# Windows Network Enumeration

> Covers active Windows network enumeration techniques including host discovery, share mapping, SMB reconnaissance, and user/group extraction via native and third-party tools.

- **URL:** https://hackindex.io/platforms/windows/enumeration/windows-network-enumeration
- **Path:** Windows > Enumeration
- **Up:** [Enumeration](https://hackindex.io/platforms/windows/enumeration.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

Network enumeration from a Windows target maps the local network configuration, firewall rules, and reachable hosts. This runs at multiple stages:

- Before exploitation, to understand what is accessible from outside
- After gaining access, to identify pivot points and internal services
- During lateral movement, to find new network segments and hosts

Focus on interfaces, active connections, firewall rules, and network shares.

## Network configuration

**Interface and routing information**

```powershell
# All interfaces with IPs, MACs, DNS
ipconfig /all

# Routing table
route print

# ARP cache: recently contacted hosts
arp -a

# DNS cache: recently resolved names
ipconfig /displaydns

# PowerShell
Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress, PrefixLength
Get-NetRoute | Select-Object DestinationPrefix, NextHop, InterfaceAlias
Get-DnsClientCache | Select-Object Entry, Data
```

## Active connections and listening ports

**Connections and open ports**

```powershell
# All connections with PIDs
netstat -ano

# Listening services only
netstat -ano | findstr LISTENING

# Match PIDs to process names
netstat -anob

# PowerShell
Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess | Sort-Object State

# Find process name from PID
Get-NetTCPConnection | Where-Object {$_.State -eq 'Listen'} | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{Port=$_.LocalPort; Process=$proc.Name; PID=$_.OwningProcess}
} | Sort-Object Port
```

## Firewall rules

Firewall enumeration reveals which ports are blocked outbound and what inbound rules exist. This determines which exfiltration channels and reverse shell protocols are viable.

**Firewall configuration**

```powershell
# Firewall state per profile
netsh advfirewall show allprofiles state

# All inbound rules
netsh advfirewall firewall show rule name=all dir=in

# All outbound rules
netsh advfirewall firewall show rule name=all dir=out

# PowerShell
Get-NetFirewallRule | Where-Object {$_.Enabled -eq 'True'} | Select-Object DisplayName, Direction, Action, Profile

# Find rules allowing inbound connections
Get-NetFirewallRule | Where-Object {$_.Direction -eq 'Inbound' -and $_.Action -eq 'Allow' -and $_.Enabled -eq 'True'} | Select-Object DisplayName, Profile
```

## Hosts file and DNS configuration

**Hosts file and DNS**

```powershell
# Hosts file: custom name resolution, may reveal internal hostnames
type C:\Windows\System32\drivers\etc\hosts

# Configured DNS servers
Get-DnsClientServerAddress | Select-Object InterfaceAlias, ServerAddresses

# DNS search suffixes
Get-DnsClient | Select-Object InterfaceAlias, ConnectionSpecificSuffix
```

## Network shares

**Local and mapped shares**

```powershell
# Local shares
net share
Get-SmbShare

# Mapped network drives
net use
Get-PSDrive -PSProvider FileSystem | Where-Object {$_.Root -like '\\*'}

# Connected sessions to this host
net session
Get-SmbSession
```