Page cover

Windows Enumeration

Users
Display User Info
net user john
Check Permissions for the current User
whoami /priv
Check Groups for the current User
whoami /groups
System
systeminfo
Lists all installed Windows updates
wmic qfe
Check all scheduled tasks settings
schtasks /query /fo LIST /v
Show tasks that are actively scheduled
(schtasks /query /fo LIST /v | Out-String) -split "`r`n`r`n" | Where-Object { $_ -match "Repeat: Every:" -and $_ -notmatch "Repeat: Every:\s+(N/A|Disabled)" } | ForEach-Object {
    Write-Output (($_ | Select-String "TaskName:").Line)
    Write-Output (($_ | Select-String "Repeat: Every:").Line)
    Write-Output ""
}
Firewall
Show all rules
Get-NetFirewallRule | Group-Object -Property Profile
Show all active rules
Get-NetFirewallRule | Where-Object {$_.Enabled -eq $true} | Measure-Object
Files Enumeration
Check File Permissions
icacls "C:\file.ps1"
Show all Shares
Get-SmbShare | Where-Object { $_.Name -like "*$" }

Last updated