason.gitbook.io/sec-350-enterprise-and-network-security-controls-1/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://paul-gleason.gitbook.io/sec-350-enterprise-and-network-security-controls-1/labs/lab-10.1-windows-logging.md).

# Lab 10.1: Windows Logging

### Install AD

```powershell
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
Install-ADDSForest -DomainName “paul.local”
$pw = Read-Host -Prompt 'Enter a Password for this user' -AsSecureString 
New-ADUser -Name paul.gleason-adm -AccountPassword $pw -Passwordneverexpires $true -Enabled $true
Add-ADGroupMember -Identity "Domain Admins" -Members paul.gleason-adm
Install-WindowsFeature DNS -IncludeManagementTools
Add-DnsServerPrimaryZone -NetworkId “172.16.150.0/24” -ReplicationScope “Domain”
Add-DnsServerPrimaryZone -NetworkId “172.16.200.0/28” -ReplicationScope “Domain”
```

### Firewall Rules

MGMT-to-LAN

```bash
set firewall name mgmt-to-lan rule 30 action accept
set firewall name mgmt-to-lan rule 30 description “Allow adds service”
set firewall name mgmt-to-lan rule 30 destination address “172.16.150.100-172.16.150.250”
set firewall name mgmt-to-lan rule 30 destination port “53,88,135,389,445,686,1024-65535”
set firewall name mgmt-to-lan rule 30 protocol “tcp_udp”
```

LAN-to-MGMT

```bash
set firewall name lan-to-mgmt rule 50 action accept
set firewall name lan-to-mgmt rule 50 description “Allow adds service”
set firewall name lan-to-mgmt rule 50 destination address “172.16.200.11”
set firewall name lan-to-mgmt rule 50 destination port “53,88,135,389,445,686,1024-65535”
set firewall name lan-to-mgmt rule 50 protocol “tcp_udp”
```

### WKS01 onto Domain:

DNS configuration:

<figure><img src="/files/VOF77zyYKq4MobHqLVXf" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/R1bYXdF38iJAGedyAgZD" alt=""><figcaption></figcaption></figure>

Join Domain:

<https://www.itechguides.com/join-windows-10-to-domain/>

### Wazuh Install Windows:

#### WKS01

<figure><img src="https://lh4.googleusercontent.com/-5nSZ0hHCxa2WnMYw_gFSIT2z7QovQxE0vcM815jU1tVDVmIySsDeJ6Ft7uv4c9bYFzellL-RLO9KfAGUJox8W8PMVFiXc-OaNRwXfAyrGAHgynr_1YSJG269MyQKOQPUfwaWG0H5pkob8xyAlZUYHk" alt=""><figcaption></figcaption></figure>

<pre class="language-powershell" data-overflow="wrap" data-line-numbers><code class="lang-powershell">Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.3.10-1.msi -OutFile ${env:tmp}\wazuh-agent-4.3.10.msi; msiexec.exe /i ${env:tmp}\wazuh-agent-4.3.10.msi /q WAZUH_MANAGER='172.16.200.10' WAZUH_REGISTRATION_SERVER='172.16.200.10' WAZUH_AGENT_GROUP='windows'
<strong>NET START WazuhSvc
</strong></code></pre>

#### MGMT02

<figure><img src="https://lh6.googleusercontent.com/D8ImvoFUrsOEYsIVgLPBgkgSU8JvLkVdIxOIYI7wgghmiHlUhljDOenj3jDxhKWzbtymuzMa_R5FHr7uhZeKA3Q7fuKtEYc7QSIwvxJV6FEC0O5Ip7oF0zT5_vKqodfApdwwP7nAIDZO9ATV61mOZn0" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" lineNumbers="true" %}

```powershell
sftp paul@172.16.150.0:wazuh-agent-4.3.10-1.msi ${env:tmp}\wazuh-agent-4.3.10.msi
msiexec.exe /i ${env:tmp}\wazuh-agent-4.3.10.msi /q WAZUH_MANAGER='172.16.200.10' WAZUH_REGISTRATION_SERVER='172.16.200.10' WAZUH_AGENT_GROUP='windows'
NET START WazuhSvc
```

{% endcode %}