# 🪟 TryHackMe — Windows Fundamentals 1 | Learning Guide

> **Spoiler-Free Learning Guide:** This article contains **no TryHackMe flags or direct task answers**. It focuses on the concepts, tools, navigation, and commands I used while completing the room.

* * *

## Introduction

Windows is one of the most widely used operating systems in personal computers and enterprise environments, which also makes understanding Windows essential for anyone learning cybersecurity.

The **Windows Fundamentals 1** room introduces the basic structure of Windows before moving toward more advanced topics such as Windows security, Active Directory, privilege escalation, and system administration.

The room covers:

```text
Windows Editions
        ↓
Windows Desktop & GUI
        ↓
Windows File System
        ↓
Windows & System32 Directories
        ↓
Users, Groups & Permissions
        ↓
User Account Control
        ↓
Settings & Control Panel
        ↓
Task Manager
```

TryHackMe describes this first Windows Fundamentals room as an introduction to the Windows desktop, NTFS file system, UAC, Control Panel, Settings, and Task Manager. ([TryHackMe](https://tryhackme.com/module/windows-fundamentals?utm_source=chatgpt.com))

* * *

# Task 1 — Windows Editions

The first task introduces the history and different editions of Microsoft Windows.

Windows has evolved through many generations:

```text
Windows XP
    ↓
Windows Vista
    ↓
Windows 7
    ↓
Windows 8 / 8.1
    ↓
Windows 10
    ↓
Windows 11
```

Different Windows editions are designed for different types of users.

For example:

```text
Home Users
    ↓
Everyday personal computing

Professional Users
    ↓
Additional management and security features

Enterprise Environments
    ↓
Centralized management and organizational features

Servers
    ↓
Hosting services, applications, users and networks
```

The room also introduces the idea that Windows editions may have different features depending on their intended use. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx))

* * *

## Why Windows Versions Matter in Cybersecurity

Knowing the exact Windows version running on a system is important.

Different versions can have:

*   Different security features
    
*   Different default configurations
    
*   Different vulnerabilities
    
*   Different patch levels
    
*   Different administrative tools
    
*   Different end-of-support dates
    

During security assessments, identifying the operating system is therefore an important part of reconnaissance.

* * *

## 🛠️ Hands-On / Commands — Task 1

### Tools Used

```text
Windows GUI
System Information
Command Prompt
PowerShell
```

### Check Windows Version

A useful command is:

```cmd
winver
```

This opens the Windows version information window.

* * *

### View Detailed System Information

```cmd
systeminfo
```

This provides information such as:

```text
OS Name
OS Version
System Manufacturer
System Type
Installed Memory
Boot Time
Network Information
```

* * *

### PowerShell Alternative

```powershell
Get-ComputerInfo
```

This can provide much more detailed information about the system.

The important cybersecurity habit is:

> Before investigating a Windows machine, understand exactly what operating system you are dealing with.

* * *

# Task 2 — The Desktop (GUI)

After logging into Windows, we interact with the **Graphical User Interface (GUI)**.

The Windows desktop contains several major components. TryHackMe highlights the Desktop, Start Menu, Search, Task View, Taskbar, toolbars, and Notification Area. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx?utm_source=chatgpt.com))

* * *

## The Desktop

The Desktop acts as the main workspace.

It can contain:

```text
Files
Folders
Application shortcuts
Recycle Bin
Documents
```

Users often place frequently accessed items here.

* * *

# Start Menu

The Start Menu provides quick access to:

```text
Applications
Settings
User options
Power controls
Files
Search
```

It is one of the primary navigation points in Windows.

* * *

# Search

Windows Search allows us to quickly locate:

```text
Applications
Files
Folders
System settings
Administrative utilities
```

For example, instead of manually navigating through menus, we can search:

```text
Task Manager
Control Panel
Computer Management
Services
```

* * *

# Taskbar

The Taskbar shows running and pinned applications.

It also provides quick access to system components.

* * *

# Notification Area

The Notification Area usually appears on the right side of the taskbar.

It contains information and controls related to things such as:

```text
Network
Audio
Date & Time
Notifications
Background applications
```

* * *

## Why the GUI Matters for Cybersecurity

A cybersecurity analyst frequently needs to move between:

```text
GUI Tools
   +
Command-Line Tools
```

For example:

```text
Task Manager
Computer Management
Event Viewer
Registry Editor
Windows Security
Services
```

are all Windows GUI tools that appear frequently in security investigations.

