> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/windows/user-enumeration.md).

# User Enumeration

Identifying **which users exist**, **who is logged in**, and **which users have elevated rights** can help identify paths to escalate their privileges. 

#### **Current User Info**

```cmd
whoami
```

```cmd
whoami /priv
```

```cmd
whoami /groups
```

#### **List All Users**

```cmd
net users
```

#### **List Users in Admin Group**

```cmd
net localgroup administrators
```

#### **List Logged-in or Active Users**

```cmd
query user
```

```powershell
Get-WmiObject -Class Win32_ComputerSystem | Select-Object UserName
```

#### **Check for User Sessions (RDP/Console)**

```cmd
qwinsta
```

#### **Environment Variables (May reveal usernames)**

```cmd
set
echo %USERNAME%
echo %USERDOMAIN%
```