Chapter 8: Scanning Windows Systems

Windows-based networks are still the most common type of network found in organizations, mainly because of the Active Directory (AD) technology that helps system administrators simplify many of their daily tasks. While Windows systems have come a long way regarding security, there are still a few default configurations that we can deem as insecure. Not only default configurations, but some undesirable functionality is also there, such as obtaining system information through SMBv1 pre-authentication.

For this reason, scanning Windows machines is a common task for penetration testers and system administrators, and thankfully, Nmap is full of resources to help us. There are Nmap Scripting Engine (NSE) scripts available to perform tasks from information gathering to vulnerability detection in workstations and servers. As advanced Nmap users, we need to understand what is available and, most importantly, what platforms and configurations these scripts...