Command Center · Reference 02
Windows Server Quick Reference
Fast lookup for server roles, domain awareness, users and groups, shares, services, firewall, networking, event logs, scheduled tasks, processes, updates, Defender, and remote access.
Server security starts with understanding the role of the host. Preserve required services and dependencies while you investigate.
Server Rule
Before changing a server
Required roles and dependencies matter more than familiarity
A server can intentionally run services, ports, shares, and roles that would look unnecessary on a normal workstation. Confirm the server's assigned purpose before disabling or removing anything.
Role awareness
Common Windows Server roles
Recognize the role first so you do not break required functionality while securing the host.
AD DS
Active Directory Domain Services
DNS
Name resolution, often critical in AD environments
DHCP
Dynamic IP address assignment
File Services
SMB shares and file access
IIS
Web server role
Hyper-V
Virtualization platform
Print Services
Centralized printing
Remote Access
Routing/VPN-related functionality
Windows Server
Server Roles & Features
Get-WindowsFeature
Lists Windows Server roles and features with install state.
Caution
Do not remove a role just because it looks unnecessary. Check the scenario first.
Get-WindowsFeature | Where-Object Installed
Shows only installed roles and features.
Caution
Installed roles may be required for scoring or business functionality.
Get-Service | Sort-Object Status,Name
Provides a quick service-state inventory.
Caution
Service state alone does not tell you whether the service is required.
Windows Server
Local Users & Groups
Get-LocalUser
Lists local server accounts and their enabled state.
Caution
On a domain controller, local account behavior differs because AD DS is authoritative.
Get-LocalGroupMember -Group "Administrators"
Shows members of the local Administrators group.
Caution
Privilege membership is capability, not proof of misuse.
net user
Classic local-user inventory command.
Caution
Use domain-specific commands when the server is acting as a domain controller.
Windows Server
Domain Awareness
Get-ComputerInfo | Select CsDomain,CsDomainRole,CsName
Shows domain membership and basic server role information.
Caution
Confirm whether the host is standalone, domain-joined, or a domain controller before making account changes.
whoami /fqdn
Shows the current user's fully qualified domain name when available.
Caution
This describes the current user context, not every domain account.
nltest /dsgetdc:<domain>
Locates a domain controller for the specified domain.
Caution
Use the actual domain name from the environment rather than guessing.
Windows Server
Active Directory Quick Checks
Get-ADUser -Filter *
Lists Active Directory users when the AD module is installed and available.
Caution
This can return many accounts. Filter deliberately when possible.
Get-ADGroup -Filter *
Lists Active Directory groups.
Caution
Group existence does not show membership or recent use.
Get-ADGroupMember -Identity "Domain Admins"
Shows members of a selected AD group.
Caution
Do not remove members until scenario requirements and ownership are clear.
Get-ADComputer -Filter *
Lists computers known to Active Directory.
Caution
An AD object can remain after the device is no longer active.
Windows Server
Shared Folders & SMB
Get-SmbShare
Lists SMB shares configured on the server.
Caution
Administrative shares such as C$ and ADMIN$ are expected on many Windows systems.
Get-SmbSession
Shows current SMB client sessions.
Caution
Current sessions are volatile and may disappear quickly.
Get-SmbOpenFile
Shows files currently opened through SMB.
Caution
Record useful evidence before disconnecting anything.
Get-SmbShareAccess -Name "ExampleShare"
Shows share-level permissions for one SMB share.
Caution
Share permissions and NTFS permissions both affect effective access.
Windows Server
Services
Get-Service
Lists service names, display names, and state.
Caution
Never bulk-disable unfamiliar services.
Get-CimInstance Win32_Service | Select Name,State,StartMode,StartName,PathName
Shows startup mode, service account, executable path, and state.
Caution
Required server roles often depend on multiple services.
Get-CimInstance Win32_Service -Filter "Name='ExampleService'" | Format-List *
Shows detailed configuration for a selected service.
Caution
Preserve configuration details before making changes.
Windows Server
Firewall
Get-NetFirewallProfile
Shows the state of Domain, Private, and Public firewall profiles.
Caution
Profile state alone does not describe all individual rules.
Get-NetFirewallRule -Enabled True
Lists enabled firewall rules.
Caution
Review direction, profile, program, protocol, and address scope.
Get-NetFirewallRule -DisplayName "Example Rule" | Get-NetFirewallPortFilter
Shows protocol and port filters for a selected rule.
Caution
A firewall allow rule does not prove that a service is listening.
