0.4 Building the Course VM

Introduction

The course is practical: you will plant the case on a machine, collect it with KAPE, process it with the EZ Tools and analyze what comes back, and the machine you do that on is a virtual machine you build for this course and use for nothing else.

This lesson builds it. One Windows 11 VM, a snapshot you return to before each host, an evidence drive outside that snapshot, and an account that holds nothing about you.

By the end of this lesson you can:

• Build a Windows 11 VM that meets the course's requirements, including a virtual TPM and Secure Boot.
• Install Windows with an account that keeps your own details out of the evidence.
• Give the VM a network your computer can reach over Remote Desktop, and an evidence drive that survives a revert.
• Take the clean snapshot and confirm the VM is ready for the case.

The case scripts change the machine they run on, on purpose. They rename it, create accounts, plant a scheduled task, a service and a Run value, create, rename and delete files, and clear an event log.

All of it is harmless: the "attacker tools" are renamed copies of programs that ship with Windows, and nothing leaves the VM. But a machine the scripts have run on is a machine whose evidence now contains an intrusion, and that is not something to do to a computer you use for anything else.

There is a second reason, which is about the evidence itself. Everything on the machine you collect ends up in the collection: the accounts, the programs installed, the files in the profile.

On a computer you use every day that would include your own name, your browsing, your documents. On a VM built for the course it includes only Windows, the tools and the case, which is what makes the evidence clean to read and safe to keep.

The scripts check for this themselves and refuse to run on anything that does not identify as a virtual machine. That check is a safety net, not a substitute for using the right machine.

Windows 11 sets the floor. Microsoft's minimums are a 64-bit processor with two or more cores at 1 GHz, 4 GB of memory, 64 GB of storage, UEFI firmware capable of Secure Boot, and a Trusted Platform Module version 2.0.

A virtual machine meets the last two through the hypervisor: UEFI with Secure Boot is a firmware setting on the VM, and the TPM is a virtual device you add to it.

Once Windows is installed, two commands in an administrator PowerShell window confirm the two requirements a VM most often misses:

PS C:\> (Get-Tpm).TpmPresent
True
PS C:\> Confirm-SecureBootUEFI
True

Above the floor, memory makes the most difference to the course. KAPE's processing runs several EZ Tools in turn over a collection, and the larger tools, MFTECmd on a busy file system in particular, run faster with room to work. If your computer can give the VM 8 GB without struggling, do. Disk matters less: the VM's own disk holds Windows, and the collections go to the evidence drive.

The evidence drive needs room for three collections and their processed output. Thirty gigabytes is comfortable; the collections themselves are a few gigabytes each at most.

The VM borrows its processor, memory and disk from your own computer, so your computer has to have them to spare. Before creating anything, check that hardware virtualization is switched on.

Most processors from the last decade support it, Intel as VT-x and AMD as AMD-V, but many computers ship with it disabled in the firmware settings, and a hypervisor without it either refuses to start a VM or runs one too slowly to use.

Memory is the usual constraint. Whatever you give the VM is taken away from your own system while the VM runs, so on a computer with 8 GB in total, giving the VM 4 GB leaves your own system short and both will crawl.

Sixteen gigabytes lets you give the VM 8 GB and still use your computer normally. Disk is less often the problem, but plan for the VM's disk, the space its snapshot grows into as the case changes the machine, and the evidence drive together.

Set your computer not to sleep while a run is in progress. A host takes a couple of hours from revert to collection, much of it spent waiting between steps, and a computer that sleeps in the middle pauses the VM's clock along with everything else.

That leaves a gap in the evidence the case did not put there, and you would then have to explain it in your timeline as if it were real.

Any hypervisor that can do four things will run the course: take and revert snapshots, provide a virtual TPM 2.0, give the VM a network your computer can reach, and, optionally, pass a USB stick through to the VM.

VMware Workstation Pro, VirtualBox and Hyper-V can all do the first three; the course's Lab Setup Guide walks through VMware Workstation Pro in detail, and the same settings exist under different names in the others.

Pick the one you already know if it meets the four, because familiarity with snapshots and networking saves more time than any difference between products. The USB pass-through is only needed for one part of Module 8, where a real stick gives fuller removable-media evidence than the virtual disk the script falls back to. Without it you lose detail in one lesson, not the course.

Whichever you choose, find its snapshot controls now. You will revert to the clean snapshot three times in Module 2 alone. Find, too, where it sets the VM's firmware to UEFI with Secure Boot and where it adds a virtual TPM, because those are the two settings most often missed on a first attempt, and Windows 11 setup refuses to continue without them.

In some hypervisors the TPM option only appears once the VM is set to UEFI, and in others it requires the VM's files to be encrypted first, so look before you start rather than halfway through an installation.

