# Finishing Touches

## WC1

### Powershell History
Run powershell as user


Enter following commands into wyldstyle's powershell session

If we go to users we see that wyldstyle has a folder now

And we can see the console history - which will also be part of the investigations later

### Enable Local Administrator Account

We need to set a password for the local Administrator account first




Enable


### Housekeeping

Delete it-users.zip from C:\setup
Delete useradd.ps1 from C:\setup

Restart the machine and it should log in automatically as Lucy.

Switch users

Log in using the local Administrator accoung
- This will prevent the password for the domain admins from being cached

#### Delete local accounts with administrator access that are not part of the lab

This PC > Properties


Delete from Computer Management as well


## Creating Loot

### On Kali VM

We create three text file containing different hashes

Let's clean this up a bit
So we just have the hashes

Send to WC1

### On WC1

Access share and copy


#### local.txt

Place in Lucy's desktop (limited-privlege user)

#### proof.txt
Goes to Administrator desktop

#### proof2.txt
Goes to WC2

Rename to proof

#### proof3.txt
Goes to DC1

Rename to proof

### Disable local administrator account after everything

## Kali VM

We can go in and clear the history of everything we've done, and delete all the files etc.

Or we an back it up somewhere else - we just don't want our prep getting in the way of our exercise.