Windows Fundamentals

Windows dominates the corporate desktop and, with Active Directory, the identity infrastructure of almost every company. Understanding how it manages users, permissions, the registry, processes, and authentication is the basis for the whole Windows & AD area: you can’t escalate privileges or move laterally without understanding how the system thinks.

Users, groups, and SIDs

Windows identifies each principal (user, group, computer) by a SID (Security Identifier), not by its name:

S-1-5-21-<domain>-500   Administrator (RID 500, always)
S-1-5-21-<domain>-501   Guest
S-1-5-32-544            Administrators group (local)
S-1-5-18                SYSTEM
RID 512 = Domain Admins, 519 = Enterprise Admins (in a domain)

Key local groups: Administrators, Users, Remote Desktop Users, Backup Operators. In a domain: Domain Admins, Enterprise Admins (see Active Directory Fundamentals).

Integrity levels and UAC

A process runs with an integrity level: Low, Medium, High, System. An admin, due to UAC, runs by default at medium integrity; elevating to high requires the UAC prompt (or a bypass). SYSTEM is the equivalent of root. Understanding this is the basis of local escalation (see Windows Privilege Escalation, UAC Bypass).

The registry

Hierarchical database of system and app configuration. Main hives:

HKLM  HKEY_LOCAL_MACHINE   machine config (SAM, SYSTEM, SOFTWARE)
HKCU  HKEY_CURRENT_USER    current-user config
HKLM\SAM          local account hashes
Run keys:  HKLM\...\CurrentVersion\Run  (autostart -> persistence)

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
reg add / reg save / reg delete

The registry holds credentials, autoruns (persistence), and keys that enable UAC bypasses.

Processes, services, and tasks

tasklist /v              # processes and the user running them
sc query ; sc qc <svc>   # services (many run as SYSTEM)
schtasks /query /fo LIST /v   # scheduled tasks
wmic process list        # via WMI

Misconfigured services and tasks running as SYSTEM are classic privesc vectors.

Authentication: NTLM and Kerberos

• NTLM — legacy challenge-response; its hash (NT hash) enables Pass-the-Hash.
• Kerberos — the modern one in AD: tickets (TGT/TGS) issued by the DC. Basis of Kerberoasting, PtT, Golden Ticket.
• LSASS — the process that holds credentials in memory (a dumping target, see Credential Dumping).

CMD vs PowerShell

• cmd.exe — the classic interpreter, short commands (dir, whoami, net).
• PowerShell — powerful, object-oriented, scripting and remote administration; also the attacker’s favorite language on Windows (see PowerShell for Hacking). Key natives: net user, net localgroup, whoami /all, systeminfo.

Why it matters in security

All local escalation (tokens, UAC, services), credential dumping (LSASS, SAM), authentication (NTLM/Kerberos), and persistence (registry, tasks) rest on these concepts. Windows & AD is probably the biggest surface in an internal pentest; this is its alphabet.

Mastery checklist

• I understand what a SID is and recognize key RIDs (500, 512, 519)
• I can explain integrity levels and UAC’s role
• I navigate the registry (HKLM/HKCU) and know which hives hold secrets/autoruns
• I inspect processes, services, and scheduled tasks
• I distinguish NTLM from Kerberos and know what LSASS is
• I can use cmd and PowerShell for basic enumeration
• I know the privileged local and domain groups

References

• HackTricks — Windows local privilege escalation
• Microsoft Learn — Active directory domain services overview
• LOLBAS — abusable living-off-the-land Windows binaries
• ss64.com — Nt