Why this matters
Most office computers in Ghanaian banks, schools, hospitals and businesses run Windows. When something goes wrong, the analyst is often asked "what happened on this computer?". The answer usually sits in Windows settings and the Windows event logs.
Accounts and permissions
Windows has standard accounts and administrator accounts. Administrators can install software and change settings; standard users cannot. A safe office gives staff standard accounts for daily work, so a malicious download cannot easily change the whole system. Shared accounts such as "Accounts1" with one password for five people make it impossible to know who did what.
Built in protection
- Windows Update installs fixes for security weaknesses. Many attacks succeed only because updates were delayed.
- Microsoft Defender Antivirus is built in and scans for malware.
- Windows Firewall filters traffic coming into and out of the computer.
- Disk encryption (BitLocker or device encryption, depending on the edition and hardware) protects data if a laptop is stolen.
Event logs: the computer's diary
Open Event Viewer, then , then . Each entry has an Event ID. A few to know: