Windows Enumeration

On Windows, the goal is usually to go from a normal user to NT AUTHORITY\SYSTEM — the highest local account, even above Administrator. As on Linux, success starts with thorough enumeration of the system.

First, learn who you are and what privileges your token holds. whoami /priv is critical — privileges like SeImpersonate or SeBackup are direct escalation routes.

Gather OS version, architecture, and installed hotfixes. Missing patches map to kernel/privilege CVEs.

List local users and group memberships. Look for accounts in the Administrators group and for groups that grant special rights.

Map the host's network: interfaces, listening ports, and connections. Internal-only services may be exploitable for escalation or pivoting.

Enumerate processes and services, noting which run as SYSTEM. Services are a top escalation source on Windows.

Inspect scheduled tasks. A task running as SYSTEM that executes a file you can modify is a clean escalation path.

Hunt for stored secrets: unattended-install files, saved RDP/Wi-Fi credentials, registry autologon, and config files. Windows hides credentials in predictable places.

Catalog installed programs and patch level. Vulnerable third-party software running as SYSTEM, or a missing patch, becomes the escalation vector.

Automate with WinPEAS, PowerUp (PowerShell), Seatbelt, and Windows-Exploit-Suggester. They flag misconfigurations and missing patches, but always verify findings by hand.

Defender may quarantine these tools; encode or run from memory only with authorization. Conduct Windows privesc strictly within an authorized, scoped engagement.

Test your Windows enumeration knowledge.

You learned Windows enumeration:

• Goal: reach NT AUTHORITY\SYSTEM
• Check whoami /priv, systeminfo, users/groups
• Enumerate services, scheduled tasks, and stored credentials
• Automate with WinPEAS / PowerUp, then verify

Next: service misconfigurations.