> For the complete documentation index, see [llms.txt](https://hacktricks.xsx.tw/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacktricks.xsx.tw/windows-hardening.md).

# Windows Hardening

- [Checklist - Local Windows Privilege Escalation](https://hacktricks.xsx.tw/windows-hardening/checklist-windows-privilege-escalation.md)
- [Windows Local Privilege Escalation](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation.md)
- [Abusing Tokens](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.md)
- [Access Tokens](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/access-tokens.md)
- [ACLs - DACLs/SACLs/ACEs](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.md)
- [AppendData/AddSubdirectory permission over service registry](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/appenddata-addsubdirectory-permission-over-service-registry.md)
- [Create MSI with WIX](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md)
- [COM Hijacking](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/com-hijacking.md)
- [Dll Hijacking](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/dll-hijacking.md)
- [Writable Sys Path +Dll Hijacking Privesc](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/dll-hijacking/writable-sys-path-+dll-hijacking-privesc.md)
- [DPAPI - Extracting Passwords](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.md)
- [From High Integrity to SYSTEM with Name Pipes](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/from-high-integrity-to-system-with-name-pipes.md)
- [Integrity Levels](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/integrity-levels.md)
- [JuicyPotato](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/juicypotato.md)
- [Leaked Handle Exploitation](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.md)
- [MSI Wrapper](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/msi-wrapper.md)
- [Named Pipe Client Impersonation](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.md)
- [Privilege Escalation with Autoruns](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md)
- [RoguePotato, PrintSpoofer, SharpEfsPotato, GodPotato](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.md)
- [SeDebug + SeImpersonate copy token](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/sedebug-+-seimpersonate-copy-token.md)
- [SeImpersonate from High To System](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/seimpersonate-from-high-to-system.md)
- [Windows C Payloads](https://hacktricks.xsx.tw/windows-hardening/windows-local-privilege-escalation/windows-c-payloads.md)
- [Active Directory Methodology](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology.md)
- [Abusing Active Directory ACLs/ACEs](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/acl-persistence-abuse.md)
- [Shadow Credentials](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/acl-persistence-abuse/shadow-credentials.md)
- [AD Certificates](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/ad-certificates.md)
- [AD CS Account Persistence](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/ad-certificates/account-persistence.md)
- [AD CS Domain Escalation](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md)
- [AD CS Domain Persistence](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/ad-certificates/domain-persistence.md)
- [AD CS Certificate Theft](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/ad-certificates/certificate-theft.md)
- [AD information in printers](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/ad-information-in-printers.md)
- [AD DNS Records](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/ad-dns-records.md)
- [ASREPRoast](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/asreproast.md)
- [BloodHound & Other AD Enum Tools](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/bloodhound.md)
- [Constrained Delegation](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/constrained-delegation.md)
- [Custom SSP](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/custom-ssp.md)
- [DCShadow](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/dcshadow.md)
- [DCSync](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/dcsync.md)
- [Diamond Ticket](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/diamond-ticket.md)
- [DSRM Credentials](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/dsrm-credentials.md)
- [External Forest Domain - OneWay (Inbound) or bidirectional](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/external-forest-domain-oneway-inbound.md)
- [External Forest Domain - One-Way (Outbound)](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/external-forest-domain-one-way-outbound.md)
- [Golden Ticket](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/golden-ticket.md)
- [Kerberoast](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/kerberoast.md)
- [Kerberos Authentication](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/kerberos-authentication.md)
- [Kerberos Double Hop Problem](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/kerberos-double-hop-problem.md)
- [LAPS](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/laps.md)
- [MSSQL AD Abuse](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/abusing-ad-mssql.md)
- [Over Pass the Hash/Pass the Key](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/over-pass-the-hash-pass-the-key.md)
- [Pass the Ticket](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/pass-the-ticket.md)
- [Password Spraying / Brute Force](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/password-spraying.md)
- [PrintNightmare](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/printnightmare.md)
- [Force NTLM Privileged Authentication](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/printers-spooler-service-abuse.md)
- [Privileged Groups](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.md)
- [RDP Sessions Abuse](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/rdp-sessions-abuse.md)
- [Resource-based Constrained Delegation](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/resource-based-constrained-delegation.md)
- [Security Descriptors](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/security-descriptors.md)
- [SID-History Injection](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/sid-history-injection.md)
- [Silver Ticket](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/silver-ticket.md)
- [Skeleton Key](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/skeleton-key.md)
- [Unconstrained Delegation](https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/unconstrained-delegation.md)
- [Windows Security Controls](https://hacktricks.xsx.tw/windows-hardening/authentication-credentials-uac-and-efs.md)
- [UAC - User Account Control](https://hacktricks.xsx.tw/windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.md)
- [NTLM](https://hacktricks.xsx.tw/windows-hardening/ntlm.md)
- [Places to steal NTLM creds](https://hacktricks.xsx.tw/windows-hardening/ntlm/places-to-steal-ntlm-creds.md)
- [Lateral Movement](https://hacktricks.xsx.tw/windows-hardening/lateral-movement.md)
- [AtExec / SchtasksExec](https://hacktricks.xsx.tw/windows-hardening/lateral-movement/atexec.md)
- [DCOM Exec](https://hacktricks.xsx.tw/windows-hardening/lateral-movement/dcom-exec.md)
- [PsExec/Winexec/ScExec](https://hacktricks.xsx.tw/windows-hardening/lateral-movement/psexec-and-winexec.md)
- [SmbExec/ScExec](https://hacktricks.xsx.tw/windows-hardening/lateral-movement/smbexec.md)
- [WinRM](https://hacktricks.xsx.tw/windows-hardening/lateral-movement/winrm.md)
- [WmicExec](https://hacktricks.xsx.tw/windows-hardening/lateral-movement/wmicexec.md)
- [Stealing Windows Credentials](https://hacktricks.xsx.tw/windows-hardening/stealing-credentials.md)
- [Windows Credentials Protections](https://hacktricks.xsx.tw/windows-hardening/stealing-credentials/credentials-protections.md)
- [Mimikatz](https://hacktricks.xsx.tw/windows-hardening/stealing-credentials/credentials-mimikatz.md)
- [WTS Impersonator](https://hacktricks.xsx.tw/windows-hardening/stealing-credentials/wts-impersonator.md)
- [Basic Win CMD for Pentesters](https://hacktricks.xsx.tw/windows-hardening/basic-cmd-for-pentesters.md)
- [Basic PowerShell for Pentesters](https://hacktricks.xsx.tw/windows-hardening/basic-powershell-for-pentesters.md)
- [PowerView/SharpView](https://hacktricks.xsx.tw/windows-hardening/basic-powershell-for-pentesters/powerview.md)
- [Antivirus (AV) Bypass](https://hacktricks.xsx.tw/windows-hardening/av-bypass.md)