Any edition of Windows 11 you are licensed to install will do. If you do not have a spare license, Microsoft's Evaluation Center offers Windows 11 Enterprise for a 90-day evaluation: register, download the ISO, and install it without a product key. At the time of writing the Evaluation Center offers Enterprise 26H2 as an x64 or Arm64 ISO, with LTSC 2024 also listed.

Ninety days is enough for the course at a steady pace, and the clean snapshot does not reset the evaluation clock, so note the date you installed.

When the evaluation expires, Windows turns the desktop black, shows a persistent notice and shuts down every hour, which would interrupt a collection at the worst moment. If you are close to the end date, rebuild the VM rather than run the case on a machine about to start shutting itself down.

The version matters in one place in the course: Module 5 reads Amcache, and from 26H1 Windows 11 records the same inventory in new databases as well. The lesson shows both, so any current version works.

The account you set Windows up with appears in every collection: its profile folder, its registry hive, its sign-ins in the event logs. If that is your own Microsoft account, your name and email address are in every piece of evidence you take in the course. Install with an account that holds nothing about you instead.

The simplest is a local account, which exists only on the VM. Microsoft has been removing the ways to create one during Windows 11 setup: the old OOBE\BYPASSNRO command was removed in 2025, and Microsoft has said it is removing the remaining known mechanisms from setup.

On Windows 11 Pro, setup still offers a route through Set up for work or school and then Domain join instead, which creates a local account. If your edition's setup offers no local option, create a new Microsoft account used only for this lab, with a name that is not yours, and sign in with that.

The case scripts create the case's own accounts on top of yours, so the evidence you analyze is about Laura Brennan and Kieran Ashworth. Your setup account is simply the one you use to run the scripts and KAPE. The course calls that account labadmin and the machine COURSE-VM. Use the same names during setup and the prompts in the lessons will match your own screen.

The VM needs two kinds of network access at different times. During setup it needs the internet, to install Windows and later to download KAPE and the EZ Tools.

During the case it needs to be reachable from your own computer, because when you play WS-031 you connect to it over Remote Desktop with the case's administrator account, and that connection is what writes the real RDP evidence on that host.

PS C:\> Get-NetIPAddress -AddressFamily IPv4 | Where-Object InterfaceAlias -notlike 'Loopback*' | Select-Object IPAddress, InterfaceAlias

PS C:\> Test-NetConnection <VM address> -Port 3389

Keep the VM off your home or office network. A bridged adapter puts it on the same network as every other device you own, which the case does not need and you should not want.

The hypervisor's own networks, NAT or host-only, let your computer reach the VM while keeping it separate from everything else. Find the VM's address with ipconfig once it is running, on the adapter your computer can reach, and note it with the account you installed with.

You do not need to test Remote Desktop yet. The case script enables it when you play WS-031, and 0.5 tells you when to connect. What you can check now is the route.

From your own computer, ping the VM's address; Windows blocks ping by default, so a reply is not guaranteed, but the attempt shows whether your computer has a route to that network at all. If your computer has no adapter on the same network as the VM, fix the hypervisor's network settings now, while nothing depends on it, rather than in the middle of the WS-031 run.

Reverting a snapshot returns the VM's disk to exactly how it was when the snapshot was taken, which is what lets one VM play three hosts. It would also throw away anything you collected, unless the collection is somewhere the snapshot does not reach. That somewhere is the evidence drive: storage the VM can write to that is not part of its snapshot.

PS C:\> Set-Content E:\revert-test.txt "written before the revert"

PS C:\> Test-Path E:\revert-test.txt

The evidence drive also holds the tools. Investigators run KAPE from external media rather than installing it on the machine they are collecting, so the tool changes the evidence as little as possible and the same known copy is used every time.

You will install KAPE and the EZ Tools onto the evidence drive in Module 1, so reverting the VM never loses them and they are never part of a host's own collection.

Test it before you rely on it: write a small file to the drive, revert the VM, and check the file is still there. A collection lost to a misconfigured disk costs a whole host's run. Give the drive a short, obvious label, such as EVIDENCE, and note the drive letter Windows assigns it.

Module 1 installs the tools under a folder on that drive, and every KAPE command in the course writes its output to a folder there named for the host, so a stable letter saves editing commands later. If the letter changes after a revert, set it once in Disk Management and take the snapshot again.

Hypervisors make it easy to move things between your computer and a VM: a shared clipboard, drag and drop, folders from your computer that appear inside the VM. Each is convenient and each is a way for something of yours to end up in the evidence, or for something from the case to end up on your computer.

The case is harmless, but the habit is not, and this course is a good place to build the habit an investigator keeps for real evidence.

