Enumerate Windows Environments

author: Nathan Acks
date: 2022-08-17


Windows’ net command is can also be used to manipulate user and group information (if you already have admin/SYSTEM permission)! For example:

# Change a user's password

# Add a user to a domain
net user $USERNAME /add /domain

# Make a user a domain admin
net group "Domain Admins" $USERNAME /add /domain


The netstat command on Windows almost works exactly like its Linux equivalent. The difference is that -o displays the PID of the process using the connection on Windows (which, IMHO, is more useful than -o on Linux).


Use findstr to filter the output of systeminfo:

systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"


The wmic command is extremely useful, but is also deprecated (because of its usefulness to attackers!). It can be used on Windows 10 21H1 and earlier. For later systems, PowerShell command-lets will need to be used instead (which increases the risk that activity will be logged).

Useful Scripts