# Windows User VM

I usually go with a [Windows 11](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-11-enterprise) VM with [VMWare](https://support.broadcom.com/group/ecx/productdownloads?subfamily=VMware+Workstation+Pro) or [Virtualbox](https://www.virtualbox.org/). I have VMWare Workstation Pro as Broadcom bought out VMWare and made it free, you just need an account with them. You can go with either VMWare or Virtualbox, both work and it just comes down to personal preference on the application and what you're use to.

Obviously your setup may differ depending on your system specs. I typically go with 4GB(4096 MB) of RAM per VM, 2 processors and 2 cores per processor but I am running with 32GB of RAM and an Intel i7-10750H.

If you need to, you can start with 4 or 8GB of RAM and 2 processors and 2 core per processor, for the install so it goes faster then drop it down to 2 or 4GB of RAM and 2 processors and 1 core per processor for the victim machines.

## VMWare Setup

Starting with typical setup

<figure><img src="https://cybersec.th4ntis.com/~gitbook/image?url=https%3A%2F%2F667808901-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FTdW22AGCceN8oUXfdlKI%252Fuploads%252FsnQye1BjFW53yx8blAvF%252Fimage.png%3Falt%3Dmedia%26token%3D2b443419-09d7-4e80-b3fe-69c62291eb01&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=ebd1da4a&#x26;sv=2" alt=""><figcaption></figcaption></figure>

I add the .iso after

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FJTUdjKem71dQMFzSYsdP%2Fimage.avif?alt=media&#x26;token=0111e07d-3e49-4a53-9cce-027e1e033bfb" alt=""><figcaption></figcaption></figure>

Select the size of the VM. This will **NOT** the overall size, this is just the max size of the VMs HDD space and will fill up as we add more to the VM that takes up space.

If this VM will be on a PC and not be used from an external HDD or moved around you can store it as a single file but if you plan on using this VM on other PC or from an external HDD it's a better idea to split it into multiple files.

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FeUVsrIouvuIA0g8OBU5u%2Fimage.avif?alt=media&#x26;token=8b969563-957b-439e-b4f5-263b05c842ef" alt=""><figcaption></figcaption></figure>

Finally we can now customize our hardware. This is where we can customize the RAM, Processors, ISO files, Network Settings, etc. This is where we select our Windows Server ISO.

I recommend disabling the Printer, Sound Card, and under Display unchecking 'Accelerate 3D Graphics'.

I usually increase the RAM for the install so it goes quicker then drop it down after.

For install purposes, I up it to 8GB of ram and 4 Processors. Also add in the .iso file now.

<figure><img src="https://cybersec.th4ntis.com/~gitbook/image?url=https%3A%2F%2F667808901-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FTdW22AGCceN8oUXfdlKI%252Fuploads%252F5Uqo0wIHz0nrjvfdV9EZ%252Fimage.png%3Falt%3Dmedia%26token%3Dd79f9af0-7219-4f27-a44b-a2a79d8845ca&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=6b4fe7f6&#x26;sv=2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FRCN74gFN3xOJgbtQpp3A%2Fimage.avif?alt=media&#x26;token=7df95cfa-af42-4dc8-9189-0b7284e44f3a" alt=""><figcaption></figcaption></figure>

When finished, click close > finish > turn on the VM. Be sure to click into the VM to press a button when it starts.

## Installing Windows 11

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FrY3Z6ACL4yvfaxSQwQkW%2Fimage.avif?alt=media&#x26;token=0d3e9c4e-abf9-4676-a57c-50af82d566e8" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2Fg6FAXj3CUKvwmS0CQp29%2Fimage.avif?alt=media&#x26;token=a663ef8c-2f76-4bcf-8d3a-8139609d9a8c" alt=""><figcaption></figcaption></figure>

You MAY need to bypass TPM. If so, continue on. If not, skip ahead a little bit to [INSTALL NOW](#install-now).

![](https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F9BYD796iJBwKKxXJnRUO%2Fimage.png?alt=media\&token=dc474663-8757-45ae-b64e-ceadebe7669f)

Press `Shift+F10` to bring up the Command Prompt

![](https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F8eaKdgAaz2nfm9u0WPHZ%2Fimage.png?alt=media\&token=c0c991c8-4da7-47fc-afda-90a54bad4d8a)

Run `regedit` and navigate to `HKEY_`*`LOCAL_MACHINE\SYSTEM\Setup` and make a new Key called "LabConfig"*

![](https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FTWAWJdhi16L5Lau6IbVe%2Fimage.png?alt=media\&token=526cc293-8d1d-4001-9292-44ea29938226)

*Inside there create DWord(32-Bit) Values for:*

* *BypassTPMCheck*
* *BypassRAMCheck*
* *BypassSecureBootCheck*

*and change their value to 1*

![](https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FGzFT3qaoXy66CeS6dAqs%2Fimage.png?alt=media\&token=2ab6cede-955e-4d75-9314-6485a4af05ce)

Close out that window to exit the installation and start from the beginning window.

### Install Now

Click INSTALL NOW, then accept the EULA and click next

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F4Sh0b7USrO4h5NM0CMsC%2Fimage.avif?alt=media&#x26;token=103c7474-78d3-4d3c-a5a3-0afdfbee51f6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F9GoCwME8sigW9gA88Sjh%2Fimage.avif?alt=media&#x26;token=763c460d-c204-4611-973d-62a44e76cbd8" alt=""><figcaption></figcaption></figure>

I go with the custom installation option.

