Class notes · TryHackMe Pre Security (2026 path) · Module 3

Quick reference: the short version of this module is the Module 3 cheat sheet. OS internals in more depth are in TCM Help Desk section 6.

Note: rooms in this module include Operating Systems: Introduction and Windows Basics, with Linux covered alongside. These notes are written from the module outline — cross-check room specifics as you go.

Learning objectives

By the end of these notes you should be able to:

Explain what an OS does, and the main OS types.
Find your way around Windows: the interface, system information, apps, files and security settings.
Use the essential Windows admin tools and their Run shortcuts.
Navigate Linux from the terminal, and read and change basic permissions.
Explain user accounts, administrator/root privileges, UAC and sudo.
Inspect processes and system information on both operating systems.
Apply basic OS security hygiene.

1. The operating system’s job

An operating system sits between you, your applications and the hardware. It manages resources so programs can share the machine safely.

Job

What it means for you

Process management

Many apps run “at once” — the OS shares CPU time between them

Memory management

Each app gets its own memory; one can’t read another’s

File management

Files and folders, paths, permissions

Device management

Drivers make printers, Wi-Fi and USB devices work

User management

Accounts, passwords, admin rights

Interface

Desktop (GUI) and command line (CLI)

1.1 OS types

Type

Examples

Built for

Desktop

Windows 11, macOS, Ubuntu Desktop

One user at a keyboard

Server

Windows Server, Ubuntu Server, RHEL

Running services for many users; often no GUI

Mobile

Android, iOS

Touch, battery life, app stores, sensors

Embedded

Custom Linux, RTOS

One dedicated job inside a device

Real-time (RTOS)

FreeRTOS, VxWorks

Guaranteed response times (cars, industrial control)

1.2 Worked example — “what is this old computer?”

A friend gives you an old PC and can’t remember anything about it. Before deciding whether to wipe, upgrade or sell it, identify it.

If it runs Windows:

Question

How

Which Windows, and which build?

Win+R → winver

CPU, RAM, model, BIOS mode

Win+R → msinfo32

Full summary, including install date and hotfixes

systeminfo in Command Prompt

Storage and free space

File Explorer → This PC, or Get-Volume

Is it activated and still supported?

Settings → System → Activation; compare the build with Microsoft’s support dates

If it runs Linux:

cat /etc/os-release \

distribution and version

uname -r \

kernel version

lscpu | head \

CPU

free -h \

RAM

lsblk \

disks

Decision:

An unsupported OS version (no more security updates) should be upgraded or wiped before it’s used online.
Old personal data on it should be securely erased before selling.

2. Windows basics

2.1 The interface

Element

Use

Desktop

Shortcuts and open windows

Start menu

Launch apps; just start typing to search

Taskbar

Pinned and running apps, system tray, clock and notifications

File Explorer (Win+E)

Browse drives, folders and files

Settings (Win+I)

Modern configuration: Wi-Fi, updates, accounts, privacy

Control Panel (control)

Classic configuration; some settings still only live here

Useful shortcuts:

Shortcut

Does

Win+R

Run box

Win+X

Power-user menu

Ctrl+Shift+Esc

Task Manager

Win+L

Lock the PC

Win+D

Show the desktop

Alt+Tab

Switch apps

2.2 Run-box tools every technician uses

Type in Win+R

Opens

Use it to

winver

About Windows

Check the exact version and build

msinfo32

System Information

Hardware, BIOS mode, Secure Boot state, drivers

taskmgr

Task Manager

Processes, performance, startup apps

resmon

Resource Monitor

Detailed CPU, memory, disk and network use per process

control

Control Panel

Classic settings

appwiz.cpl

Programs and Features

Uninstall or repair programs

sysdm.cpl

System Properties

Computer name, domain, remote settings, environment variables

ncpa.cpl

Network Connections

Adapter settings, IP configuration

services.msc

Services

Start, stop and configure background services

eventvwr.msc

Event Viewer

System, Application and Security logs

compmgmt.msc

Computer Management

Disks, users, services and logs in one console

diskmgmt.msc

Disk Management

Partitions and volumes

lusrmgr.msc

Local Users and Groups

Local accounts (Pro/Enterprise editions only)

wf.msc

Firewall with Advanced Security

Detailed firewall rules

regedit

Registry Editor

Low-level settings — back up before editing

2.3 Files and folders

Paths start with a drive letter and use backslashes: C:\Users\andrew\Documents\report.docx.

Folder

Holds

C:\Windows

The operating system

C:\Program Files

64-bit applications

C:\Program Files (x86)

32-bit applications

C:\Users\

Each user’s profile: Desktop, Documents, Downloads, AppData

C:\Users\\AppData

Per-user app settings and data (hidden by default)

Turn on File Explorer → View → Show → Hidden items and File name extensions.

