One of the risks being simulated for organizations are stolen laptops.

Was wondering if anyone had a methodology/list of items to check when assessing the security of Windows laptops.

Here is my list so far:

  • Check that disk encryption (using TPM) is in use
  • Trying to steal credentials from locked machine by abusing USB permissions Bash Bunny (quickcreds)
  • Spoofing various services that Windows relies on in enterprise environments (Responder)
  • Port scanning for open/vulnerable services
  • Vuln scan for cases where running unpatched version of Windows

What are some other things that can be tried that can add value to the test?

  • check that users are not writing the disk encryption password on a stickynote on the device or keep the encryption key USB stick in the same bag as the device
    – schroeder
    Jun 7 '18 at 15:04
  • Questions asking for lists will get closed. Can you narrow the question down a little?
    – schroeder
    Jun 7 '18 at 15:05

While some of the things you bring up are going in the right direction ... bottom line with a stolen laptop is

Physical Access is Root access

While locking down a laptop will help, ultimately it is just buying you time.

  • New vulnerabilities will be found
  • Encryption will eventually be cracked
  • Users love weak, repeatedly used passwords (often on a sticky note stuck to the keyboard)

IMO, best thing to do with a laptop is to not keep any damn-ing information on it ... and instead use it to VPN into the company and keep all company files on company servers. In this case, if a laptop gets stolen and you have a VPN with 2 Factor auth ... the account can be re-keyed before the attacker can do anything dangerous.


  • 2
    Even if organization laptop is not the same as personal laptop, i'd like to add a reference to a DefCon talk youtube.com/watch?v=Jwpg-AwJ0Jc It's showing that one of the best way to recover stolen device is to not secure them too much. Thus the thieft doesn't wipe it, and you can access it remotely. This is true only if the laptop itselft is more valuable than the data. Jun 7 '18 at 10:29
  • 3
    I have seen that video before, and enjoyed it greatly, however, in almost every case I have ever seen the corporate IP is way more valuable than the laptop hardware itself. Jun 7 '18 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.