Turn off what the course does not need. Nothing from the VM needs to reach your computer by copy and paste, because what you take away from it is the collection on the evidence drive.

If you use a shared folder as the evidence drive, share that one folder and nothing else; a VM that can see your Documents folder can collect it. Inside the VM, use the browser only to download Windows updates, KAPE and the EZ Tools, and never sign in to anything personal there.

The same rule applies in reverse. The collections are evidence of a staged intrusion and you will open them on the VM with the EZ Tools; there is no need to copy them onto your own computer to read them. Keeping the work inside the lab keeps the lab's evidence and your own data apart for the whole course.

The clean snapshot is the state every host starts from, so anything wrong in it is wrong three times. Before taking it, bring the machine to a settled state.

Install Windows updates and pause them, so an update does not start mid-run and add its own activity to the evidence. Check the clock and time zone match your computer's. Attach the evidence drive and make sure the VM can write to it.

Check Defender before the snapshot rather than assuming it. Both values should read True:

PS C:\> Get-MpComputerStatus | Format-List AntivirusEnabled, RealTimeProtectionEnabled

AntivirusEnabled          : True
RealTimeProtectionEnabled : True

Leave Microsoft Defender on. A real Northgate Engineering workstation runs antivirus, and the case is built from Windows' own programs so that Defender has nothing to stop. If Defender does object to a step on your build, the script stops and says so, and the fix belongs in the lab pack, not in turning protection off.

Do not install anything else. Every extra program is extra noise in every collection.

With the machine settled, shut it down and take a snapshot named clean. A powered-off snapshot is the most reliable: it captures the disk alone, with nothing mid-flight in memory. This is the state you revert to before each host, and the reason one VM can play three machines without their evidence mixing.

The case scripts protect the cycle too. If you run Deploy-Case.ps1 for one host on a VM that has already played another without being reverted, it refuses and tells you to revert first, because evidence from two hosts on one disk would make every exercise unreliable. Revert first, every time, even if you think nothing has changed.

Keep the clean snapshot for the whole course. If something goes wrong in a run, reverting and starting that host again costs a few minutes; rebuilding the VM costs an evening. Resist taking more snapshots on top of it.

A snapshot taken halfway through a host's run looks like a handy restore point, but it captures a machine with part of the case on it, and reverting to it later produces evidence with gaps and duplicates the model answers do not describe.

One clean snapshot, reverted to before each host, is the whole scheme. If you ever need to change the clean state, for example after installing a pending update, revert, make the change, shut down and replace the snapshot.

Sooner or later a run will go wrong: a step fails, you run one twice, a reboot comes at the wrong moment or a collection does not save. The instinct is to repair the machine and carry on.

Resist it. A repaired run leaves evidence of the failure and the repair alongside the case, and every exercise after that is reading activity the case did not put there and the model answers do not describe.

Reset-Case.ps1 says the same thing itself when it finishes:

PS C:\> E:\kape-ez-tools-lab-pack\Reset-Case.ps1
Case removed. Evidence already written stays on the machine;
revert to the clean snapshot for a true reset.

The lab pack includes Reset-Case.ps1, which removes the case's accounts, persistence, files and settings. Use it if you want the machine back in working order without reverting, but understand its limit, which the script states when it finishes: it cannot remove evidence already written.

Event log records, prefetch files, the file system journal and the registry's own history of what was there all stay. Only a revert to clean takes the machine back to a state with no case evidence in it at all.

Rerunning a host costs the time the run takes and nothing else, because the scripts and the clean snapshot produce the same evidence each time. Treat the snapshot as the safety net it is, and use it without hesitating.

Before moving on, check five things. They take a few minutes and they are the difference between a smooth Module 2 and an evening spent working out why a collection did not save.

If any check fails, fix it before 0.5. The most common failure is the evidence drive: a shared folder the VM can see but not write to, or a second disk that was included in the snapshot after all.

The second most common is a network the VM can reach out of but your computer cannot reach into, which only shows itself when you try to connect over Remote Desktop for WS-031.

With the VM ready, 0.5 walks through the lab pack and the three runs, and Module 1 installs KAPE and the EZ Tools onto the evidence drive.

Practice

Build the lab you will use for the rest of the course.

Check your understanding

Answer each question before you read on. Every option explains itself once you choose it, the wrong ones too.

Resources

Checked 25 October 2026. Publishers revise these pages; where a page and this lesson disagree, the page is newer.

• Windows 11 specifications and system requirements (Microsoft)
• Windows 11 Enterprise evaluation (Microsoft Evaluation Center)
• Microsoft blocks bypass to skip Microsoft Account during setup on Windows 11 (Pureinfotech, 6 October 2025)