2.4 Installing and removing apps

Method

Notes

Microsoft Store

Sandboxed apps, auto-updated

Installer (.exe / .msi)

Traditional; usually needs admin rights

winget

Command-line package manager, e.g. winget install Mozilla.Firefox

Uninstall

Settings → Apps → Installed apps, or appwiz.cpl

2.5 Security settings

Area

Where

What to check

Antivirus

Windows Security → Virus & threat protection

Real-time protection on; definitions current

Firewall

Windows Security → Firewall & network protection

On for all profiles (domain, private, public)

Updates

Settings → Windows Update

Up to date; no failed updates

Account protection

Windows Security → Account protection

Windows Hello, dynamic lock

UAC

Control Panel → User Accounts

Not set to “Never notify”

Device security

Windows Security → Device security

Core isolation / memory integrity; TPM and Secure Boot

Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusSignatureLastUpdated Get-NetFirewallProfile | Select-Object Name, Enabled Update-MpSignature \

update Defender definitions

Start-MpScan -ScanType QuickScan \

run a quick scan

3. Linux basics

3.1 The terminal and the file system

Linux is usually managed from a terminal running a shell (typically Bash). Everything lives in one tree starting at / — there are no drive letters.

Directory

Holds

The root of everything

/home/

Users’ files (~ is shorthand for your own)

/root

The root user’s home

/etc

System configuration files (plain text)

/var/log

Log files

/bin, /usr/bin

Programs

/tmp

Temporary files

Task

Command

Where am I?

pwd

List files (including hidden, with details)

ls -la

Change directory

cd /etc, cd ~, cd ..

Read a file

cat file, less file

Find text in a file

grep “word” file

Make / remove directory

mkdir name, rmdir name

Copy / move / delete

cp, mv, rm (no recycle bin)

The Shotts class notes cover all of this in depth.

3.2 Installing software

Distro family

Package manager

Update everything

Install

Debian / Ubuntu

apt

sudo apt update && sudo apt upgrade

sudo apt install nmap

RHEL / Fedora

dnf

sudo dnf upgrade

sudo dnf install nmap

4. Users and privileges

4.1 Standard vs administrative accounts

Windows

Linux

All-powerful account

Administrator (and members of the Administrators group)

root (UID 0)

Everyday elevation

UAC prompt: “Do you want to allow this app to make changes?”

sudo — runs one command as root, after your password

Switch to another user

Sign out, or “Run as different user”

su - username

Who am I?

whoami, whoami /groups

whoami, id

List users

net user, Get-LocalUser

cat /etc/passwd

Admin members

net localgroup administrators

getent group sudo (Ubuntu) or wheel (RHEL)

UAC (User Account Control) means even administrators run with standard rights until an action needs elevation. Then Windows asks for confirmation. It limits the damage malware can do silently.

4.2 Linux permissions

Every file has an owner, a group and permissions for three classes: user (owner), group and others.

Letter

On a file

On a directory

Octal value

Read contents

List contents

Modify

Create and delete files inside

Run as a program

Enter (cd)

Worked example — setting permissions:

Goal: you wrote backup.sh. You should read, write and run it; your team group should read and run it; nobody else should touch it.
Octal per class: owner rwx = 4+2+1 = 7; group r-x = 4+0+1 = 5; others — = 0.
Apply it:

chmod 750 backup.sh ls -l backup.sh \

-rwxr-x— … backup.sh1. Symbolic alternative: chmod u+x backup.sh adds execute for the owner only.

Changing ownership needs root:

sudo chown andrew:devs backup.sh

Windows uses NTFS permissions (ACLs): right-click → Properties → Security, or icacls C:\Data from the command line.

5. Processes and system information

5.1 Processes

Task

Windows

Linux

Live view

Task Manager (Ctrl+Shift+Esc)

top (or htop)

List all

tasklist, Get-Process

ps aux

Find one

Get-Process -Name chrome

ps aux | grep ssh

End one

taskkill /PID 1234 /F, Stop-Process -Id 1234

kill 1234 (kill -9 only as a last resort)

Services

services.msc, Get-Service

systemctl status ssh, systemctl list-units –type=service

5.2 Worked example — “the PC is really slow”

Look: open Task Manager → Processes, and sort by CPU, then by Memory.
Find the culprit: an unknown process, updater_x.exe, is using 90 % CPU.
Investigate before killing it:
- Right-click → Open file location. Where does it run from? C:\Users\…\AppData\Local\Temp is suspicious; C:\Program Files\ is less so.
- Right-click → Properties → Digital Signatures. Is it signed by a known publisher?
- Search the exact file name.
Decide:
- Legitimate but stuck (e.g. a known updater): end it and update the software.
- Unknown, in Temp, unsigned: don’t just kill it and move on — treat it as potential malware and follow the security procedure.

