Important! Bring your own system configured according to these instructions!
A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.
To get the most value out of the course, students are required to bring their own laptop so that they can connect directly to the enterprise laboratory environment.
Course exercises are based around a virtual Windows operations platform. The tailored operations platform designed for this course will provide the optimal learning experience. VMware Player or VMware Workstation is required for the class. If you plan to use a Mac, please make sure you bring VMware Fusion.
Host Operating System: Latest version of Windows 10, macOS 10.15.x or later, or Linux that also can install and run VMware virtualization products described below. It is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices. Those who use a Linux host must also be able to access exFAT partitions using the appropriate kernel or FUSE modules. CRITICAL NOTE: Apple systems using the M1 processor line cannot perform the necessary virtualization functionality and therefore cannot in any way be used for this course.
You also must have a minimum of 8 GB of RAM for the Virtual Machine to function properly in the class. A VMware product must also be installed prior to coming to class. Verify that under BIOS, Virtual Support is ENABLED.
The course includes a VMware image file of a guest Windows system that is larger than 12 GB. Therefore, you need a file system with the ability to read and write files that are larger than 3 GB, such as NTFS on a Windows machine.
IMPORTANT NOTE: You will also be required to disable your anti-virus tools temporarily for some exercises, so make sure you have the anti-virus administrator permissions to do so. DO NOT plan on just killing your anti-virus service or processes, because most anti-virus tools still function, even when their associated services and processes have been terminated. For many enterprise-managed clients, disabling your anti-virus tool may require a different password than the Administrator account password. Please bring that Administrator password for your anti-virus tool.
Enterprise VPN clients may interfere with the network configuration required to participate in the class. If your system has an enterprise VPN client installed, you may need to uninstall it for the exercises in class.
Download and install either VMware Workstation Pro 15.5.x, VMware Player 15.5.x or Fusion 11.5.x or higher versions before class. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. Other virtualization software, such as VirtualBox and Hyper-V, are not appropriate because of compatibility and troubleshooting problems you might encounter during class.
VMware Workstation Pro and VMware Player on Windows 10 is not compatible with Windows 10 Credential Guard and Device Guard technologies. Please disable these capabilities for the duration of the class, if they're enabled on your system, by following instructions in this document.
We will also provide a licensed Enterprise Edition Windows 10 image with all of our tools pre-installed that runs within VMware Player or VMware Workstation.
Mandatory System Requirements
- System running Windows, Linux, or Mac OS X 64-bit version
- At least 8 GB of RAM
- 40 GB of available disk space (more space is recommended)
- Administrator access to the operating system
- Anti-virus software will need to be disabled to ensure an ideal learning environment
- An available USB type-A port
- Wireless NIC for network connectivity
- Workstation must be OPSEC SAFE and should NOT contain any personal or company data; you will connect to a high-risk, live-fire environment
- Verify that under BIOS, Virtual Support is ENABLED
Mandatory Downloads Prior to Coming to Class:
- Installed 64-bit host operating systems (Windows is recommended)
- Download and install VMware Workstation Pro 15.5.X+, VMware Player 15.5.X+ or Fusion 11.5+
By bringing the right equipment and preparing in advance, you can maximize what you will see and learn, as well as have a lot of fun.
I have confirmed that:
- I have administrator access to the operating system
- I have at least 8 GB of RAM and 40 GB of available disk space
- Anti-virus is disabled
- The system includes a working USB port
- I have downloaded and installed the VMWare Workstation, Fusion, or Player
Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.
SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.