WINDOWS. Host. Performance report

 Purpose

Use a command to get a detailed performance report for a host

Steps

Command: perfmon /report

Command: Some screenshots:

By GoN | Published: Mar 2025 | Last Updated:

WINDOWS. AD. OSINT. Locate privileged users

Purpose

Locate and discover privileged user in Active Directory. Locate privileged users in the AD, either by direct association or by nesting to a group with special privileges.

Steps

[*] AD users have a property that is set to one if you have direct nested privileges in any AD group.

COMMAND: Get-ADUser administrador -properties *

[*] List All users

Command: Get-ADUser -Filter {AdminCount -eq 1} - | Select-Object Name, SamAccountName

[*]  View user information

We already have a way to attack a network and try to make lateral movement.

By GoN | Published: Feb 2025 | Last Updated:

WINDOWS. PS. Users list

 Purpose

List AD users with the most important properties and then work with them in Excel.

Steps

Run te script: 

# Importar el módulo de Active Directory

Import-Module ActiveDirectory

 # Obtener todos los usuarios y seleccionar los campos deseados

Get-ADUser -Filter * -Property SamAccountName, DisplayName, CN, Enabled, LockedOut, AccountExpirationDate, EmailAddress, WhenCreated, LastLogonDate, PasswordLastSet, LogonWorkstations, PasswordNeverExpires, PasswordNotRequired, DistinguishedName, Description 

Select-Object SamAccountName,

              DisplayName,

              CN,

              Enabled,

              LockedOut,

              AccountExpirationDate,

              EmailAddress,

              WhenCreated,

              LastLogonDate,

              PasswordLastSet,

              LogonWorkstations,

              @{Name="La cuenta expira";Expression={$_.AccountExpirationDate}},

              @{Name="la contraseña nunca expira";Expression={$_.PasswordNeverExpires}},

              @{Name="no requiere contraseña";Expression={$_.PasswordNotRequired}},

              DistinguishedName,

              Description |

Export-Csv -Path "C:\tmp\Usuarios30012025.csv" -NoTypeInformation -Encoding UTF8 -Delimiter "#"

We will be left with an output like this 

By GoN | Published: Jan 2025 | Last Updated: