> ## Documentation Index
> Fetch the complete documentation index at: https://hackbook.dudji.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Windows Enumeration Checklist

> Step-by-step checklist for every Windows box — from initial shell to full pillage.

<Note>
  **Phase 1** covers what to do the moment you get a shell. **Phase 2** covers
  what to do once you have admin or SYSTEM.
</Note>

<Tabs>
  <Tab title="Phase 1 — Enumeration">
    <AccordionGroup>
      <Accordion title="Identity" icon="user" defaultOpen>
        <label className="cl-item"><input type="checkbox" /><span>Who am I? → <a href="/tech/windows/system-enumeration">System Enumeration</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>What privileges do I have, and do any lead to escalation (SeImpersonate, SeBackup, SeDebug)? → <a href="/tech/windows/system-enumeration">System Enumeration</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>What groups am I in, and are any of them privileged? → <a href="/tech/windows/system-enumeration">System Enumeration</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>What is my SID, and what does the RID tell me about my account? → <a href="/tech/windows/system-enumeration">System Enumeration</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>What is my integrity level — am I Medium or High? → <a href="/tech/windows/security-mechanisms">Security Mechanisms</a></span></label>
      </Accordion>

      <Accordion title="The Machine" icon="computer">
        <label className="cl-item"><input type="checkbox" /><span>What OS version and build number is this? → <a href="/tech/windows/system-enumeration">System Enumeration</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>What patches are installed, and which are missing? → <a href="/tech/windows/system-enumeration">System Enumeration</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>What scheduled tasks run as Administrator or SYSTEM? → <a href="/tech/windows/system-enumeration">System Enumeration</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Are any of those scheduled-task scripts writable by me? → <a href="/tech/windows/permissions-icacls">NTFS Permissions & icacls</a></span></label>
      </Accordion>

      <Accordion title="File System" icon="folder-open">
        <label className="cl-item"><input type="checkbox" /><span>Where can I write — ProgramData, Public, AppData? → <a href="/tech/windows/architecture-filesystem">Architecture & File System</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Are there interesting files I can find by name or extension? → <a href="/tech/windows/architecture-filesystem">Architecture & File System</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>What shell am I in, and can I upgrade to PowerShell? → <a href="/tech/windows/command-line">CMD, PowerShell & WMI</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>What is the PowerShell execution policy, and can I bypass it? → <a href="/tech/windows/command-line">CMD, PowerShell & WMI</a></span></label>
      </Accordion>

      <Accordion title="Processes & Services" icon="gear">
        <label className="cl-item"><input type="checkbox" /><span>What processes are running, and who owns them? → <a href="/tech/windows/processes-services">Processes & Services</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Are any processes passing credentials as command-line arguments? → <a href="/tech/windows/processes-services">Processes & Services</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>What services are running, and what accounts do they run as? → <a href="/tech/windows/processes-services">Processes & Services</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Can I change any service's configuration (weak service permissions)? → <a href="/tech/windows/processes-services">Processes & Services</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Can I overwrite any service binary? → <a href="/tech/windows/processes-services">Processes & Services</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Are there any unquoted service paths I can hijack? → <a href="/tech/windows/processes-services">Processes & Services</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Can I write to any service's registry key? → <a href="/tech/windows/processes-services">Processes & Services</a></span></label>
      </Accordion>

      <Accordion title="Network & Remote Access" icon="network-wired">
        <label className="cl-item"><input type="checkbox" /><span>What is the network configuration and what ports are listening? → <a href="/tech/windows/command-line">CMD, PowerShell & WMI</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Is RDP or WinRM available, and am I in the group that can use it? → <a href="/tech/windows/remote-access">Remote Access & Sessions</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>What SMB shares exist, and what can I read or write? → <a href="/tech/windows/smb-shares">SMB & Network Shares</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Is anonymous/null session access allowed on any share? → <a href="/tech/windows/smb-shares">SMB & Network Shares</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Is the host vulnerable to a known SMB exploit (EternalBlue)? → <a href="/tech/windows/smb-shares">SMB & Network Shares</a></span></label>
      </Accordion>