* * *

## 🛠️ Hands-On / Commands — Task 2

### Tools Used

```text
Windows Desktop
Start Menu
Search
Taskbar
Notification Area
```

A useful command for opening Windows Explorer is:

```cmd
explorer.exe
```

You can also quickly open common Windows components through the Run dialog.

Press:

```text
Windows Key + R
```

For example:

```cmd
control
```

opens Control Panel.

And:

```cmd
taskmgr
```

opens Task Manager.

The important lesson here was learning that Windows tools can often be accessed in multiple ways:

```text
GUI
Search
Run dialog
Command Prompt
PowerShell
```

* * *

# Task 3 — Introduction to Windows

This task moves from theory to the practical Windows lab.

The room provides a Windows machine that can be accessed directly through the browser or remotely. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx))

Instead of simply reading about Windows, the goal is to explore an actual system.

* * *

## Why a Windows Lab Is Useful

Understanding Windows from a cybersecurity perspective requires practical interaction.

For example, it is much easier to understand:

```text
File permissions
User accounts
Processes
System folders
UAC
```

when working with a real Windows environment.

* * *

## Remote Desktop

Windows systems can commonly be accessed remotely through:

```text
RDP
```

or:

```text
Remote Desktop Protocol
```

RDP provides a graphical session on a remote Windows computer.

Conceptually:

```text
Your Computer
     |
     | RDP
     v
Remote Windows Machine
```

* * *

## 🛠️ Hands-On / Commands — Task 3

### Tools Used

```text
TryHackMe Lab Machine
AttackBox
Remote Desktop
Windows GUI
```

From a Linux machine, RDP clients such as `xfreerdp` can be used in authorized labs:

```bash
xfreerdp /v:<LAB_IP> /u:<USERNAME>
```

The actual lab values are intentionally not included here.

From Windows, the built-in Remote Desktop client can be started with:

```cmd
mstsc
```

This opens:

```text
Remote Desktop Connection
```

* * *

# Task 4 — The File System

One of the most important topics in this room is the Windows file system.

Modern Windows installations commonly use:

# NTFS

NTFS provides capabilities beyond older Windows file systems, including permissions, large-file support, compression, encryption-related functionality, and journaling. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx))

* * *

# File-System Structure

Windows commonly organizes files through drive letters.

For example:

```text
C:\
```

A path might look like:

```text
C:\Users\Example\Documents
```

Breaking this down:

```text
C:
│
└── Users
    │
    └── Example
        │
        └── Documents
```

* * *

# NTFS Permissions

NTFS allows access controls to be applied to files and directories.

Common permissions include:

```text
Full Control
Modify
Read & Execute
List Folder Contents
Read
Write
```

These permissions become extremely important in cybersecurity.

A poorly configured file permission can sometimes allow:

```text
Unauthorized file access
File modification
Sensitive-data exposure
Privilege escalation
```

The room demonstrates how these permissions can be viewed from a file or folder's **Properties → Security** tab. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx))

* * *

# Alternate Data Streams

Another interesting NTFS concept introduced in the room is:

```text
ADS
```

or:

```text
Alternate Data Streams
```

ADS allows additional data streams to exist alongside a file's normal content.

This is particularly interesting from a cybersecurity perspective because hidden streams have historically been abused to conceal information, although ADS also has legitimate Windows uses. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx))

* * *

## 🛠️ Hands-On / Commands — Task 4

### Tools Used

```text
File Explorer
File Properties
Security tab
Command Prompt
PowerShell
```

### Check the Current Directory

```cmd
cd
```

* * *

### List Files

```cmd
dir
```

PowerShell equivalent:

```powershell
Get-ChildItem
```

or simply:

```powershell
ls
```

* * *

### Move Into a Directory

```cmd
cd Documents
```

* * *

### Go Back One Level

```cmd
cd ..
```

* * *

### View Available Drives

PowerShell:

```powershell
Get-PSDrive
```

* * *

### Inspect File Permissions

Windows includes the useful command:

```cmd
icacls example.txt
```

For a directory:

```cmd
icacls C:\Example
```

This displays access-control information for the object.

* * *

# Task 5 — The Windows\\System32 Folders

The next task introduces one of the most important locations in Windows:

```text
C:\Windows
```

This directory contains core Windows operating-system files.

Inside it is another especially important directory:

```text
System32
```

TryHackMe warns that System32 contains critical operating-system files and that modifying or deleting its contents carelessly can break Windows. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx))

* * *

# Why System32 Matters

System32 contains many important:

```text
Executables
DLL files
System utilities
Configuration components
Administrative tools
```

A large number of commands frequently used in cybersecurity originate from this area.

