Investigating Windows Tryhackme Writeup

https://tryhackme.com/room/investigatingwindows

Room link: https://tryhackme.com/room/investigatingwindows
Note: This room is for Premium Members Only. who purchased THM premium membership.

This is a challenge that is exactly what is says on the tin, there are a few challenges around investigating a windows machine that has been previously compromised.

Connect to the machine using RDP. The credentials the machine are as follows:

Username: Administrator
Password: letmein123!

Question 1. Whats the version and year of the windows machine?

Answer: Windows server 2016

Question 2. Which user logged in last?

Answer: administrator

Question 3. When did John log onto the system last?

Answer format: MM/DD/YYYY H:MM:SS AM/PM

Answer: 03/02/2019 5:48:32…