Week 1: Let’s get to work

This week was all about getting a clear picture: what we're setting out to do, what's happening in your environment, and how to start tightening things up without overwhelming your team. We are starting to make smart, early moves that quietly raise the bar for any would-be cybercriminals.

You don’t need ThreatLocker to complete this webinar series successfully—but it definitely makes things easier.

If you’d like help getting set up, we’re happy to assist. Schedule a complimentary, no-obligation 30-minute session with a ThreatLocker Solutions Engineer, and we’ll walk you through installing the agent and getting started.

Use the checklist below to get started.

Download the PDF checklist

We’ve also included a PowerShell script to help you document local admin accounts and their last activity, just to make your life a bit easier.

Copy the PowerShell script

# Get all members of the local Administrators group
$adminGroup = [ADSI]"WinNT://./Administrators,group"
$adminMembers = @()
foreach ($member in $adminGroup.psbase.Invoke("Members")) {
   $user = $member.GetType().InvokeMember("Name", 'GetProperty', $null, $member, $null)
   $adminMembers += $user
}
# Get last logon info for each admin account
$adminInfo = foreach ($admin in $adminMembers) {
   try {
       $userAccount = Get-LocalUser -Name $admin -ErrorAction Stop
       [PSCustomObject]@{
           Username     = $userAccount.Name
           Enabled      = $userAccount.Enabled
           LastLogon    = $userAccount.LastLogon
           Description  = $userAccount.Description
       }
   } catch {
       Write-Warning "Could not retrieve info for $admin"
   }
}
# Export to CSV
$adminInfo | Export-Csv -Path "$env:USERPROFILE\Desktop\AdminAccounts.csv" -NoTypeInformation
Write-Output "Admin account information exported to Desktop\AdminAccounts.csv"

Now, time to knock out your homework. We’ll see you in the week 2 webinar on Tuesday, May 20, 2025 at 8 a.m. PDT/ 11 a.m. EDT/ 4 p.m. BST!