Examples include utilities for:

```text
Networking
Process management
User management
System configuration
Diagnostics
```

* * *

# Environment Variables

Windows also uses **environment variables**.

Instead of hard-coding a particular directory location, programs can reference system variables.

Conceptually:

```text
Environment Variable
        ↓
Represents a system value
        ↓
Application uses the value
```

These variables may contain:

```text
System paths
User directories
Temporary directories
Processor information
Configuration locations
```

The room introduces Windows-directory environment variables in this task. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx))

* * *

## 🛠️ Hands-On / Commands — Task 5

### Tools Used

```text
File Explorer
Command Prompt
Environment Variables
System32
```

### View Environment Variables

```cmd
set
```

Instead of looking for a specific room answer, this command lets us explore all currently defined variables ourselves.

PowerShell:

```powershell
Get-ChildItem Env:
```

* * *

### Enter the Windows Directory

```cmd
cd C:\Windows
```

List files:

```cmd
dir
```

* * *

### Explore System32 Safely

```cmd
cd C:\Windows\System32
```

Then:

```cmd
dir
```

For a learning lab, browsing the folder is useful.

Deleting or modifying random System32 files is definitely not.

* * *

# Task 6 — User Accounts, Profiles, and Permissions

Windows systems commonly differentiate between privileged and regular users.

The room introduces two important local account types:

```text
Administrator
Standard User
```

Administrators can perform system-wide operations, while standard users are more restricted. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx?utm_source=chatgpt.com))

* * *

# Administrator Account

An administrator may be allowed to:

```text
Install software
Add/remove users
Modify groups
Change system configuration
Manage permissions
Perform administrative operations
```

* * *

# Standard User

A standard user generally works mainly within their own account context.

This follows an important cybersecurity idea:

# Principle of Least Privilege

A user should receive:

> Only the privileges necessary to perform their job.

If everyone operates permanently with maximum privileges, malware or compromised applications may inherit far more power than necessary.

* * *

# User Profiles

Windows stores user profiles under:

```text
C:\Users\
```

Conceptually:

```text
C:\Users
│
├── User1
│   ├── Desktop
│   ├── Documents
│   ├── Downloads
│   └── Pictures
│
└── User2
    ├── Desktop
    ├── Documents
    └── Downloads
```

The room explains that Windows creates a profile for a user during the user's first login. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx))

* * *

# Users and Groups

Instead of assigning every permission individually, administrators can organize users into groups.

```text
User
  ↓
Group
  ↓
Permissions
```

A user can also belong to multiple groups.

This model becomes extremely important later when learning:

```text
Windows Administration
Active Directory
Privilege Escalation
Domain Security
```

* * *

## 🛠️ Hands-On / Commands — Task 6

### Tools Used

```text
Local Users and Groups
Windows Settings
Command Prompt
PowerShell
```

### Open Local Users and Groups

From Run:

```cmd
lusrmgr.msc
```

This opens:

```text
Local Users and Groups
```

where we can inspect:

```text
Users
Groups
Memberships
Account properties
```

TryHackMe specifically introduces this console for exploring local users and groups. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx?utm_source=chatgpt.com))

* * *

### Display Current User

```cmd
whoami
```

* * *

### List Local Users

```cmd
net user
```

* * *

### Inspect One Account

```cmd
net user <USERNAME>
```

* * *

### List Local Groups

```cmd
net localgroup
```

* * *

### PowerShell Alternative

```powershell
Get-LocalUser
```

and:

```powershell
Get-LocalGroup
```

These commands are very useful during Windows enumeration.

* * *

# Task 7 — User Account Control

This task introduces:

# User Account Control (UAC)

Being logged in with an administrator account does not mean every application should automatically execute with maximum privileges.

UAC helps create an additional boundary.

When an operation requires elevated privileges, Windows can ask for approval or administrative credentials. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx))

* * *

# Why UAC Exists

Imagine malware running under a highly privileged account.

Without safeguards:

```text
Malware starts
     ↓
User has administrative privileges
     ↓
Malware gains powerful system access
```

UAC helps interrupt this process:

```text
Application requests elevated action
             ↓
          UAC Prompt
             ↓
     User approval required
```

* * *

# The Shield Icon

You may notice a small shield icon on certain Windows applications.

That usually indicates the program may require elevated privileges.

For example:

```text
Normal program
     ↓
Runs with normal user context

Administrative operation
     ↓
UAC prompt
     ↓
Elevation
```

* * *

## 🛠️ Hands-On / Commands — Task 7

### Tools Used

```text
UAC Prompt
User Accounts
Application Installer
Windows GUI
```

A common way to intentionally launch something with elevated privileges is:

```text
Right-click application
        ↓
Run as administrator
```

From PowerShell, a process can request elevation with:

```powershell
Start-Process powershell -Verb RunAs
```

Windows then displays the UAC confirmation prompt.