5.3 System information commands

Need

Windows

Linux

OS version

winver, systeminfo

cat /etc/os-release

Kernel / build

systeminfo | findstr /B /C:“OS Version”

uname -r

Hostname

hostname

Uptime

(Get-CimInstance Win32_OperatingSystem).LastBootUpTime

uptime

Disk space

Get-Volume

df -h

IP configuration

ipconfig /all

ip a

Logs

Event Viewer (eventvwr.msc)

journalctl, /var/log

6. GUI vs CLI

GUI

CLI

Discoverable — you can see the options

You need to know the commands

Slow for repetitive tasks

Fast, scriptable, repeatable

Hard to document precisely

The command is the documentation

Needs a desktop session

Works remotely over SSH or PowerShell remoting

Technicians use both: the GUI to explore, the CLI to repeat and automate.

7. Security perspective

Least privilege. Use a standard account for daily work and elevate only when needed (UAC, sudo). Malware runs with the rights of whoever launched it.
Keep protections on: real-time antivirus, firewall, automatic updates. “Temporarily” disabling them is a common way incidents start.
Weak passwords and exposed remote logins get attacked. SSH or RDP open to the internet with weak passwords is brute-forced constantly. Use strong passwords, keys and MFA, and don’t expose these services unnecessarily.
Command history leaks secrets. ~/.bash_history and the PowerShell history file record what was typed, including any password on the command line. Attackers look there after getting in; so do investigators.
Logs are evidence.
- Windows: Security log event 4624 = successful logon, 4625 = failed logon.
- Linux: /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL).
Permissions matter:
- 777 (anyone can do anything) is almost always wrong.
- Private keys and credentials should be 600.
- Watch out for world-writable scripts that root runs.

Summary

The OS manages processes, memory, files, devices, users and the interface. Types include desktop, server, mobile, embedded and real-time.
Windows:
- The Start menu, Explorer, Settings and Control Panel.
- Win+R tools: winver, msinfo32, taskmgr, services.msc, eventvwr.msc, ncpa.cpl.
- Windows Security for antivirus, firewall and device security.
Linux: one tree from /; the terminal with pwd, ls, cd, cat, grep; packages with apt or dnf.
Privileges: Administrator/UAC on Windows; root/sudo on Linux. Work as a standard user.
Linux permissions: r=4, w=2, x=1 for user/group/others — chmod 750, chown user:group.
Processes: investigate before killing — check the location and signature.

Glossary

Term

Definition

GUI / CLI

Graphical / command-line user interface

Shell

A program that interprets commands (PowerShell, Bash)

Terminal

A window giving access to a shell

Run box

Win+R dialog for launching programs by name

.msc / .cpl

Microsoft Management Console snap-in / Control Panel applet

Profile

A user’s folder and settings (C:\Users\name, /home/name)

Administrator / root

The all-powerful account on Windows / Linux

UAC

User Account Control — prompts before admin-level changes

sudo

Runs one command with root privileges on Linux

Least privilege

Using only the minimum rights needed

Permission bits

r, w, x for user, group and others on Linux

Octal notation

Numeric permissions, e.g. 750

ACL

Access control list — Windows/NTFS permissions

Process / PID

A running program / its process ID

Service / daemon

A background process (Windows term / Linux term)

Package manager

A tool that installs and updates software (apt, dnf, winget)

Event Viewer

Windows log viewer

Distro

A Linux distribution

Review questions

Which Run command shows the exact Windows version and build?
Where do 32-bit programs install on 64-bit Windows?
What does UAC do for an administrator account?
What does chmod 640 notes.txt set?
Write the octal permission for rwxr-xr-x.
Which Linux command runs a single command with root privileges?
An unknown process runs from AppData\Local\Temp and is unsigned. What should you do?
Which tool shows Windows Security, Application and System logs?
How do you update all packages on Ubuntu?
Give two reasons to prefer the CLI for repetitive admin tasks.
Which Windows event ID records a failed logon?
Why is typing a password as a command argument risky?

Answer key

winver.
C:\Program Files (x86).
It runs the administrator with standard rights until elevation is needed, then asks for confirmation — limiting silent changes by malware.
Owner read/write, group read, others nothing — rw-r—–.
755.
sudo.
Treat it as potential malware. Don’t just kill it; check its signature and details, and follow the security procedure (isolate and report).
Event Viewer (eventvwr.msc).
sudo apt update && sudo apt upgrade.
Any two of: faster; scriptable and repeatable; works remotely; self-documenting.
4625.
It’s saved in shell history files (and may be visible in process lists and logs), where attackers or others can read it.