# Windows System Enumeration

> Covers techniques for enumerating Windows systems, including users, groups, privileges, network config, running processes, and installed software to identify attack paths.

- **URL:** https://hackindex.io/platforms/windows/enumeration/windows-system-enumeration
- **Path:** Windows > Enumeration
- **Up:** [Enumeration](https://hackindex.io/platforms/windows/enumeration.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

System enumeration establishes the baseline for everything that follows. Run this on every Windows target before attempting privilege escalation or lateral movement. Key details to collect:

- OS version and architecture (determines available exploits)
- Installed patches and hotfixes (reveals missing security updates)
- Environment variables and system paths
- Installed software (identifies vulnerable applications)
- Drive layout and file system permissions

These details determine which exploits are viable and which techniques apply.

## OS version and architecture

**OS and system details**

```powershell
# Full system information
systeminfo

# Concise version
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Hotfix" /C:"Domain"

# PowerShell
[System.Environment]::OSVersion
$PSVersionTable

# Architecture
[System.Environment]::Is64BitOperatingSystem
[System.Environment]::Is64BitProcess
# OS Name:                   Microsoft Windows Server 2019 Datacenter
# OS Version:                10.0.17763 N/A Build 17763
# System Type:               x64-based PC
# Domain:                    corp.local
```

The build number is more reliable than the OS name for exploit matching. Build 17763 is Server 2019 / Windows 10 1809. Cross-reference with [Windows Kernel Exploits](https://hackindex.io/platforms/windows/privilege-escalation/windows-kernel-exploits) to find applicable CVEs.

## Installed patches and hotfixes

**Hotfix and patch enumeration**

```powershell
# List all installed hotfixes
wmic qfe list
Get-HotFix | Sort-Object InstalledOn -Descending

# Check for specific KB (e.g. KB for PrintNightmare patch)
Get-HotFix -Id KB5004945
wmic qfe | findstr KB5004945

# WES-ng input: save systeminfo output
systeminfo > C:\Windows\Temp\sysinfo.txt
# Then transfer and run on attack box:
# python3 wes.py sysinfo.txt
```

## Environment variables and paths

**Environment variables**

```powershell
# All environment variables
set
Get-ChildItem Env:

# Key variables
$env:PATH
$env:USERNAME
$env:USERDOMAIN
$env:COMPUTERNAME
$env:TEMP
$env:APPDATA
$env:PROGRAMFILES
$env:PROGRAMFILES(X86)

# Check for writable directories in PATH (DLL hijacking potential)
$env:PATH -split ';' | ForEach-Object { if (Test-Path $_) { $acl = Get-Acl $_; $acl.Access | Where-Object {$_.IdentityReference -match 'Users|Everyone|Authenticated' -and $_.FileSystemRights -match 'Write|FullControl'} | ForEach-Object {Write-Host "Writable PATH: $_"} } }
```

## Installed software

**Installed applications**

```powershell
# 64-bit applications
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallLocation | Sort-Object DisplayName

# 32-bit applications
Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallLocation | Sort-Object DisplayName

# Program Files directories
Get-ChildItem 'C:\Program Files', 'C:\Program Files (x86)' | Select-Object Name

# Check for interesting software
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName | findstr /i "VNC Kerberos Putty Git python ruby perl"
```

## Drives and file system

**Drives and shares**

```powershell
# Logical drives
Get-PSDrive -PSProvider FileSystem
wmic logicaldisk get caption,description,providername

# Local shares
net share
Get-SmbShare

# Writable directories (useful for dropping tools)
Get-ChildItem C:\ | ForEach-Object { try { [System.IO.File]::Create("$($_.FullName)\test.tmp").Close(); Remove-Item "$($_.FullName)\test.tmp"; Write-Host "Writable: $($_.FullName)" } catch {} }
```

## References

- [WES-ng: GitHub](https://github.com/bitsadmin/wesng) - Windows Exploit Suggester next generation: patch-level CVE matching