# Windows

| Domain                                    | Comment                          |
| ----------------------------------------- | -------------------------------- |
| net view                                  | list computers on domain         |
| net view \\\\\<target name>               | list shares on host              |
| net view /domain                          | list domains                     |
| net view /domain:\<domain name>           | list computers on a named domain |
| net users \<username> \<password> /add    | add user                         |
| net localgroup Administrators \<username> | add to administrators group      |
| nltest /dclist:\<domain name>             | Domain Controllers list          |

### **User details:**&#x20;

`Whoami`&#x20;

`hostname`&#x20;

`Echo %username%`&#x20;

`Net users`&#x20;

`Net user USERNAME`&#x20;

### **Get Windows User and Domain Information**&#x20;

`set`&#x20;

`whoami /all`&#x20;

`Get-ADTrust`

### **Information on current domain:**

Domain information:

`[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()`

Domain Trusts:

`([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()`

Current forest info:

`[System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()`

Trust relationship:

`([System.DirectoryServices.ActiveDirectory.Forest]::GetForest((New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', 'forest-of-interest.local')))).GetAllTrustRelationships()`

**Get current privileges:**&#x20;

`whoami /priv`&#x20;

**Show routes:**&#x20;

`route print`&#x20;

**Enumerate local administrators**&#x20;

`net localgroup administrators`&#x20;

**Check for missing patches:**&#x20;

`wmic qfe get Caption,Description, HotFixID,InstalledOn`&#x20;

**get DCs of a domain**&#x20;

`net group "domain controllers" /domain`&#x20;

**Launch a cmd prompt as another user:**&#x20;

`runas /netonly /user:[Domain]\[username] cmd.exe`&#x20;

**Get windows version:**&#x20;

`ver`&#x20;

**Systeminfo:**&#x20;

`systeminfofindstr/B /C:"OS Name" /C:"OS Version`&#x20;

**View password policy:**&#x20;

`net accounts`&#x20;

On DC:

`Get-ADDefaultDomainPasswordPolicy`&#x20;

**List Drives:**

`gdr -PSProvider 'FileSystem'`

Or

`[System.IO.DriveInfo]::GetDrives() | Format-Table`