The problem
Canritco is a fictional French company with 600 employees and a mixed Windows estate. We acted as external consultants hired to audit a standard employee workstation.
The brief: inventory the assets, map the exposure, identify the top risks, and hand over a 90-day plan, with proof attached to every finding.
Audit method
- 01CIA inventory
- 02Nmap exposure
- 03CIS baseline
- 04Log timeline
- 05Risk register
- 0690-day plan
Top risks found
| RISK | EVIDENCE | LEVEL |
|---|---|---|
| BitLocker disabled on the workstation | manage-bde | CRITICAL |
| Shared local admin account, no traceability | Local users export | HIGH |
| SMB share open to Everyone | net share | HIGH |
| TeamViewer installed as shadow IT | Software inventory | HIGH |
| Ports 135 and 445 exposed | Nmap scan | MEDIUM |
| Partial CIS compliance, score 3.24 / 6 | HardeningKitty | MEDIUM |
Straight from the code
Excerpts from the actual repository and deliverables, trimmed for length.
Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-15 00:53 +0100
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00096s latency).
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
445/tcp open microsoft-ds?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Nmap done: 1 IP address (1 host up) scanned in 6.66 secondsRaw evidence behind risks R5 and R6: only two ports exposed, and 445 gives access to the over-permissive SMB share.
"ID","Category","Name","Severity","Result","Recommended","TestResult"
"1.1.1","Account Policies","Length of password history maintained","Low","None","24","Failed"
"1.1.2","Account Policies","Maximum password age","Passed","42","365","Passed"First lines of the 621-check CIS baseline export, the source of the 3.24 / 6 score and the password policy recommendations.
Results
What I'd do differently
A finding without proof is an opinion. Every risk in the register points to a raw export. Next time: automate the collection with one PowerShell script so the audit can be repeated every quarter.