Though the level of security in a computer system should reflect the policies of the organization, a baseline reasonable policy will be used as the foundation for discussion of the methods, techniques, and tools used in doing a SPA for NT networks. Common and not so common attacks against Windows NT networks will be discussed, as well as possible defenses that can be used to uphold the security policy. There will as so be a small discussion about what and how information should be preserved in the case that a security incident occurs. Some assessment tools will be provided.