Basics

dir env:
for %%G in (*.txt *.pdf *.xls *.xlsx *.doc *.docx *.exe) do (dir "C:\Users\%%G" /s /b /a-d 2>nul)
for %G in (*.txt *.pdf *.xls *.xlsx *.doc *.docx *.exe) do (dir "C:\Users\%G" /s /b /a-d 2>nul)


Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\Users\\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx,*.exe -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path 'C:\' | Select-String -Pattern "Password = "

Get-Acl  file.txt

set \#variables
echo %PATH%

\#Permissions
whoami
whoami /groups \#groups for a user
whoami /priv \#priviledges for a user

icacls filename \#permission for a file

\#account with sids
wmic useraccount get domain,name,sid

\#set file permissions
icacls test.txt /grant hostname\username:R /t /c
	/t - recursively
	/c - to keep going, skip errors

users & groups

#check for dangerous privileges (SeImpersonatePrivilege,SeBackupPrivilege)

whoami /groups
whoami /priv
net user
net user username
netaccounts \#accounts policy


Get-LocalUser
Get-LocalGroup
Get-LocalGroupMember groupname

Installed apps and services

Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname


systeminfo
wmic qfe get Caption,Description,HotFixID,InstalledOn \#hotfixes list
driverquery /v /fo list

ipconfig /all
route print
netstat -ano

Get-Process