Practical Lab: Security Feature Exploration

Objective

Find out which security features your own PC has and whether they are on: Secure Boot, TPM, BitLocker, Defender, the firewall, code signatures and the Windows Security app. You only look. Nothing in this lab changes any setting.

Time: 30–40 minutes
You need: A Windows 10 or 11 PC. A few steps need an administrator PowerShell or Command Prompt (marked admin). If you do not have admin rights, skip those lines and note "no access".

GOLDEN RULE: never turn a security feature off "to test it". Not Secure Boot, not BitLocker, not Defender, not the firewall. This lab is read-only. If a result says a feature is Off, write it down, read the section again, and decide later with a clear head.

What to Open

Part 1: Firmware and Boot Security (System Information)

Open msinfo32. On the System Summary page, find these lines and write them down. (Lines your PC does not have may be missing.)

1. BIOS Mode (Legacy or UEFI): ________________
2. Secure Boot State (On, Off or Unsupported): ________________
3. Device Encryption Support (the reason, or "Meets prerequisites"): ________________
4. Virtualization-based security (Running, or Not enabled): ________________
5. Kernel DMA Protection (from Chapter 4): ________________

Tip: if a line is long, widen the window. "Device Encryption Support" can list the unmet requirements, such as TPM or Secure Boot.

Secure Boot a second way (PowerShell admin):

Confirm-SecureBootUEFI

6. Result (True, False, or an error saying it is not supported): ________________

An error such as "Cmdlet not supported on this platform" simply means the PC boots in Legacy BIOS mode, not UEFI. It matches what you saw for BIOS Mode.

Part 2: The TPM

2A. The graphical way. Run tpm.msc. Read the status box and the "TPM Manufacturer Information".

7. Status (for example "The TPM is ready for use"): ________________
8. Specification Version (hope for 2.0): ________________
9. Manufacturer Name (for example INTC for Intel, AMD, IFX for Infineon): ________________

If you see "Compatible TPM cannot be found", your PC may have the TPM switched off in UEFI settings, or it may be a very old PC. Do not change anything now.

Do not click "Clear TPM". Clearing erases the keys, and BitLocker or Windows Hello may stop working.

2B. The PowerShell way (admin):

Get-Tpm

10. TpmPresent: ____ TpmReady: ____ ManufacturerIdTxt: ____

The TPM may be a separate chip or a firmware TPM (Intel PTT or AMD fTPM). The tools cannot always tell you which. Section 4 explained the difference.

Part 3: BitLocker (admin)

manage-bde -status

Look at the Volume C: block (and others if present). Write down:

11. Conversion Status (Fully Encrypted / Fully Decrypted / Encryption in Progress): ________________
12. Protection Status (Protection On / Off): ________________
13. Encryption Method (for example XTS-AES 128 or 256): ________________
14. Key Protectors (look for "TPM", "Numerical Password"): ________________

The PowerShell form gives much the same information:

Get-BitLockerVolume

If you get "BitLocker is not supported" or the commands are missing, your edition or hardware may not include it. Windows Home may offer Device Encryption instead: check Settings → Privacy & security → Device encryption.

15. Do you know where your recovery key is saved? ________________
    (Do not type or copy the key anywhere in this lab. Just check that you could find it.)

Why this matters: If BitLocker is On and you do not know where the recovery key is, find out today. For a Microsoft account, you can look in your account's recovery key page online. Do not store the only copy on the same disk.

Part 4: Microsoft Defender (PowerShell)

Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, IsTamperProtected, AntivirusSignatureLastUpdated, AMRunningMode

16. RealTimeProtectionEnabled: ________________
17. IsTamperProtected: ________________
18. AntivirusSignatureLastUpdated (should be recent): ________________
19. AMRunningMode (Normal, or Passive if another antivirus is active): ________________

Some property names vary between Windows versions. If one is missing, the command still shows the rest.

Part 5: The Firewall (PowerShell)

Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction

20. For Domain, Private and Public: is each Enabled? ________________
21. DefaultInboundAction (expect Block or NotConfigured, which acts as block): ________________
22. DefaultOutboundAction (expect Allow or NotConfigured, which acts as allow): ________________

The older command shows the same data in text form:

netsh advfirewall show allprofiles

23. Which profile is your current network using? Run Get-NetConnectionProfile and read NetworkCategory: ________________

Part 6: Code Signing (PowerShell)

Get-AuthenticodeSignature C:\Windows\System32\notepad.exe | Format-List Status, StatusMessage, SignerCertificate

The path may differ on your Windows version (newer Notepad can be a Store app). If the file is not found, try C:\Windows\System32\cmd.exe instead.

24. Status (Valid, NotSigned...): ________________
25. SignerCertificate subject (who signed it): ________________

If Status shows NotSigned for a Windows file, remember the catalog note in Section 9: many Windows files are covered by catalog files. Check with the next step instead.

Graphical way: In File Explorer open C:\Windows\System32, right-click cmd.exe → Properties → Digital Signatures tab → select the entry → Details. You will see "This digital signature is OK" and the signer.

26. Who signed it? ________________

Part 7: Windows Security App Tour

Open Windows Security. Click through each area and only read:

27. Under Device security → Core isolation details, is Memory integrity On or Off? ________________
28. Under Device security → Security processor details, which Specification version is shown? ________________
29. Under App & browser control → Exploit protection settings, how many system settings are shown, and is DEP on by default? ________________

Optional (read-only): Get-ProcessMitigation -System shows the same system settings in text form.

What Should Happen

• Part 1 and 2 tell you whether your PC meets the Windows 11 security hardware ideas: UEFI, Secure Boot, TPM 2.0.
• Part 3 shows whether the disk is protected, and how.
• Parts 4, 5 and 7 show your guards (Defender, firewall) are running.
• Part 6 shows that a normal Windows program has a valid signature.

Interpretation Guide

Follow-Up Questions

1. Your PC reports Secure Boot Off. What kind of malware does that leave you more open to, and what other layers still help?
2. BitLocker is On with a TPM protector. A thief takes the powered-off laptop. What stops them reading your files, and what does the TPM check at boot?
3. Why is the Public profile stricter than Private? Which one is your current network using, and is that right?
4. Defender shows RealTimeProtectionEnabled = True but AntivirusSignatureLastUpdated is two weeks old. Why is that a problem?
5. Why should you never turn a protection off "just to test it", even for a few minutes?