This was useful for understanding the difference between:

```text
Being an administrator
```

and:

```text
Running a process with elevated privileges
```

* * *

# Task 8 — Settings and the Control Panel

Windows currently provides two major interfaces for configuring the operating system:

```text
Settings
```

and:

```text
Control Panel
```

TryHackMe explains that Settings is the newer configuration interface while Control Panel remains important for many traditional and advanced Windows settings. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx))

* * *

# Windows Settings

Settings provides modern configuration categories such as:

```text
System
Devices
Network
Personalization
Accounts
Privacy
Updates
```

* * *

# Control Panel

Control Panel is the older management interface but is still extremely useful.

It provides access to areas such as:

```text
Programs
User Accounts
Network Settings
System Configuration
Hardware
Administrative Options
```

Some operations begin inside Settings but eventually open an older Control Panel component. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx))

* * *

## Why Both Matter in Cybersecurity

When investigating Windows systems, documentation might instruct you to navigate through either interface.

Knowing both is useful because:

```text
Modern settings → Settings

Legacy / advanced configuration → Control Panel
```

* * *

## 🛠️ Hands-On / Commands — Task 8

### Tools Used

```text
Windows Settings
Control Panel
Windows Search
Run Dialog
```

### Open Settings

Keyboard shortcut:

```text
Windows + I
```

* * *

### Open Control Panel

```cmd
control
```

* * *

### Installed Applications

One way to inspect installed software is:

```text
Control Panel
    ↓
Programs
    ↓
Programs and Features
```

TryHackMe uses this interface to demonstrate how applications installed on the system can be reviewed. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx))

PowerShell can also provide software-related information through various system-management approaches, although later Windows rooms explore administration in greater depth.

* * *

# Task 9 — Task Manager

Task Manager is one of the most useful built-in Windows tools.

It provides visibility into what is currently happening on the machine.

TryHackMe introduces Task Manager as a way to inspect running applications/processes and system resource usage such as CPU and RAM. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx))

* * *

# What Can Task Manager Show?

Depending on the Windows version, Task Manager can expose areas including:

```text
Processes
Performance
Users
Details
Services
Startup Applications
```

* * *

# Processes

Processes show programs currently executing.

Example:

```text
Browser
Explorer
Background services
Security software
System processes
```

* * *

# Performance

Performance provides information about:

```text
CPU
Memory
Disk
Network
GPU
```

This can help identify unusual behavior.

For example:

```text
CPU suddenly at 100%
        ↓
Check Task Manager
        ↓
Identify responsible process
```

* * *

# Why Task Manager Matters in Cybersecurity

Task Manager can provide quick clues during investigation.

For example:

```text
Unknown process
Unexpected resource usage
Suspicious startup application
Unexpected user session
```

It is not a complete forensic tool, but it is an excellent first place to look.

* * *

## 🛠️ Hands-On / Commands — Task 9

### Tools Used

```text
Task Manager
Windows GUI
Command Prompt
PowerShell
```

Open Task Manager from Run:

```cmd
taskmgr
```

Another common method is:

```text
Right-click Taskbar
        ↓
Task Manager
```

The room also encourages learning the dedicated keyboard shortcut, which I am leaving for learners to discover during the room rather than publishing the task answer. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx))

* * *

### Command-Line Process Listing

```cmd
tasklist
```

Example structure:

```text
Image Name        PID      Memory Usage
----------------------------------------
process.exe       1234     ...
```

PowerShell equivalent:

```powershell
Get-Process
```

This shows how the GUI and command line expose the same underlying idea:

```text
Task Manager
       ↕
Processes
       ↕
tasklist / Get-Process
```

* * *

# Task 10 — Conclusion

Windows Fundamentals 1 provides a broad introduction rather than a deep dive into every Windows subsystem.

The room finishes by pointing toward more advanced Windows concepts and security tools covered later in the Windows Fundamentals series. ([TryHackMe](https://tryhackme.com/room/windowsfundamentals1xbx))

The complete learning flow for me was:

```text
Windows Editions
       ↓
Desktop & GUI
       ↓
Windows Lab
       ↓
NTFS
       ↓
System Directories
       ↓
Users & Groups
       ↓
Permissions
       ↓
UAC
       ↓
Settings & Control Panel
       ↓
Task Manager
```

* * *

# 🛠️ Hands-On / Commands — Task 10

No new tool was required in the final task.