      <Accordion title="Registry & Autostart" icon="registered">
        <label className="cl-item"><input type="checkbox" /><span>What autostart entries exist in the Run and RunOnce keys? → <a href="/tech/windows/registry">The Windows Registry</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Do any autostart entries point to a path I can write to? → <a href="/tech/windows/registry">The Windows Registry</a></span></label>
      </Accordion>

      <Accordion title="Security Mechanisms" icon="shield-halved">
        <label className="cl-item"><input type="checkbox" /><span>Is Windows Defender running, and are there any exclusion paths? → <a href="/tech/windows/security-mechanisms">Security Mechanisms</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Is AppLocker enforced, and are there writable trusted paths to bypass it? → <a href="/tech/windows/security-mechanisms">Security Mechanisms</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>What does Group Policy enforce on this machine? → <a href="/tech/windows/security-mechanisms">Security Mechanisms</a></span></label>
      </Accordion>
    </AccordionGroup>
  </Tab>

  <Tab title="Phase 2 — Pillaging">
    <AccordionGroup>
      <Accordion title="Automated First" icon="robot" defaultOpen>
        <label className="cl-item"><input type="checkbox" /><span>What does winPEAS (or PowerUp / Seatbelt) flag as a privesc path? → <a href="/tech/windows/pillaging">Windows Pillaging</a></span></label>
      </Accordion>

      <Accordion title="Credentials" icon="key">
        <label className="cl-item"><input type="checkbox" /><span>Are there any sensitive files by name (password, secret, .kdbx)? → <a href="/tech/windows/pillaging">Windows Pillaging</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Do any config, xml, or ini files contain credentials or connection strings? → <a href="/tech/windows/pillaging">Windows Pillaging</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Is there an unattended install file with a plaintext password? → <a href="/tech/windows/pillaging">Windows Pillaging</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>What is in the PowerShell command history? → <a href="/tech/windows/pillaging">Windows Pillaging</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Are there stored credentials in cmdkey I can use with runas? → <a href="/tech/windows/pillaging">Windows Pillaging</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Are there Group Policy Preferences (cpassword) credentials in SYSVOL? → <a href="/tech/windows/security-mechanisms">Security Mechanisms</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Are there credentials stored in the registry (autologon, VNC, PuTTY, SNMP)? → <a href="/tech/windows/registry">The Windows Registry</a></span></label>
      </Accordion>

      <Accordion title="Hashes & Memory" icon="memory">
        <label className="cl-item"><input type="checkbox" /><span>Can I save the SAM, SYSTEM, and SECURITY hives to dump local hashes? → <a href="/tech/windows/registry">The Windows Registry</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Can I dump LSASS to extract live credentials from memory? → <a href="/tech/windows/processes-services">Processes & Services</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Has an administrator logged in interactively (RDP), leaving credentials in LSASS? → <a href="/tech/windows/remote-access">Remote Access & Sessions</a></span></label>
      </Accordion>

      <Accordion title="Data & Impact" icon="file-shield">
        <label className="cl-item"><input type="checkbox" /><span>Is there sensitive business data or PII I can demonstrate access to? → <a href="/tech/windows/pillaging">Windows Pillaging</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Have I confirmed the contents and scope of the data before reporting it? → <a href="/tech/windows/pillaging">Windows Pillaging</a></span></label>
      </Accordion>

      <Accordion title="Lateral Movement" icon="arrow-right-arrow-left">
        <label className="cl-item"><input type="checkbox" /><span>Do any found credentials work on other hosts (password reuse)? → <a href="/tech/windows/remote-access">Remote Access & Sessions</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Can I use a recovered hash for pass-the-hash to another host? → <a href="/tech/windows/remote-access">Remote Access & Sessions</a></span></label>
        <label className="cl-item"><input type="checkbox" /><span>Are there writable SMB shares I can use to spread a payload? → <a href="/tech/windows/smb-shares">SMB & Network Shares</a></span></label>
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>