Windows:

Enumeration

Guides covering Windows and AD enumeration for privesc and pivoting

6 guides • Created Apr 4, 2026 • Updated Apr 4, 2026

6 guides

Active Directory Enumeration

Techniques for enumerating AD objects, users, groups, GPOs, trusts, and misconfigurations using tools like BloodHound, ldapsearch, and PowerView.

Apr 4, 2026 • 3 min read

Windows Antivirus and EDR Enumeration

Techniques for identifying installed AV and EDR solutions on Windows systems, including registry queries, process enumeration, and WMI-based detection methods.

Apr 4, 2026 • 4 min read

Windows Network Enumeration

Covers active Windows network enumeration techniques including host discovery, share mapping, SMB reconnaissance, and user/group extraction via native and third-party tools.

Apr 4, 2026 • 2 min read

Windows Service and Process Enumeration

Enumerate Windows services and processes to identify running applications, privileges, and potential attack vectors using native tools and commands.

Apr 4, 2026 • 6 min read

Windows System Enumeration

Covers techniques for enumerating Windows systems, including users, groups, privileges, network config, running processes, and installed software to identify attack paths.

Apr 4, 2026 • 3 min read

Windows User and Group Enumeration

Techniques for enumerating local and domain users, groups, and memberships on Windows systems using built-in tools and commands.

Apr 4, 2026 • 3 min read

Windows enumeration is about understanding exactly what you have landed on. Local users and groups, network shares, running services, scheduled tasks, installed software, firewall rules, and antivirus products all shape what you can do next. Commands like net user, net localgroup, tasklist, sc query, and schtasks give you the baseline.

PowerShell makes deep enumeration practical. Get-Process, Get-Service, Get-NetFirewallRule, and WMI queries pull detailed system state. Tools like winPEAS, Seatbelt, and SharpUp automate the collection and flag common escalation paths, weak permissions, and misconfigurations in a single pass.

Network enumeration from the host (arp -a, netstat, route print, DNS cache) reveals the internal landscape and adjacent systems. Start here to map the local attack surface before moving into privilege escalation or lateral movement.