Instead, I reviewed the commands encountered throughout the room.

```cmd
winver
systeminfo
explorer.exe
taskmgr
control
whoami
net user
net localgroup
lusrmgr.msc
tasklist
```

And some useful PowerShell equivalents:

```powershell
Get-ComputerInfo
Get-ChildItem
Get-LocalUser
Get-LocalGroup
Get-Process
Get-ChildItem Env:
```

* * *

# Tools Used

| Tool | Purpose |
| --- | --- |
| Windows Desktop | Navigating the Windows GUI |
| File Explorer | Browsing files and directories |
| Command Prompt | Basic Windows commands |
| PowerShell | System inspection and administration |
| `systeminfo` | Inspecting Windows/system information |
| `lusrmgr.msc` | Viewing local users and groups |
| `icacls` | Inspecting file permissions |
| Control Panel | Traditional Windows configuration |
| Windows Settings | Modern Windows configuration |
| UAC | Controlling privileged operations |
| Task Manager | Monitoring processes and resources |
| `tasklist` | Viewing processes from CLI |
| Remote Desktop | Accessing a Windows system remotely |

* * *

# Key Lessons Learned

### 1\. Windows Knowledge Is Essential for Cybersecurity

Windows is not simply a desktop operating system.

Enterprise environments heavily depend on:

```text
Windows Servers
User Accounts
Permissions
Active Directory
Windows Services
Security Policies
```

Understanding the fundamentals makes later security topics much easier.

* * *

### 2\. File Permissions Matter

NTFS permissions determine:

```text
Who can read?
Who can write?
Who can modify?
Who has full control?
```

Misconfigured permissions can become security vulnerabilities.

* * *

### 3\. Users and Groups Control Access

Instead of looking only at usernames, security professionals also need to ask:

```text
Which groups does this user belong to?

What privileges does that group have?
```

This becomes especially important in privilege-escalation and Active Directory investigations.

* * *

### 4\. Administrative Access Should Be Controlled

The principle of least privilege matters.

```text
More privileges
      =
More potential impact if compromised
```

UAC is one mechanism Windows uses to reduce unnecessary elevation.

* * *

### 5\. GUI and CLI Skills Complement Each Other

I could inspect processes using:

```text
Task Manager
```

or:

```cmd
tasklist
```

I could inspect users through:

```text
Local Users and Groups
```

or:

```cmd
net user
```

Cybersecurity requires being comfortable with both approaches.

* * *

# My Final Mental Model

```text
                   WINDOWS
                      |
      ┌───────────────┼────────────────┐
      |               |                |
   Filesystem        Users          Processes
      |               |                |
    NTFS          Accounts           Task Manager
      |             Groups              |
 Permissions      Permissions        CPU / RAM
      |               |                |
      └───────────────┼────────────────┘
                      |
                  Security
                      |
              Least Privilege
                      |
                     UAC
```

* * *

# Ethical Learning Note

This article is intended as a **learning guide**, not an answer dump.

I included:

```text
✅ Concepts
✅ Tools
✅ Windows commands
✅ Navigation methods
✅ Practical methodology
✅ Cybersecurity relevance
```

while intentionally excluding:

```text
❌ TryHackMe answers
❌ Flags
❌ Lab-specific credentials
❌ Direct responses to room questions
```

The goal is to document what I learned without removing the problem-solving experience for other learners.

* * *

# Resources

*   🌐 **TryHackMe Room:** [Windows Fundamentals 1](https://tryhackme.com/room/windowsfundamentals1xbx)
    
*   👨‍💻 **TryHackMe Profile:** [sunnysharma11200](https://tryhackme.com/p/sunnysharma11200)
    
*   💻 **GitHub Repository:** [tryhackme-writeups](https://github.com/SunnySharma04/tryhackme-writeups)
    
*   ✍️ **Hashnode Blog:** [cybersecurity-learning.hashnode.dev](https://cybersecurity-learning.hashnode.dev/)
    

* * *

# Connect with Me

*   **TryHackMe:** [sunnysharma11200](https://tryhackme.com/p/sunnysharma11200)
    
*   **GitHub:** [SunnySharma04](https://github.com/SunnySharma04/tryhackme-writeups)
    
*   **Hashnode:** [cybersecurity-learning](https://cybersecurity-learning.hashnode.dev/)
    
*   **LinkedIn:** [Sunny Sharma](https://www.linkedin.com/in/sunny-sharma-2487312a7/)
    

* * *

*Happy Learning!* 🚀