# Windows Local Situational Awareness

> Enumerate local Windows system info, users, groups, privileges, network config, and running processes to build situational awareness post-compromise.

- **URL:** https://hackindex.io/platforms/windows/post-exploitation/windows-local-situational-awareness
- **Path:** Windows > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/platforms/windows/post-exploitation.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

Before hunting credentials or moving laterally, orient yourself on the target. Key areas to check first:

- Current user context and token privileges
- OS version, patch level, and architecture
- Local users, groups, and active sessions
- Running processes (especially security tools)
- Installed software and scheduled tasks

These details determine which techniques apply and what detection risk exists.

## Current user and privileges

The first thing to establish is who you are and what token privileges are enabled. Dangerous privileges like `SeImpersonatePrivilege`, `SeBackupPrivilege`, and `SeDebugPrivilege` open direct escalation paths even before running any enumeration tool.

**Identity and privileges**

```powershell
# Current user and domain
whoami
whoami /all
whoami /priv

# Check for dangerous privileges
whoami /priv | findstr /i "SeImpersonate SeBackup SeRestore SeDebug SeTakeOwnership SeAssignPrimaryToken"
# Privilege Name                Description                               State
# ============================= ========================================= ========
# SeImpersonatePrivilege        Impersonate a client after authentication Enabled
```

If `SeImpersonatePrivilege` is enabled, go directly to [Token Impersonation](https://hackindex.io/platforms/windows/privilege-escalation/token-impersonation-seimpersonateprivilege-exploitation): it gives you SYSTEM in one step. `SeBackupPrivilege` means you can read any file regardless of ACLs, including the SAM hive. See [SeBackupPrivilege Abuse](https://hackindex.io/platforms/windows/privilege-escalation/sebackupprivilege-abuse).

## System information

**OS and system details**

```powershell
# OS version, hostname, domain
systeminfo

# Concise version
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Domain"

# Hostname
hostname

# Environment variables (reveals paths, username, temp dirs)
set
$env:USERNAME
$env:COMPUTERNAME
$env:USERDOMAIN
$env:PATH
```

The OS version from `systeminfo` is the starting point for kernel exploit matching. Take note of the exact build number and cross-reference with [Windows Kernel Exploits](https://hackindex.io/platforms/windows/privilege-escalation/windows-kernel-exploits). The domain membership tells you whether AD lateral movement techniques are relevant.

## Local users, groups, and sessions

**Users, groups, and sessions**

```powershell
# Local users
net user
Get-LocalUser

# Local groups
net localgroup
Get-LocalGroup

# Members of local Administrators group
net localgroup administrators
Get-LocalGroupMember -Group "Administrators"

# Currently logged on users (interactive sessions)
query user
qwinsta

# Active sessions including non-interactive
$sessions = query session; $sessions
```

Active sessions from `query user` tell you which accounts currently have interactive sessions. Other logged-in users mean credentials may be in LSASS memory. If you have SYSTEM, you can dump LSASS and recover those credentials. See [Windows Password Attacks](https://hackindex.io/platforms/windows/privilege-escalation/windows-password-attacks).

## Running processes

**Process enumeration**

```powershell
# All running processes with owner
Get-Process
tasklist /v

# Processes with service name
tasklist /svc

# Check for AV and EDR processes
tasklist | findstr /i "defender norton crowdstrike sentinel cylance carbon cbdefense tanium"

# PowerShell: processes with path and owner
Get-Process | Select-Object Name, Id, Path, StartTime | Sort-Object Name
```

Identify AV and EDR processes before doing anything noisy. Common ones: `MsMpEng.exe` (Windows Defender), `CrowdStrike`, `SentinelOne`, `cbdefense` (Carbon Black). Knowing what is running shapes how you proceed with credential dumping and lateral movement.

## Installed software and patches

**Installed applications and hotfixes**

```powershell
# Installed software via registry (most complete)
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher
Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher

# Installed hotfixes
wmic qfe list
Get-HotFix | Sort-Object InstalledOn -Descending

# 32-bit and 64-bit program files
dir 'C:\Program Files'
dir 'C:\Program Files (x86)'
```

## Scheduled tasks and startup items

**Scheduled tasks**

```powershell
# All scheduled tasks with details
schtasks /query /fo LIST /v

# PowerShell: filter for tasks not owned by Microsoft/System
Get-ScheduledTask | Where-Object {$_.TaskPath -notlike "\Microsoft*"} | Select-Object TaskName, TaskPath, State

# Check a specific task's action
(Get-ScheduledTask -TaskName "TaskName").Actions

# Startup programs
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
```

Tasks not in the `\Microsoft\` path are custom and worth inspecting. Check the script or binary being executed: if it is writable by your current user, you have a privilege escalation path. See [Scheduled Task Abuse](https://hackindex.io/platforms/windows/privilege-escalation/scheduled-task-abuse).

For credential collection from the found paths continue to [Windows Token and Credential Harvesting](https://hackindex.io/platforms/windows/post-exploitation/windows-token-and-credential-harvesting).