<figure><img src="https://cybersec.th4ntis.com/~gitbook/image?url=https%3A%2F%2F667808901-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FTdW22AGCceN8oUXfdlKI%252Fuploads%252FqbLVgMtuGMWVbf0sbv7J%252Fimage.png%3Falt%3Dmedia%26token%3D831bd2a6-fec9-4cb3-92b6-4ce38873096e&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=c15f4953&#x26;sv=2" alt=""><figcaption></figcaption></figure>

Select the hard drive and click next

Click Next

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2Fbctfiu585Fhb0WotEVi7%2Fimage.avif?alt=media&#x26;token=e7249a03-7489-4fca-8e4f-e4c72544ad6a" alt=""><figcaption></figcaption></figure>

Wait for the install process to finish and restart

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2Fo44JzDT3O65ZjCDXE2JQ%2Fimage.avif?alt=media&#x26;token=47358a3d-2f79-4774-986c-2d3d99710379" alt=""><figcaption></figcaption></figure>

After install and it reboots&#x20;

![](https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FGiznxzfQrFwT2uwkWn5b%2Fimage.png?alt=media\&token=27a93727-d204-4b31-9e2a-e47ef62b1671)

We choose our region, keyboard layout, etc. and we can setup our account. Select 'sign-in options'

![](https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F9eAzJZqataGHE65ltNFk%2Fimage.png?alt=media\&token=c0e668d1-7adc-47f1-a937-aac146d8f7b7)

Then 'Domain Join Instead'

![](https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FYpfwgXZzYzF8RwtC7GJv%2Fimage.png?alt=media\&token=40615605-44eb-4945-a5b2-418f31b1fb0b)

Input our username and password, password confirmation, and security questions

![](https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F4tYh5HJdO4IXqKHy03XA%2Fimage.png?alt=media\&token=958a5dd9-7171-4254-aba2-296e2b245fdd)

Disable all the privacy settings and click accept.

![](https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FMyZgdpoDEdYvEKh4SgkY%2Fimage.png?alt=media\&token=7db55c22-009e-4bc2-8164-78a7119a7aff)

It will now do Windows setup and such

![](https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FCg0IXxDJcDZhhKC577TD%2Fimage.png?alt=media\&token=c4072f4e-ff71-4fdd-b039-4d029cadb37e)

We're now logged in and can install VMWare Tools

![](https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FURMCEo9SiOnzm8Osi9cW%2Fimage.png?alt=media\&token=5dd53d18-9169-4b15-98c2-c16bfeb630bc)

![](https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FQTEbNDqn7cgATD3O1lp2%2Fimage.png?alt=media\&token=f134c2e7-7caa-4341-881f-5cceae1bfdf9)

### Joining a domain

We need to set out DNS Server to be the IP of our Domain Controller. So open the start menu, search for and open Control Panel.

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F6bFVpEOxwCKoGP5g2ZRL%2Fimage.png?alt=media&#x26;token=76df09c6-095a-4b2d-ba17-3a078849210a" alt=""><figcaption></figcaption></figure>

In the top right, change it from 'Category' to 'Small/Large Icons', then open network and sharing center.

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FSNKYpmL6ioHoBRLvLPFF%2Fimage.png?alt=media&#x26;token=15a59df4-cb27-46fc-bfd2-c614ba021887" alt=""><figcaption></figcaption></figure>

On the left hand side, select 'Change Adapter Settings', then right click on the adapter, and select properties.

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FV86LbtPcYc2ABiiP5ilQ%2Fimage.png?alt=media&#x26;token=b927f922-8744-46a3-9a67-9958f43ff5cc" alt=""><figcaption></figcaption></figure>

Select Internet Protocol Version 4 (TCP/IPv4) and then properties.

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FaSof08diR0mm9wXVeGG5%2Fimage.png?alt=media&#x26;token=767d8019-91b1-40b9-8d5b-ab4ec1bcde80" alt=""><figcaption></figcaption></figure>

Change the DNS settings and set it to be the Domain Controllers IP address.

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2Ftydosklq5wNSoHl2bLkM%2Fimage.png?alt=media&#x26;token=227beca7-be77-4bdd-97a7-a8aea6eee625" alt=""><figcaption></figcaption></figure>

Open the start menu and search for domain, and select 'Access work or school'

![](https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FQu9Hk6dsR8YxC9FHobXj%2Fimage.png?alt=media\&token=6d181b48-67a8-4941-8b68-06402d79bf9c)

Click the blue 'Connect' button

![](https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F3InQxCv79lMPNGLB978c%2Fimage.png?alt=media\&token=2d74e160-e48e-47dc-b2e7-905bdce4518a)

Select 'Join this device to a local Active Directory domain'.

![](https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F4ffeg2YZ7E6ZYMpT0MSo%2Fimage.png?alt=media\&token=928804df-da46-47df-9b87-555166de543a)

and follow the steps. Add in your domain name followed by .local, Eg. Gibson.local, sign in with Domain Admin credentials, reboot, and ta-da! You're now on a domain

### Optional Setup:

There a great [Setup.bat](https://raw.githubusercontent.com/Tib3rius/Windows-PrivEsc-Setup/master/setup.bat) from [Tib3rius](https://github.com/Tib3rius) we can run that will give us a nice setup to practice Privilege Escalation tactics.

From an admin CMD on the User Machine, we can run the script.

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FbSys2g8cJXQMTf4oiMsA%2Fimage.png?alt=media&#x26;token=1b9fb886-caa6-418e-b738-ffaaaa0e4e8b" alt=""><figcaption></figcaption></figure>