Skip to content
HackIndex logo

HackIndex

Windows Local Situational Awareness

3 min read Jul 14, 2026

Before hunting credentials or moving laterally, orient yourself on the target. Knowing the OS version, current user context, active sessions, running processes, and network position determines which techniques apply and what detection risk exists.

Current user and privileges

The first thing to establish is who you are and what token privileges are enabled. Dangerous privileges like SeImpersonatePrivilege, SeBackupPrivilege, and SeDebugPrivilege open direct escalation paths even before running any enumeration tool.

PS C:\Users\Guest\Desktop> # Current user and domain
PS C:\Users\Guest\Desktop> whoami
PS C:\Users\Guest\Desktop> whoami /all
PS C:\Users\Guest\Desktop> whoami /priv
 
PS C:\Users\Guest\Desktop> # Check for dangerous privileges
PS C:\Users\Guest\Desktop> whoami /priv | findstr /i "SeImpersonate SeBackup SeRestore SeDebug SeTakeOwnership SeAssignPrimaryToken" 
Privilege Name                Description                               State
============================= ========================================= ========
SeImpersonatePrivilege        Impersonate a client after authentication Enabled

If SeImpersonatePrivilege is enabled, go directly to Token Impersonation — it gives you SYSTEM in one step. SeBackupPrivilege means you can read any file regardless of ACLs, including the SAM hive. See SeBackupPrivilege Abuse.

System information

PS C:\Users\Guest\Desktop> # OS version, hostname, domain
PS C:\Users\Guest\Desktop> systeminfo
 
PS C:\Users\Guest\Desktop> # Concise version
PS C:\Users\Guest\Desktop> systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Domain"
 
PS C:\Users\Guest\Desktop> # Hostname
PS C:\Users\Guest\Desktop> hostname
 
PS C:\Users\Guest\Desktop> # Environment variables (reveals paths, username, temp dirs)
PS C:\Users\Guest\Desktop> set
PS C:\Users\Guest\Desktop> $env:USERNAME
PS C:\Users\Guest\Desktop> $env:COMPUTERNAME
PS C:\Users\Guest\Desktop> $env:USERDOMAIN
PS C:\Users\Guest\Desktop> $env:PATH

The OS version from systeminfo is the starting point for kernel exploit matching. Take note of the exact build number and cross-reference with Windows Kernel Exploits. The domain membership tells you whether AD lateral movement techniques are relevant.

Local users, groups, and sessions

PS C:\Users\Guest\Desktop> # Local users
PS C:\Users\Guest\Desktop> net user
PS C:\Users\Guest\Desktop> Get-LocalUser
 
PS C:\Users\Guest\Desktop> # Local groups
PS C:\Users\Guest\Desktop> net localgroup
PS C:\Users\Guest\Desktop> Get-LocalGroup
 
PS C:\Users\Guest\Desktop> # Members of local Administrators group
PS C:\Users\Guest\Desktop> net localgroup administrators
PS C:\Users\Guest\Desktop> Get-LocalGroupMember -Group "Administrators"
 
PS C:\Users\Guest\Desktop> # Currently logged on users (interactive sessions)
PS C:\Users\Guest\Desktop> query user
PS C:\Users\Guest\Desktop> qwinsta
 
PS C:\Users\Guest\Desktop> # Active sessions including non-interactive
PS C:\Users\Guest\Desktop> $sessions = query session; $sessions

Active sessions from query user tell you which accounts currently have interactive sessions. Other logged-in users mean credentials may be in LSASS memory. If you have SYSTEM, you can dump LSASS and recover those credentials. See Windows Password Attacks.

Running processes

PS C:\Users\Guest\Desktop> # All running processes with owner
PS C:\Users\Guest\Desktop> Get-Process
PS C:\Users\Guest\Desktop> tasklist /v
 
PS C:\Users\Guest\Desktop> # Processes with service name
PS C:\Users\Guest\Desktop> tasklist /svc
 
PS C:\Users\Guest\Desktop> # Check for AV and EDR processes
PS C:\Users\Guest\Desktop> tasklist | findstr /i "defender norton crowdstrike sentinel cylance carbon cbdefense tanium"
 
PS C:\Users\Guest\Desktop> # PowerShell — processes with path and owner
PS C:\Users\Guest\Desktop> Get-Process | Select-Object Name, Id, Path, StartTime | Sort-Object Name

Identify AV and EDR processes before doing anything noisy. Common ones: MsMpEng.exe (Windows Defender), CrowdStrike, SentinelOne, cbdefense (Carbon Black). Knowing what is running shapes how you proceed with credential dumping and lateral movement.

Installed software and patches

PS C:\Users\Guest\Desktop> # Installed software via registry (most complete)
PS C:\Users\Guest\Desktop> Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher
PS C:\Users\Guest\Desktop> Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher
 
PS C:\Users\Guest\Desktop> # Installed hotfixes
PS C:\Users\Guest\Desktop> wmic qfe list
PS C:\Users\Guest\Desktop> Get-HotFix | Sort-Object InstalledOn -Descending
 
PS C:\Users\Guest\Desktop> # 32-bit and 64-bit program files
PS C:\Users\Guest\Desktop> dir 'C:\Program Files'
PS C:\Users\Guest\Desktop> dir 'C:\Program Files (x86)'

Scheduled tasks and startup items

PS C:\Users\Guest\Desktop> # All scheduled tasks with details
PS C:\Users\Guest\Desktop> schtasks /query /fo LIST /v
 
PS C:\Users\Guest\Desktop> # PowerShell — filter for tasks not owned by Microsoft/System
PS C:\Users\Guest\Desktop> Get-ScheduledTask | Where-Object {$_.TaskPath -notlike "\Microsoft*"} | Select-Object TaskName, TaskPath, State
 
PS C:\Users\Guest\Desktop> # Check a specific task's action
PS C:\Users\Guest\Desktop> (Get-ScheduledTask -TaskName "TaskName").Actions
 
PS C:\Users\Guest\Desktop> # Startup programs
PS C:\Users\Guest\Desktop> reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
PS C:\Users\Guest\Desktop> reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Tasks not in the \Microsoft\ path are custom and worth inspecting. Check the script or binary being executed — if it is writable by your current user, you have a privilege escalation path. See Scheduled Task Abuse.

For credential collection from the found paths continue to Windows Token and Credential Harvesting.