net users

net localgroup

net user alex

net localgroup administrators

whoami /priv

systeminfo

Get-CimInstance -Class win32_quickfixengineering | Where-Object { $_.Description -eq "Security Update" } | format-table -wrap

wmic qfe get Description,HotFixID,InstalledOn | findstr /i "Security Update"

ipconfig /all

netstat -aon

Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname,installlocation | format-table -wrap

reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s | findstr /i "DisplayName InstallLocation"

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname,installlocation | format-table -wrap

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s | findstr /i "DisplayName InstallLocation"

reg query "HKCU\SOFTWARE"

reg query "HKCU\SOFTWARE"

Get-ItemProperty "HKLM:\SOFTWARE\*" | select displayname,installlocationclear

reg query "HKLM\SOFTWARE"

Get-Process

tasklist

Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'} | Format-Table -Wrap

Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'} | Format-Table -Wrap

sc query state= all

Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'} | Format-Table -Wrap

sc query state= inactive

Get-ScheduledTask | Select-Object TaskName, @{Name='ExecutablePath'; Expression={$_.Actions.Execute}}

schtasks /query /fo LIST /v

Get-History

(Get-PSReadlineOption).HistorySavePath

cmdkey /list

reg query HKLM /f password /t REG_SZ /s

for %k in (passw secret admin pwd) do reg query HKLM /f %k /t REG_SZ /s

foreach ($k in "passw","secret","admin","pwd") { reg query HKLM /f $k /t REG_SZ /s }

reg query HKCU /f password /t REG_SZ /s

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"

reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP"

reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"

findstr /si /m “password” *.xml *.ini *.conf *.txt,*.cnf,*config

Get-ChildItem -Path . -File -Recurse -ErrorAction SilentlyContinue

dir /s /b /a:-d 2>nul

Get-ChildItem -Path . -File -Recurse -ErrorAction SilentlyContinue -Hidden -Exclude desktop.ini,NTUSER.DAT*,Desktop.ini,ntuser.pol

dir /s /b /a:h-d 2>nul

Get-ChildItem -Path . -Include *.txt -File -Recurse -ErrorAction SilentlyContinue

dir /s /b /a:-d *.txt 2>nul

Get-ChildItem -Path . -Include *.config -File -Recurse -ErrorAction SilentlyContinue

dir /s /b /a:-d *.config 2>nul

Get-ChildItem -Path . -Include *.xls,*.xlsx,*.xlsm,*.xltx,*.xltm,*.doc,*.docx,*.docm,*.dotm,*.ppt,*.pptx,*.pptm,*.potx,*potm,*.accdb,*.pst,*.oft -File -Recurse -ErrorAction SilentlyContinue

(for %E in (xls xlsx xlsm xltx xltm doc docx docm dotm ppt pptx pptm potx potm accdb pst oft) do @dir /s /b /a:-d *.%E 2>nul)

Get-ChildItem -Path . -Include *.pdf -File -Recurse -ErrorAction SilentlyContinue

dir /s /b /a:-d *.pdf 2>nul

Get-ChildItem -Path . -Include *.xml -File -Recurse -ErrorAction SilentlyContinue

dir /s /b /a:-d *.xml 2>nul

Get-ChildItem -Path . -Include *.ini,*.init -File -Recurse -ErrorAction SilentlyContinue

(for %E in (ini init) do @dir /s /b /a:-d *.%E 2>nul)

Get-ChildItem -Path . -Include *.c,*.cpp,*.cc,*.cxx,*.h,*.hpp,*.hh,*.hxx,*.ino,*.cs,*.java,*.py,*.pyw,*.pyi,*.pyx,*.pxd,*.js,*.mjs,*.cjs,*.ts,*.tsx,*.php,*.phtml,*.php3,*.php4,*.php5,*.phps,*.rb,*.erb,*.pl,*.pm,*.t,*.pod,*.go,*.rs,*.swift,*.kt,*.kts,*.scala,*.sc,*.r,*.R,*.Rmd,*.jl,*.d,*.m,*.mm,*.f,*.for,*.f90,*.f95,*.pas,*.pp,*.dpr,*.adb,*.ads,*.asm,*.s,*.a51,*.html,*.htm,*.xhtml,*.css,*.scss,*.sass,*.less,*.ejs,*.mustache,*.hbs,*.twig,*.jinja,*.njk,*.md,*.markdown,*.rst,*.adoc,*.bat,*.cmd,*.ps1,*.psm1,*.psd1,*.sh,*.bash,*.zsh,*.vbs,*.vba,*.wsf,*.wsc,*.m,*.hs,*.lhs,*.erl,*.hrl,*.ex,*.exs,*.ml,*.mli,*.lisp,*.cl,*.el,*.scm,*.rkt,*.clj,*.cljs,*.cljc,*.edn,*.pro,*.cbl,*.cob,*.cpy,*.fs,*.fsi,*.fsx,*.m,*.prolog,*.sql,*.psql,*.dbml,*.json,*.json5,*.yaml,*.yml,*.toml,*.ini,*.cfg,*.conf,*.env,*.properties,*.cmake,*.mak,*.gradle -File -Recurse -ErrorAction SilentlyContinue

(for %E in (c cpp cc cxx h hpp hh hxx ino cs java py pyw pyi pyx pxd js mjs cjs ts tsx php phtml php3 php4 php5 phps rb erb pl pm t pod go rs swift kt kts scala sc r R Rmd jl d m mm f for f90 f95 pas pp dpr adb ads asm s a51 html htm xhtml css scss sass less ejs mustache hbs twig jinja njk md markdown rst adoc bat cmd ps1 psm1 psd1 sh bash zsh vbs vba wsf wsc m hs lhs erl hrl ex exs ml mli lisp cl el scm rkt clj cljs cljc edn pro cbl cob cpy fs fsi fsx m prolog sql psql dbml json json5 yaml yml toml ini cfg conf env properties cmake mak gradle) do @dir /s /b /a:-d *.%E 2>nul)