Enumeration Checklist

whoami
whoami /priv
whoami /groups
echo %USERNAME%
hostname

systeminfo
ver
wmic os get Caption,Version,BuildNumber,OSArchitecture

net user
net user %USERNAME%
net localgroup
net localgroup administrators

ipconfig /all
route print
arp -a
netstat -ano

tasklist /v

sc query
wmic service get name,displayname,pathname,startmode

schtasks /query /fo LIST /v

wmic logicaldisk get name

wmic qfe

whoami
whoami /priv
whoami /groups
$env:USERNAME
$env:COMPUTERNAME

Get-ComputerInfo
Get-CimInstance Win32_OperatingSystem | select Caption,Version,BuildNumber,OSArchitecture
Get-ChildItem Env:

Get-LocalUser
Get-LocalGroup
Get-LocalGroupMember "Administrators"

Get-NetIPAddress
Get-NetRoute
Get-NetTCPConnection

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | select DisplayName,DisplayVersion,Publisher

Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select DisplayName,DisplayVersion,Publisher

Get-Process

Get-Service
Get-CimInstance Win32_Service | select Name,DisplayName,PathName,StartMode

Get-ScheduledTask

Get-PSDrive -PSProvider FileSystem

Get-HotFix

Get-MpComputerStatus

# Search documents (possible credentials)
Get-ChildItem -Path C:\Users\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue

# PowerShell command history (very important!)
(Get-PSReadlineOption).HistorySavePath

# Search for documents containing "pass" string (CMD)
findstr /SIM /C:"pass" *.ini *.cfg *.xml