1)	Delete user orochimaru with lusrmgr tool, exit the tool and then watch your score for a minute
 2)	Use lusrmgr to check for user orochimaru.  
 3)	This user is persistent, how did this happen?   It seems to be scheduled

 4)	Search google for Microsoft system internals process explorer
 5)	Download the application and save the file
 6)	Open the file location
 7)	Right click on ProcessExplorer zip file and select Extract All…
 8)	Right click on procexp64 and run as administrator → Agree
 9)	Off menu Options → Click Verify Image Signatures
 10)	Off menu Options → VirusTotal.comt → click on Check VirusTotal.com → yes
 11)	Click the Verified Signer column header to sort unsigned items to top
 12)	Sadly Microsoft didn’t sign Skype and WinStore App, just need to ignore
 13)	score.exe and nssm.exe are part of the scoring engine on this image so ignore them also
 14)	Is there anything else shown that could be the issue?

 15)	Search google for Microsoft system internals autoruns
 16)	Download the application and save the file
 17)	Open the file location
 18)	Right click on Autoruns and select Extract All…
 19)	Right click on Autoruns64 and run as administrator → Agree
 20)	Off menu Options → Scan Options … → click on Check VirusTotal.com → Rescan → yes
 21)	Look for items that are pink
 22)	Under the Drivers section notice there is a Bluetooth driver that indicates it’s from Microsoft but isn’t signed.  This is legitemet, from Microsoft.  It’s bad that Microsoft didn’t sign this.  
 23)	There are two pink lines under scheduled task.  

 24)	Google npcapwatchdog task
 25)	Is this something that needs to be delt with?

 26)	Google system_profile
 27)	Is this something that needs to be delt with?
 28)	Right click on system_profile → Jump to Image …
 29)	In this directory structure is there anything that you could look for to see if this is the program in question?
 30)	In the file explorer window that popped up click on SystemProfileManager to un-highligh the currently highlighted executable
 31)	In the seach window try content:orochimaru
 32)	double click on the file to see the contents
 33)	Do you think this is related to what we saw in 1-3 above?
 34)	Read forensic question number 1, might this be related?
 35)	Back to autoruns, right click on system_profile → Jump to Entry …
 36)	Click on Task Scheduler Library and find system_profile in the top center box
 37)	Click on system_profile
 38)	Back to task scheduler, the bottom middle box, click Triggers to see what causes this task to run
   Not so helpful
 39)	Double click on system_profile then in this popup click the Triggers tab, then double click on each Trigger entry, which will pop up another window.  
 40)	Notice the event IDs, try them in the foresnic questions, did you get any points?  

 41)	If WinUserProfileManager is a logic bomb then it should be removed from the system
 42)	Back to autoruns right click system_profile → Jump to Image…
 43)	In the file explorer window that popped up click the up arrow to the left of the directory path
 44)	Now SystemProfileManager is highlighted in the list.  
 45)	Right click SystemProfileManager and select rename change it to TBD_SystemProfileManager
    This was just a to temporary disable anything in this directory instead of deleting it
 46)	In the command prompt bring up lusrmgr and delete the orochimaru account again, if we’ve fixed the right issue it should come back.  Watch the score for a minue
 47)	We need to also disable the entry in the task scheduler, right click on system_profile and you can either pick disable or delete.  At this point we know this is a problem so pick delete. Disable would be another option to check things out,like we did by changing the directory name above
 48)	In autoruns select menu option File → refresh
 49)	system_profile is gone.
 50)	If you want you can go back and delete the directory we change to TBD_SystemProfileManager

 51)	There is another logic bomb on this system that isn’t highlighted by autoruns
 52)	Bring up new file explorer window and nagivate to C:\Users
 53)	Double click on each users direcory to make sure we have access to files, then back to c:\Users
 54)	Make sure View tab has Hidden items enabled
 55)	kind:music
 56)	Delete all the music files then check score, you should have two lines related to deleting Gaara’s music
 57)	Once one of the score lines goes away, check for file explorer again, did anything come back?

 58)	Because we ran process explorer at the start of this exercise we know that the process isn’t persistent.  As auto runs didn’t identify any non-signed items then it’s most likely a script that kicks off based on some action.  So looking for powershell associated with task scheduler would be a good starting place to look.    
 59)	From auto runs under Task Scheduler it shows three powershell scripts being kicked off.  Only one of them shows up in the Task Schedule GUI.  So look at it.
 60)	In Task Scheduler double click on Windows Special Updates → Actions
 61)	Double click “Start a program”
 62)	Look at the add argument field to get the name of the script.  Copy the script name
 63)	Past the script name in location field of file explorer
 64)	What does this show?  Is it what we’re looking for?
 65)	In task schedule right click on Windows Special Updates and select disabled
 66)	Go back to file exploer where it shows Thriller.mp3 and delete the file again
 67)	Wait a minute and see if it comes back.
 68)	Look at the powersheel script again.  The source file for the copy has an executable file extensions then it’s copied over as an mp3 file.  
 69)	Delete the source file
 70)	What files are in the directory containing the script?
 71)	Just one file so delete the directory and the script file
 72)	In Task Scheduler delete the Windows Special Update entry

 73)	Start a cmd terminal as adminstrator
 74)	In the command terminal bring up the local security policy tool:  secpol
 75)	Set the password policy
 76)	It’s been disable by group policy

 77)	You can modify policy via command line in admin cmd terminal, harding guide page 9 has the instructions
 1.	change directory:   cd c:\Users\kakashi
 2.	export the security policy:  secedit  /export  /cfg  .\secpol.cfg
 3.	edit policy: notepad  secpol.cfg
 1.	Change MinimumPasswordAge from 0 to 5
 2.	Change MaximumPasswordAge from -1 to 90
 3.	Save the file
 4.	secedit /configure /db c:\windows\security\local.sdb /cfg .\secpol.cfg /areas SECURITYPOLICY

 78)	 Change group policy to allow using local security policy tool.
 79)	 In  admin cmd terminal 
 1.	bring up group policy editor:  gpedit
 2.	Double click User Configuration → Administrative Templates → All Settings
 3.	Click “State” column header to get any configured items to the top
 4.	Double click “Security Settings”  as this is the one that disables local security policy tool
 5.	Change to Not Configured ot Enabled  → OK 
 80)	Back in admin command terminal bring up local security policy editor: secpol
 81)	You should now have access to GUI for modifying items if you desire
 82)	Go back to the group policy editor, are their other items under the User Configuration All Settings that have been modified that you might want to change?
 83)	Double click on Computer Configurations → Administrative Templates → All Settings
 1.	Click “State” column header to get any configured items to the top
 2.	Are there any items here you might want to change?
 1.	Conigure Automate Updates is DISABLED!!!!
 2.	They’ve asked about “Use Windows Hello for Business” before.  Here it is in the group policy.

 84)	done