🪟Windows

Get-WmiObject cmdlet

PS C:PS C:\Users\user>  Get-WmiObject -Class win32_OperatingSystem | select Version,BuildNumber  

Version    BuildNumber                                                                                                  
-------    -----------                                                                                                  
10.0.19044 19044   

References:

• https://ss64.com/ps/get-wmiobject.html

• https://adamtheautomator.com/get-wmiobject/

Integrity Control Access Control List (icacls)

• icacls c:\windows

C:\Users\user>icacls c:\windows                                                                                        
c:\windows NT SERVICE\TrustedInstaller:(F)                                                                                         
           NT SERVICE\TrustedInstaller:(CI)(IO)(F)                                                                                 
           NT AUTHORITY\SYSTEM:(M)                                                                                                 
           NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)                                                                                     
           BUILTIN\Administrators:(M)                                                                                              
           BUILTIN\Administrators:(OI)(CI)(IO)(F)                                                                                  
           BUILTIN\Users:(RX)                                                                                                      
           BUILTIN\Users:(OI)(CI)(IO)(GR,GE)                                                                                       
           CREATOR OWNER:(OI)(CI)(IO)(F)                                                                                           
           APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)                                                             
           APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)                                              
           APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APP PACKAGES:(RX)                                                          
           APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APP PACKAGES:(OI)(CI)(IO)(GR,GE)                                                                                                                                                        
           
Successfully processed 1 files; Failed processing 0 files    

Granting and removing user's permission

• icacls c:\users /grant joe:f

• icacls c:\users /remove joe

References:

• https://ss64.com/nt/icacls.html

Windows Services and Processes

Reference:

• https://en.wikipedia.org/wiki/List_of_Microsoft_Windows_components#Services

Sysinternals Tools

• https://docs.microsoft.com/en-us/sysinternals

Service Permissions

• https://us-cert.cisa.gov/bsi/articles/knowledge/principles/least-privilege