TN-965 Windows Security Automation with Powershell

Course Overview:

PowerShell is made for Security Operations (SecOps) automation on Windows. SecOps requires automation in order to scale out security changes and monitoring beyond a handful of hosts. For example, when a vulnerability must be remediated but there is no patch for it yet, automation is needed to quickly and consistently enact the changes necessary. PowerShell “remoting” is encrypted remote command execution of PowerShell scripts in a way that can scale to thousands of endpoints and servers.

Imagine being able to hunt for indicators of compromise across thousands of machines with just a few lines of PowerShell code. Or imagine having the local Administrator account password reset every night on thousands of endpoints in a secure way, and being able to retrieve that password securely too.

We will show you to do these tasks and more. Transcription logging for forensics, strong encryption code signing, application whitelisting of scripts, IPSec port control, and Just Enough Admin (JEA).

As more and more of our systems are moved up to the cloud, PowerShell will become even more important. Amazon Web Services, Microsoft Azure, Office 365, Hyper-V and VMware already support PowerShell administration for many tasks.

Attendees to TN-965: Windows Security Automation with PowerShell will receive TechNow approved course materials and expert instruction.

Date/Locations:

Date/Time	Event
01/06/2025 - 01/10/2025 08:00 -16:00	TN-965 Windows Security Automation with Powershell TechNow, Inc, San Antonio TX
04/28/2025 - 05/02/2025 08:00 -16:00	TN-965 Windows Security Automation with Powershell TechNow, Inc, San Antonio TX
07/07/2025 - 07/11/2025 08:00 -16:00	TN-965 Windows Security Automation with Powershell TechNow, Inc, San Antonio TX
11/03/2025 - 11/07/2025 08:00 -16:00	TN-965 Windows Security Automation with Powershell TechNow, Inc, San Antonio TX

Duration: 5 days

Intended Audience
This course is intended for IT Professionals already experienced in general Windows Server and Windows Client administration or already experienced in administering and supporting Application servers and services including applications like Exchange, SharePoint, and SQL. It is broadly intended for students who want to use Windows PowerShell to automate administrative tasks from the command line, using any Microsoft or independent software vendor (ISV) product that supports Windows PowerShell manageability.

Course Objectives:

PowerShell Overview and Tips

- Getting started running commands
- Using and updating the built-in help
- Execution policies
- Fun tricks with the ISE graphical editor
- Piping .NET and COM objects, not text
- Using properties and methods of objects
- Helping Linux admins feel more at home
- Aliases, cmdlets, functions, modules, etc.
- Customizing your profile script

What Can We Do With PowerShell

- PowerShell remote command execution
- Fan-out remoting and security
- File copy via PowerShell remoting
- Capturing the output of commands
- Parsing text files and logs with regex patterns
- Searching remote event logs faster with XPath
- Mounting the registry as a drive
- Exporting data to CSV, HTML and JSON files
- Parsing and mining nmap port scanner XML output
- Running scripts as scheduled jobs
- Pushing out scripts through Group Policy
- Importing modules and dot-sourcing functions
- http://www.PowerShellGallery.com

Write your own scripts

- Writing your own functions
- Passing arguments into your scripts
- Function parameters and returning output
- Flow control: if-then, do-while, foreach, switch
- The .NET Framework class library: a playground
- How to pipe data in/out of your scripts

Continuous Secure Configuration Enforcement

- How to use Group Policy and PowerShell together
- Automate with INF security templates
- How to customize INF templates
- Microsoft Security Compliance Manager (SCM)
- SECEDIT.EXE scripting
- Building an in-house security repository for SecOps/DevOps
- NSA’s Secure Host Baseline GPOs

Group Policy Precision Targeting

- Managing Group Policy Objects (GPOs) with PowerShell
- LSDOU, Block Inheritance, Enforced GPOs
- Group Policy permissions for targeting changes
- ADMX templates for mass registry editing
- Deploying PowerShell startup and logon scripts
- WMI item-level targeting of GPO preferences
- GPO scheduled tasks to run PowerShell scripts
- Remote command execution via GPO (not remoting)
- Empowering the Hunt Team to fight back!

