Prepare a Windows Server 2016/2019 Standard image for analysis

Log on to the virtual machine as administrator.

If the Manage Your Server window page appears, select Don't Display the page at logon and close the page.

If the Server Manager windows is displayed, select Manage → Server Manager Properties, select Do not start Server Manager automatically at logon, then select OK.

Disable the shutdown event tracker:

1. Select Start → Run, type gpedit.msc, then click OK.

2. In the Local Group Policy Editor page, select Computer Configuration → Administrative Templates → System, then double-click Display Shutdown Event Tracker.

3. Select Disabled, then click OK.

4. Close the Local Group Policy Editor page.

Turn off the firewall in the virtual image:

1. Select Start → Control Panel → Windows Firewall → Turn on Windows Firewall On or Off.

2. Select Turn off Windows Firewall (not recommended), for the following, then click OK.

   • Home or work (private) networks

   • Public networks

Configure FTP settings in the virtual image:

1. Install IIS Manager if not already present and make sure you check the FTP Server checkbox when installing IIS Manager.

   1. From Server Manager page, select Add Roles and Features, then click Next.

   2. In the Installation type page, select Role-based or feature-based installation, then click Next.

   3. In the Server selection page, select Select a server from the server pool, then click Next.

   4. In the Server Roles page, expand the Web Server (IIS) node, expand the FTP Server node, select FTP Server, select FTP Service, then click Next.

   5. In the Select features page, select the Telnet Client checkbox, then click Install. You can skip this step if you do not require a Telnet client.

   6. In the confirmation page, click Install.

2. Select Start → Administrative Tools → Internet Information Services(IIS) Manager.

3. In the Internet Information Services Manager page, select ADMINISTRATOR → Sites, then right-click on Sites and select Add FTP Site.

4. In the Add FTP Site wizard, do the following.

   • Provide the FTP site name as root and Physical path as C:\, then click Next.

   • For Bindings and SSL Settings, select No SSL, then click Next.

   • For Authentication and Authorization Information, select Basic under Authentication, select All Users under Allow access to, select both Read and Write under Permissions.

   • Click Finish.

Ensure that .NET Framework 4.6.2 is installed.

Set automatic logon:

1. Select Start → Run, type netplwiz, then press Enter.

2. In the User Accounts window, deselect Users must enter a user name and password to use this computer, then click Apply.

3. In the Automatically log on page, provide these credentials.

   • User name — Administrator

   • Password — cr@cker42

   • Confirm Password — cr@cker42

Disable Windows updates and Windows Defender:

1. Select Start → Run, type gpedit.msc, then press Enter.

2. Select Computer Configuration → Administrative Templates → Windows Components → Windows update.

3. On the right pane, double click Configure Automatic Updates, then select Disable.

4. Click OK.

5. Select Computer Configuration → Administrative Templates → Windows Components → Windows Defender.

6. On the right pane, double click Turn off Windows Defender , then select Enable.

7. Click OK.

Configure Microsoft Office 2019:

1. To analyze Microsoft Word, Excel, and PowerPoint files, install Microsoft Office 2019 on the virtual machine.

2. Lower the security to run macros for the Office applications. In Microsoft Word , select the Microsoft Office 2019 option on the top left corner, then select Word options → Trust Center → Trust Center Settings → Macro Settings, then select Enable all macros (not recommended potentially dangerous code can run). Do the same for other applications such as Microsoft Excel and PowerPoint.

3. Lower the security to run ActiveX for the Office applications. In Microsoft Word 2007, select the Microsoft Office option on the top left corner, then select Word options → Trust Center → Trust Center Settings → ActiveX Settings, then select Enable all controls without restrictions and without prompting (not recommended potentially dangerous code can run). Do the same for other applications such as Microsoft Excel and PowerPoint.

4. On the Welcome to Microsoft Office 2019 page, click Next button.

5. On the Sign-up for Microsoft Update page, select I don't want to use Microsoft Update, then click Finish.

Configure Adobe Reader:

1. To analyze PDF files, download Adobe Reader to the native host and install it to the VM.

2. In Adobe reader, if Adobe Reader Protected Mode message appears, select Open with Protected Mode disabled, then select OK.

3. If Accessibility Setup Assistance message appears, select Cancel.

4. Select Edit → Preferences → Updater, select Do not download or install updated automatically, select OK, then select Yes to confirm the changes.

Configure Java:

1. Open Registry Editor

2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Update\Policy\EnableJavaUpdate.

3. Set its value to 0.

4. Close the Registry Editor.

Configure Adobe flash player:

1. Run the command prompt as an Administrator.

2. Execute the following command:

   dism.exe /online /add-package /packagepath:"<Adobe-Flash-For-Windows-Package>.mum"

   Note

   Replace <Adobe-Flash-For-Windows-Package> with the name and path of the Adobe Flash for Windows package MUM file.

3. Restart the VM.

Configure system startup:

1. Select Start → Run, type msconfig, then click OK.

2. From the Startup tab, deselect reader_sl and jusched, then click OK.

   Note

   reader_sl is available only when Adobe Reader is installed.

3. In the System Configuration dialog, select Don't show this message again, then select Restart.

Configure the default browser:

1. In Internet Explorer, select Tools → Internet Options.

2. In Home page select Use Blank or Use new tab based on the version of Internet Explorer.

3. From the Privacy tab, uncheck Turn on Pop-up Blocker.

4. Go to the Advanced tab of the Internet Options and locate Security, then select Allow active content to run in files on My Computer.

5. Open Registry Editor.

6. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}.

7. Set its value to 0.

8. Close the Registry Editor.