Complete Hands-On Guide for Enterprise Security
Master Microsoft's Enterprise Security Stack
Build a complete enterprise security environment with Microsoft's leading security tools. Learn to detect, investigate, and respond to advanced threats using Microsoft Defender for Endpoint, Microsoft Sentinel, and Azure Security Center.
This lab environment simulates a real enterprise network. Take notes of your configurations - you'll be building upon each lab progressively!
Ensure you have everything ready before starting
This lab will create multiple virtual machines. Ensure your system meets the minimum requirements to avoid performance issues.
Prepare your system for the labs
# Open PowerShell as Administrator
# Enable Hyper-V feature
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All -NoRestart
# Restart your computer to apply changes
Restart-ComputerIf you have Windows Home Edition or prefer alternative virtualization:
Get your free E5 license for testing
You now have a Microsoft 365 E5 tenant with full security features for 90 days (renewable)!
Activate your free Azure subscription
Create your lab virtual machines
# Create directory for VMs
New-Item -Path "C:\VMs" -ItemType Directory -Force
# Create virtual switch (one time only)
New-VMSwitch -Name "LabSwitch" -SwitchType Internal
# Configure network for switch
New-NetIPAddress -InterfaceAlias "vEthernet (LabSwitch)" -IPAddress 192.168.10.1 -PrefixLength 24
# Create Domain Controller VM
New-VM -Name "DC01" -MemoryStartupBytes 4GB -Generation 2 `
-NewVHDPath "C:\VMs\DC01\DC01.vhdx" -NewVHDSizeBytes 80GB `
-SwitchName "LabSwitch"
Set-VMProcessor -VMName "DC01" -Count 2
Set-VMMemory -VMName "DC01" -DynamicMemoryEnabled $true -MinimumBytes 2GB -MaximumBytes 4GB
Add-VMDvdDrive -VMName "DC01"
Set-VMDvdDrive -VMName "DC01" -Path "C:\ISOs\WindowsServer2022.iso"
Set-VMFirmware -VMName "DC01" -EnableSecureBoot Off
# Start VM
Start-VM -VMName "DC01"
# Connect to VM
vmconnect localhost DC011. Boot from ISO
2. Select Windows Server 2022 Standard (Desktop Experience)
3. Set Administrator password: P@ssw0rd123!
4. Configure static IP: 192.168.10.10
# Create CLIENT01
New-VM -Name "CLIENT01" -MemoryStartupBytes 4GB -Generation 2 `
-NewVHDPath "C:\VMs\CLIENT01\CLIENT01.vhdx" -NewVHDSizeBytes 60GB `
-SwitchName "LabSwitch"
Set-VMProcessor -VMName "CLIENT01" -Count 2
Add-VMDvdDrive -VMName "CLIENT01"
Set-VMDvdDrive -VMName "CLIENT01" -Path "C:\ISOs\Windows10Enterprise.iso"
Set-VMFirmware -VMName "CLIENT01" -EnableSecureBoot Off
# Start VM
Start-VM -VMName "CLIENT01"# Create CLIENT02
New-VM -Name "CLIENT02" -MemoryStartupBytes 4GB -Generation 2 `
-NewVHDPath "C:\VMs\CLIENT02\CLIENT02.vhdx" -NewVHDSizeBytes 60GB `
-SwitchName "LabSwitch"
Set-VMProcessor -VMName "CLIENT02" -Count 2
Add-VMDvdDrive -VMName "CLIENT02"
Set-VMDvdDrive -VMName "CLIENT02" -Path "C:\ISOs\Windows10Enterprise.iso"
Set-VMFirmware -VMName "CLIENT02" -EnableSecureBoot Off
# Start VM
Start-VM -VMName "CLIENT02"# Install AD DS Role
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
# Import AD Deployment module
Import-Module ADDSDeployment
# Create domain
$SafeModePassword = ConvertTo-SecureString "P@ssw0rd123!" -AsPlainText -Force
Install-ADDSForest `
-DomainName "securitylab.local" `
-DomainNetbiosName "SECURITYLAB" `
-SafeModeAdministratorPassword $SafeModePassword `
-InstallDns `
-Force
# Server will restart automaticallyDeploy and configure enterprise endpoint protection
Duration: 3-4 hours | Difficulty: Advanced
# Navigate to script location
cd C:\Temp
# Run onboarding script
.\WindowsDefenderATPOnboardingScript.cmd
# You should see:
# "Successfully onboarded machine to Microsoft Defender for Endpoint"
# Verify onboarding
cd "C:\Program Files\Windows Defender Advanced Threat Protection\Classification"
dir
# Should see MsSense.exe and other filesWait 5-10 minutes, then check the portal. Your devices should appear under Assets > Devices
# Create test directory
New-Item -Path "C:\SecurityTests" -ItemType Directory -Force
# Try to create EICAR test file (will be blocked)
$eicar = 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'
Set-Content -Path "C:\SecurityTests\eicar.txt" -Value $eicar
# Expected: Operation will fail
# Error: "This file contains a virus or potentially unwanted software"Verify in Portal: Go to Incidents & alerts > Alerts. You should see "Virus detected - Eicar_Test_File"
# Create suspicious encoded command
$command = "Get-Process"
$bytes = [System.Text.Encoding]::Unicode.GetBytes($command)
$encodedCommand = [Convert]::ToBase64String($bytes)
# Execute encoded PowerShell (suspicious behavior)
powershell.exe -EncodedCommand $encodedCommand
# Create another suspicious pattern
powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "Write-Host 'Test'"MITRE ATT&CK: T1059.001 (PowerShell)
# Simulate LSASS enumeration (will trigger alert)
# View LSASS process info
Get-Process lsass | Select Name, Id, Path
# Run credential enumeration command
cmdkey /list
# Check for saved credentials
rundll32.exe keymgr.dll,KRShowKeyMgrMITRE ATT&CK: T1003.001 (OS Credential Dumping: LSASS Memory)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("encodedcommand", "bypass", "hidden")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| order by Timestamp descDeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has "lsass"
| where InitiatingProcessFileName !in~ ("werfault.exe", "taskmgr.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
| order by Timestamp descWhat you've mastered in this lab
You've successfully deployed a complete Microsoft Security environment!