All right, so in the last lecture, I showed you guys how to get started with the trial and now we're
going to jump right in.
So if you don't have your Microsoft defenders for Endpoint signed up yet, you know, make sure you
go through that process first and explain how to do that in the last lecture.
Once you've got that going, you can start creating things and start setting up.
I'm going to go ahead and put my email address in here
and I'll just click next.
All right.
So enter my Microsoft account so you can create a new one.
Let's create a new account.
Randy Moralez.
All right, so we'll just set this guy's account up.
Is the fake company that we created.
Reverify, all right.
Say, Carbon Bich will be our domain name.
So you have to use something different, obviously, for your setup.
Maybe you could pick like Karvan bike one or whatever domain you're using for your range.
All right, Randi.
All right, I'm going to click sign up.
That's weird, the formatting looks really weird here.
It says, creating your account.
Signing U.N. treaty that refreshed the page.
Really, really odd formating.
All right, you're all set.
Get started.
And I'm getting access tonight as soon as I started, so let's see if we can figure out what's going
on here.
It's pretty crazy.
It looks like I'm in read-only mode.
See if we can get out of that somehow.
So I'm just going to flip back over to this tab and click manage your subscription control, click it
and it's going to try to log back in.
To see if this does anything.
All right, so this is good.
Let's go talk about.
All right, so we can see the subscription here.
And we should be good to go there.
All right, we've got the Microsoft defender for endpoint trial here.
We've got Randy Mirrorless in here, the user.
He is a global administrator, so that is really good.
OK.
Yeah, this is what I wanted to see.
This is the security center for Randy, you know, we need to do is click through this wizard.
So we're going to set up the permissions.
We're going to get started at the preferences and then on board our devices.
So what is click next to get started?
And we don't want to store my cloud data because, you know, Windows Defender for Endpoint uses the
cloud for telemetry and compute.
I'm going to store mine in the US and.
I mean, my trial was only for 60 days, so I'll only store a store for 60 days organization.
It's pretty small.
They don't have my size here, but that's fine.
They don't have four.
I think it's the size of my organization right now.
Right.
All right.
We'll click next and saying once we do this, we can't go back and we won't be able to change the data
storage location.
That's fine.
I want to be in the U.S. and let's let it create the instance.
This looks a little big.
Let me put your mind to make it look a little better.
It's go full screen and yes, this is the page I wanted to see, so we're going to open board a device
we're going to start with for up to 10 devices.
We're going to use the local scripts.
And you could do some of these other methods for onboarding your devices.
But we're just going to use a local script because the easiest thing I'm going to click download package.
Sweet.
I'm going to right click and I'm just going to grab this.
So I'm going to minimize this window and drag this in different demoralises screen control all to escape
the VM.
Let's go to his downloads folder.
Control all the SCAP or tablas, which.
Drop it in.
All right, so we've got it there and then we'll just install it and we should be able to run a detection
test after we have everything set up here, open a command prompt window and at the command prompt,
run this command so we'll get all that stuff ready.
Seemed.
All right, so we've got that ready, let's extract this.
Right, click extract all.
All right, we've got the file and to run it, all we need to do is open an elevated command prompt
and execute it.
So I'm going to shift right click and go to copy path type CMD Control shift enter to open an elevated
command prompt with my domain administrator credentials.
Right.
Click to that directory.
You can see it is there.
Let's just run it.
The script is for unboarded machines to the Microsoft defender for endpoint services.
Yes, we want to do that.
So we're going to let this onboarding process start.
And then once it finishes, we will run the detection test script to make sure that everything's working.
All right.
So it said the machine was successfully on board, so that is a good sign.
Let's go ahead and flip back over.
So we're going to click any key to continue and now that is done, close this window, let's run this
detection and then back over to the security center and start using Microsoft Defender for endpoint.
So a new alert should appear in a few minutes.
We're going to proceed.
All right.
So we'll give it a few minutes and then we'll see if we can get our endpoint to show up here.
All right.
See you guys in a little bit.
While waiting for this to load, I'm actually clicking over to the new home for Defendor for End Point.
And it takes us to the Microsoft 365 security portal at security dot Microsoft dot com.
And then if you click on incidents, you'll see us try to prepare the new space for our data and it's
trying to connect to them.
So we won't have to wait a while.
Could take a few hours.
But hopefully, you know, within a few hours we'll be able to get our connections and we'll see our
endpoints pop in here.
Right.
See you in a little bit.
All right.
Nothing there.
Let's see if we can look at our device inventory.
Yes, we've got our PC here, so this is really good.
So right now you can see we are on board it now that we have this one device on board.
First of all, let's just enable standard mode so that we can discover more devices.
And we're basically using that the best approach to discovering devices.
So we're going to enable that.
And then I want to show you how we can confirm that everything's actually working here.
Right.
So what we're going to do is going to scroll down the left pane and go down to settings.
For endpoints, and we want to scroll down to onboarding and we want to grab this detection test script,
so let's grab this and he controls how to copy it, then we'll go back here.
You can see a piece of it in the command when is already pasted in the command window from the last
time.
And they weren't going to press enter.
To make sure it actually works and we get these protections in place.
All right, let's flip back over to the security center, going to go to the homepage.
But let's see if we have any incidents.
He alerts.
Yes, and we did get the alert from PC one.
So we know that this is indeed working.
So I can click the alert and.
I can drill into the process, Trace, I can see, you know, the process ancestry, I can see the partial
command that was executed and I get a lot of good stuff here.
He minimizes a little bit.
Yeah, so we're good to go, guys, so in the next lecture, we're just going to basically put this
file that we downloaded, this Windows Defender file, we're just going to put this on a Pictou and
the DC domain controller.
And then we're good to go, guys.
That's that's really all we need to have our lab set up and completely, you know, completely ready
to run attacks.
I mean, as you can see, we're going to be able to drill in and see everything here.
Right?
I mean, look at this.
It's inspecting the ships.
It's mapping it to the miter techniques.
It's even showing, you know, basically what it does.
So when we went ARTAX, we're going to see the alerts and everything positive pop in here.
And I encourage you to spend some time in here.
You know, click through these different fields, go to hunting, you know, play with this stuff.
Right.
Because this is a this is an awesome tool, as you can probably already see.
And I brought you guys to get really comfortable with it.
I want you to, you know, fill the freedom to explore, to take a look around.
You're not going to break anything, right?
This is your child.
This is your cyber range.
So have fun.
Learn a lot.
And now that you've got everything you need to get going, we're ready to kick this off as we're ready
to start our modern ethical hacking.
I'll see you guys in the next section.
All right.
Bye.