Windows Server
Network Configuration
Get-NetIPConfiguration
Shows IP addresses, gateways, DNS servers, and adapter details.
Caution
Servers often have static addressing; do not change it without checking the scenario.
Get-NetIPAddress
Lists configured IP addresses.
Caution
Virtual adapters and link-local addresses may be present.
Get-DnsClientServerAddress
Shows DNS server assignments per interface.
Caution
Domain controllers and domain members depend heavily on correct DNS configuration.
route print
Shows routing tables.
Caution
Use routes for troubleshooting, not as a reason for arbitrary deletion.
Windows Server
Listening Ports & Connections
Get-NetTCPConnection -State Listen
Shows listening TCP sockets and owning PIDs.
Caution
Map the PID to a process and service before judging the listener.
Get-NetTCPConnection
Shows TCP connection state and owning process IDs.
Caution
A connection is an observation, not proof of malicious activity.
netstat -ano
Classic network-socket and PID view.
Caution
Use PID mapping to identify the owning process.
Windows Server
Event Logs
Get-WinEvent -LogName Security -MaxEvents 100
Shows recent Security events.
Caution
Filter by event ID and time once you know what evidence you need.
Get-WinEvent -LogName System -MaxEvents 100
Shows recent System events including service and boot activity.
Caution
Correlate service events with configuration and process evidence.
Get-WinEvent -LogName 'Directory Service' -MaxEvents 100
Shows Directory Service events on systems where that log exists.
Caution
This log is relevant mainly on domain controllers.
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4720,4726; StartTime=(Get-Date).AddHours(-4)}Filters recent logons and account-creation/deletion events.
Caution
Adjust the time window to the scenario rather than searching blindly.
Windows Server
Scheduled Tasks & Startup
Get-ScheduledTask
Lists scheduled tasks and state.
Caution
Configured does not mean executed.
Get-ScheduledTaskInfo -TaskName "ExampleTask"
Shows last-run and next-run information.
Caution
Pair this with task action, trigger, and account.
Get-CimInstance Win32_StartupCommand
Provides a broad startup-command inventory.
Caution
It is not exhaustive and should be combined with services and scheduled-task review.
Windows Server
Processes
Get-Process
Lists currently running processes.
Caution
Process name alone does not establish legitimacy.
Get-CimInstance Win32_Process | Select ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine
Adds parent PID, executable path, and command line.
Caution
Some fields may require elevation.
Get-Process -Id 1234 | Format-List Id,ProcessName,Path,StartTime
Shows details for one PID.
Caution
PIDs are temporary and can be reused.
Windows Server
Updates & Defender
Get-HotFix | Sort-Object InstalledOn -Descending
Shows visible hotfix/update history.
Caution
Not every modern update appears identically in Get-HotFix.
Get-MpComputerStatus
Shows Microsoft Defender protection state.
Caution
Healthy Defender status does not prove the system is clean.
Get-MpThreatDetection
Shows recorded Defender detections where available.
Caution
Detection history is only one evidence source.
Windows Server
Remote Access
Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name fDenyTSConnections
Shows the RDP deny/allow setting.
Caution
Remote Desktop may be required for administration; check the scenario.
Get-Service TermService
Shows Remote Desktop Services state.
Caution
Service state, firewall rules, and policy all affect RDP availability.
Get-NetTCPConnection -LocalPort 3389 -ErrorAction SilentlyContinue
Checks whether TCP 3389 currently has an endpoint.
Caution
Map the PID and process before drawing conclusions.
Event IDs
High-value Windows Server event awareness
Decision check
Ask these before changing server configuration
What role is this server expected to perform?
Is this system standalone, domain-joined, or a domain controller?
Which services are required by the assigned roles?
Are any shares required for the scenario?
Are the account or group memberships expected?
What process owns the port or connection I am investigating?
Do I need to preserve logs, hashes, PIDs, task settings, or service paths before changing anything?
What is the smallest justified defensive change?
How will I verify the server still performs its required role afterward?
Common mistakes
Server mistakes that can break required services
Removing a server role before confirming that the scenario does not require it.
Treating domain controllers like ordinary standalone Windows machines.
Changing DNS settings without understanding their role in Active Directory.
Removing SMB shares without checking whether they are required.
Disabling services that belong to required server roles.
Changing several firewall rules at once and losing track of the effect.
Deleting evidence before recording task actions, service paths, event IDs, or PIDs.
Forgetting to verify that required clients can still reach the server after remediation.