Server Hardening for SecOps/DevOps

- Server Manager scripting with PowerShell
- Adding and removing roles and feature
- Remotely inventory roles, features, and apps
- Why Server Nano or Server Core
- Running PowerShell automatically after service failure
- Service account identities, passwords, and risks
- Tools to reset service account passwords securely

PowerShell Desired State Configuration (DSC)

- DSC is Configuration Management built in for free
- Using DSC for continuous reinforcement of settings
- Writing your own DSC configuration scripts
- Free DSC resource modules: www.PowerShellGallery.com
- How to push DSC configurations to many targets
- DSC background job processing in push mode
- Examples: sync files, install roles, manage groups
- Auditing a remote target against a DSC MOF template
- “ApplyAndAutoCorrect” mode for continuous enforcement

PowerShell Just Enough Admin (JEA)

- JEA is Windows sudo, like on Linux
- JEA is Windows setuid root, like on Linux
- Restricting commands and arguments
- Verbose transcription logging
- How to set up and configure JEA
- Privilege Access Workstations (PAWs)

PowerShell and WMI

- Windows Management Instrumentation (WMI) service
- What is WMI and why do hackers abuse it so much?
- Using PowerShell to query WMI CIM classes
- WMI authentication and traffic encryption
- Inventory operating system versions and installed software
- WMI remote command execution versus PowerShell remoting
- PowerShell security best practices
- PowerShell transcription logging to catch hackers

Prerequisites:

Previous Windows Server and Windows Client management knowledge and hands on experience.
Experience installing and configuring Windows Server into existing enterprise environments, or as standalone installations.
Knowledge and experience of network adapter configuration, basic Active Directory user administration, and basic disk configuration.
Knowledge and hands on experience specifically with Windows Server 2012/Windows Server 2012 R2 and Windows 8/Windows 8.1 would be of benefit but is not essential.

Comments

Latest comments from students

Liked the class? Then let everyone know!

TN-245: Telecommunications Fundamentals

Course Overview:

This comprehensive course provides you with an in-depth understanding of the current telecom landscape and how voice is migrating from a circuit- to a packet-switched network. You will learn how to evaluate existing technology options to determine which will best meet your organization's data and telephony requirements, from mature digital transport/access services to emerging voice and data services using voice over packet technologies.

Attendees to TN-245: Telecommunications Fundamentals will receive TechNow approved course materials and expert instruction.

Dates/Locations:

No Events

Duration: 5 days

Course Objectives:

The Current State of the Telecom Industry
Telecom Service Providers
Digitalizing Voice
Communication Mediums and Multiplexing
Carrier Access: Customer-to-Carrier Connections
Broadband Access
Enterprise Networks
Carrier Transport Services
Data Communications and Packet-Switched Networks
Migrating Voice from Circuit-to-Packet-Switched Networks
Carrier Data Services
Ethernet Services
Remote Access Virtual Private Networks (VPNs)
Video Technology and Services
Current Mobile Wireless Services
Fixed Mobile Convergence (FMC)
Worldwide Interoperability for Microwave Access (WiMax)
Multimedia Subsystem (IMS)

Prerequisites:

None

Comments

Latest comments from students

Liked the class? Then let everyone know!

TN-323: SharePoint 2010 and 2013 for Project Management

Course Overview:

This hands-on, lab-driven course directs managers, project managers, and team leaders through the real-world process of using SharePoint to propel projects. Improve efficiency and boost the likelihood of success as you learn to build a customized Project Management Information System (PMIS), develop SharePoint project sites, build document libraries and management protocols. You will integrate Microsoft Office software, build SharePoint Workflows, archive completed projects, and much more during SharePoint project management training. Add these critical SharePoint tools to your project management expertise and experience the drastic difference that comes with truly effective project management.

Attendees to TN-323: SharePoint 2010/2013 for Project Management will receive TechNow approved course materials and expert instruction.

Date/Locations:

No Events

Duration: 3 days

Course Objectives:

SharePoint as a Project Management Information System (PMIS)
Creating a PMIS
Enabling Team Collaboration with SharePoint
Tracking Projects with SharePoint
Working with Business Intelligence
Establishing Processes and Standards with SharePoint
Managing Meeting with Meeting Workspaces
Working with Microsoft Access
Creating a PMO View
Concluding a Project

Prerequisites:

PM-223: Introduction to Project Management or equivalent knowledge
Six months experience with SharePoint as an end-user
Six months experience with SharePoint as an administrator

Comments

Latest comments from students

User: joseibarra

Instructor comments: Very patient, communicated expertly. Made the class easy to understand and how it applies in the real world.

Facilities comments: Excellent.

Liked the class? Then let everyone know!

L-395: Accelerated Linux Administration and Utilities

Course Overview:

This course is extremely fast paced and for students that have already had UNIX or Linux training, or have not worked with Linux in several months or years. This is NOT a course for students new to Linux and assumes the student requires a refresher before progressing through high end security courses that require dexterity on Linux. RedHat and Ubuntu, VMware Virtual Machines, and BackTrack are used for the instruction of this course. The student will acquire the skills to easily navigate the advanced VMware training environment and will be able to create scripts to manipulate and manage Linux. The ulimate goals of the skills of this course is to provide the student the ability to automate through scripting BackTrack tools for offensive security, forensics, and defense.

