100 days to secure your environment webinar series: Week 1

Week 1: Let’s get to work

This week was all about getting a clear picture: what we're setting out to do, what's happening in your environment, and how to start tightening things up without overwhelming your team. We are starting to make smart, early moves that quietly raise the bar for any would-be cybercriminals.

A quick note

This webinar series is designed to be as technology-agnostic as possible. You don’t need ThreatLocker to participate, but it certainly helps.

If you want to follow along more easily, we’d be happy to help you get started with a ThreatLocker agent. Just book a demo to chat with a ThreatLocker Solutions Engineer and get a 30-day free trial to the entire ThreatLocker platform.

Copy the PowerShell script

# Get all members of the local Administrators group
$adminGroup = [ADSI]"WinNT://./Administrators,group"
$adminMembers = @()
foreach ($member in $adminGroup.psbase.Invoke("Members")) {
   $user = $member.GetType().InvokeMember("Name", 'GetProperty', $null, $member, $null)
   $adminMembers += $user
}
# Get last logon info for each admin account
$adminInfo = foreach ($admin in $adminMembers) {
   try {
       $userAccount = Get-LocalUser -Name $admin -ErrorAction Stop
       [PSCustomObject]@{
           Username     = $userAccount.Name
           Enabled      = $userAccount.Enabled
           LastLogon    = $userAccount.LastLogon
           Description  = $userAccount.Description
       }
   } catch {
       Write-Warning "Could not retrieve info for $admin"
   }
}
# Export to CSV
$adminInfo | Export-Csv -Path "$env:USERPROFILE\Desktop\AdminAccounts.csv" -NoTypeInformation
Write-Output "Admin account information exported to Desktop\AdminAccounts.csv"

Now, time to knock out your homework.

Read the Week 1 blogs

• Disable Windows from Getting To Know You component
• Setting password policies in Entra ID, Active Directory Group Policy and local security policies
• Audit and eliminate unused local admin accounts to further secure your environment
• Enforce a password-protected screensaver

Conquered Week 1?

You're ready to go on to week 2 of the series!