> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/windows/environment-variables.md).

# Environment Variables

Environment variables in Windows are dynamic values that affect the way processes and the system behave. They can be accessed using `%VARIABLENAME%` in Batch scripts or command-line utilities.

***

### **User Profile & Session Variables**

| Variable        | Description                                           | Example Path        |
| --------------- | ----------------------------------------------------- | ------------------- |
| `%USERNAME%`    | Current logged-in user's name                         | `john.doe`          |
| `%USERDOMAIN%`  | Domain of the current user (useful in enterprise)     | `MYCOMPANY`         |
| `%USERPROFILE%` | Path to the current user's profile directory          | `C:\Users\john.doe` |
| `%HOMEDRIVE%`   | Drive letter of the user's home directory             | `C:`                |
| `%HOMEPATH%`    | User-specific path component (without drive letter)   | `\Users\john.doe`   |
| `%LOGONSERVER%` | Name of the domain controller used for authentication | `\\DC01`            |

***

### **System and OS Variables**

| Variable       | Description                 | Example Path                  |
| -------------- | --------------------------- | ----------------------------- |
| `%SystemRoot%` | Windows system root folder  | `C:\Windows`                  |
| `%WINDIR%`     | Same as `%SystemRoot%`      | `C:\Windows`                  |
| `%COMSPEC%`    | Path to command interpreter | `C:\Windows\System32\cmd.exe` |
| `%OS%`         | Operating system name       | `Windows_NT`                  |

***

### **Program & Temp Paths**

| Variable               | Description                               | Example Path                           |
| ---------------------- | ----------------------------------------- | -------------------------------------- |
| `%ProgramFiles%`       | Default directory for 64-bit applications | `C:\Program Files`                     |
| `%ProgramFiles(x86)%`  | Default directory for 32-bit applications | `C:\Program Files (x86)`               |
| `%CommonProgramFiles%` | Shared files between applications         | `C:\Program Files\Common Files`        |
| `%TEMP%`               | Temporary files folder (user-scoped)      | `C:\Users\john.doe\AppData\Local\Temp` |
| `%TMP%`                | Alias of `%TEMP%`                         | Same as above                          |

***

### **Network and Computer Variables**

| Variable         | Description                                           | Example Value    |
| ---------------- | ----------------------------------------------------- | ---------------- |
| `%COMPUTERNAME%` | Name of the local computer                            | `DESKTOP-1234`   |
| `%DOMAINNAME%`   | Domain name (if part of a domain)                     | `mydomain.local` |
| `%HOSTNAME%`     | Usually same as `%COMPUTERNAME%`, used in some shells | `DESKTOP-1234`   |

***

### **Path and Execution Variables**

| Variable    | Description                                       | Example                                        |
| ----------- | ------------------------------------------------- | ---------------------------------------------- |
| `%PATH%`    | List of directories searched for executable files | `C:\Windows\System32;C:\Program Files\Git\bin` |
| `%PATHEXT%` | Recognized executable file extensions             | `.COM;.EXE;.BAT;.CMD;.VBS`                     |
| `%CD%`      | Current working directory in the command line     | `C:\Users\john.doe\Desktop`                    |

***

### **Special and Randomized Variables**

| Variable       | Description                                 | Example                     |
| -------------- | ------------------------------------------- | --------------------------- |
| `%RANDOM%`     | Returns a random number between 0 and 32767 | `13458`                     |
| `%ERRORLEVEL%` | Exit code of the last run command or script | `0` = success, `1+` = error |
| `%DATE%`       | Current system date                         | `Tue 04/15/2025`            |
| `%TIME%`       | Current system time                         | `14:35:12.42`               |

***

### **Environment Variable Utilities**

You can interact with these in various ways:

#### View All Variables

```cmd
set
```

#### View a Specific Variable

```cmd
echo %USERNAME%
```

#### Set a Temporary Variable (Session Only)

```cmd
set MYVAR=Test123
```

#### Set a System/User Variable (Permanent, via CMD)

```cmd
setx MYVAR "Test123"
```

* `setx` writes to the registry (permanent) but doesn't affect the current session.

### Reference

* <https://gist.github.com/RebeccaWhit3/5dad8627b8227142e1bea432db3f882>