Attendees to L-395: Accelerated Linux Administration and Utilities will receive TechNow approved course materials and expert instruction.

Date/Locations:

No Events

Duration: 5 days

Course Objectives:

Day 1 and 2: Unix Review and Unix Utilities

Linux File System Archictecure and In-Depth discussion of Hard and Soft Links
Linux File, Directory, and Permissions Management
Linux archives using tar and zip
Interacting with BASH
Review of Common Linux commands
Sorting files by line or field
Regular Expressions (meta character) with grep commands to locate specific lines in files
Grep, egrep extended metacharacters, combinations-lab advanced combinations- lab Sed
Basic commands- Lab, Advanced commands- Lab, Advanced scripting -Lab
Miscellaneous commands Tr, sort, cut, past, pr -Lab
Performing non-interactive editing tasks with the sed command
Writing simple sed scripts to perform complex editing tasks
Using awk variables & arrays to sort data
Employing awk programs to manipulate numeric & textual data
Performing formatted printing in awk
Writing simple awk programs to write reports from data files
Using built-in awk functions & defining new functions
Write awk programs that make decisions based on numeric or string comparisons (branches & loops)

Day 3 – Intro to Programming / Shell Scripting

Shell Review
Shell Interpretation of Quotes & Backslash
The Bash Shell
Shell's combined with UNIX utilities
Programming Basics
Data Constructs
Programming Looping
Your Environment
More on Parameters

Day 4 and 5 – Security Fundamentals, Linux Administration

System Configuration / Kernel overview
System Maintenance / Disk and file admin
Using utilities for process control, locating files & automating maintenance tasks
System Startup / Boot Process – LILO & GRUB Configuration
Managing the Linux file system
Customization of setup files
Run Levels
Network Services / Configuration
User Management Monitoring, accessing & restricting root system access
Administration Tools
Process Control
Client side components of NFS, Samba, NTP, NIS
Server side components such as DHCP, Samba, NIS, LDAP, inet, telnet, ftp, DNS, etc.

Prerequisites:

Prior UNIX/Linux experience or training

Comments

Latest comments from students

User: mikenaya

Instructor comments: As usual, Dave was excellent and the content was very relevant to our line of work.

Facilities comments: The hotel facilities met our basic needs but it was awkward having a bathroom so close. I can't wait for the new facility to open.

User: fquinene

Instructor comments: Instructor was super knowledgeable and helped me tie in a lot of information from other OS and processes.

Facilities comments: Facility was fine

Liked the class? Then let everyone know!

TN-5320: Microsoft Modern Desktop Administrator

Course Overview:

Learn how a Modern Desktop Administrators deploys, configures, secures, manage, and monitors devices and client applications in an enterprise environment. This is a hands-on, instructor led Bootcamp focusing on the real world responsibilities of a Modern Desktop Administrator and covering the information needed for the certification exams, which are administered while attending.

If you’ve passed Exam 70-698: Configuring Windows 10 (retired March 31, 2019) you only need to take MD-101 to earn this new certification.

This certification is one of the workload administrator certification required for the Microsoft 365 Certified: Enterprise Administrator Expert certification.

Dates/Locations:

No Events

Duration: 10 Days

Course Content:

- Module 01. Installing Windows
- Module 02. Updating Windows
- Module 03. Post-Installation Configuration and Personalization
- Module 04. Configuring Peripherals and Drivers
- Module 05. Configuring Networks
- Module 06. Configuring Storage
- Module 07. Managing Apps in Windows 10
- Module 08. Configuring Authorization & Authentication
- Module 09. Configuring Data Access and Usage
- Module 10. Configuring Advanced Management Tools
- Module 11. Supporting the Windows 10 Environment
- Module 12. Troubleshooting the Windows OS
- Module 13. Troubleshooting Files & Applications
- Module 14. Troubleshooting Hardware and Drivers
- Module 15. Planning an Operating System Deployment Strategy
- Module 16. Implementing Windows 10
- Module 17. Managing Updates for Windows 10
- Module 18. Device Enrollment
- Module 19. Configuring Profiles
- Module 20. Application Management
- Module 21. Managing Authentication in Azure AD
- Module 22. Managing Devices and Device Policies
- Module 23. Managing Security

Prerequisites:

- - Microsoft 365 Certified Fundamentals (M-MS900)

Target Audience:

IT professionals who perform installation, configuration, general local management and maintenance of Windows 10 core services. Candidates may also be familiar with enterprise scenarios and cloud-integrated services.

Comments

Latest comments from students