Skip to main content

Lab 1.3: System Inventory and Documentation

Learning Objectives​

By the end of this lab, you will be able to:

  • Collect detailed information about a Windows system
  • Identify running processes and services
  • Document basic security configuration
  • Create a professional system inventory
  • Understand the usefulness of this information for maintenance and security

Estimated Duration​

30 minutes

Prerequisites​

  • Labs 1.1 and 1.2 completed
  • Administrator access to your computer
  • Basic understanding of Windows

Professional Context​

System inventory is a fundamental practice in IT administration. It allows you to:

  • Document the current state of a system
  • Identify unauthorized changes
  • Plan updates and migrations
  • Diagnose problems
  • Respond to security incidents
  • Ensure regulatory compliance

Part 1: General System Information​

Step 1.1: systeminfo Command​

The systeminfo command provides a comprehensive overview of the system.

Open the command prompt as an administrator:

  1. Search for "cmd"
  2. Right-click → "Run as administrator"

Execute:

systeminfo

Observe and note:

  • Host Name
  • Operating System Name
  • Windows version and build
  • System installation date
  • System Boot Time
  • System manufacturer and model
  • Processor(s)
  • Total physical memory
  • Domain or workgroup

Questions:

  1. What is the exact version of your Windows (build number)?
  2. How long has your system been running without a reboot?
  3. How much RAM does your system have?
  4. Is your system in a domain or a workgroup?

Step 1.2: Export to a File​

Execute:

systeminfo > C:\Users\%USERNAME%\Desktop\system_inventory.txt

A text file is created on your desktop with all the information.

Step 1.3: Hardware Information with WMIC​

WMIC (Windows Management Instrumentation Command) allows detailed system queries.

Processor information:

wmic cpu get name, numberofcores, numberoflogicalprocessors

Memory information:

wmic memorychip get capacity, speed, manufacturer

Disk information:

wmic diskdrive get model, size, status

Questions: 5. How many physical and logical cores does your processor have? 6. What is the speed of your RAM (in MHz)? 7. What is the total size of your hard drive (in bytes)?

Part 2: Users and Groups​

Step 2.1: List Local Users​

Execute:

net user

This displays all local user accounts.

For details on a specific user:

net user %USERNAME%

(Replace %USERNAME% with your username if necessary)

Observe:

  • When the account was created (Account active)
  • When the password expires
  • The groups the user belongs to
  • If the account is active

Questions: 8. How many local users exist on your system? 9. Does your password have an expiration date? 10. Are there any accounts you do not recognize?

Step 2.2: Local Groups​

Execute:

net localgroup

Lists all local groups.

To see the members of a group (example: Administrators):

net localgroup Administrators

Questions: 11. What are the local groups on your system? 12. How many accounts are part of the Administrators group?

Step 2.3: Current User Privileges​

Execute:

whoami /all

This command displays ALL information about your current account:

  • Username and SID
  • Group memberships
  • Privileges
  • Integrity level

Questions: 13. What is your SID (Security Identifier)? 14. What privileges do you have? 15. What is your integrity level?

Part 3: Running Processes​

Step 3.1: List Processes with tasklist​

Execute:

tasklist

Displays all active processes with their PID (Process ID).

Questions: 16. How many processes are running? 17. What process uses PID 4? (usually the system)

Step 3.2: Processes with Details​

To see services associated with processes:

tasklist /svc

To see memory usage:

tasklist /v

Step 3.3: Search for a Specific Process​

To find all Chrome processes:

tasklist | findstr chrome

To find processes of a user:

tasklist /v | findstr %USERNAME%

Questions: 18. How many "chrome.exe" processes are active? (if Chrome is open) 19. What are the 3 processes using the most memory?

Part 4: Windows Services​

Services are programs that run in the background.

Step 4.1: List Services​

Execute:

sc query type= service state= all

(Note: the space after the = is important!)

Step 4.2: Running Services​

To see only active services:

sc query type= service state= running

Step 4.3: Information on a Specific Service​

Example with the Windows Defender service:

sc qc WinDefend

Displays the service configuration:

  • Startup type (Automatic, Manual, Disabled)
  • Executable path
  • Account used to run the service

Questions: 20. How many services are running? 21. Is the Windows Defender service running? 22. What is the startup type of the "Windows Update" service (wuauserv)?

Part 5: Active Network Connections​

Step 5.1: Listening Ports and Connections​

Execute:

netstat -ano

Options:

  • -a : Displays all connections and listening ports
  • -n : Displays addresses in numeric format
  • -o : Displays the PID of the process

Observe:

  • LISTENING : The port is waiting for connections
  • ESTABLISHED : Active connection
  • TIME_WAIT : Connection is closing

Step 5.2: Identify Which Program Uses a Port​

Execute:

netstat -anob

The -b option displays the executable name (requires admin rights).

Questions: 23. How many ESTABLISHED connections do you currently have? 24. What program is listening on port 445? (SMB, often "System") 25. Are there any connections to foreign IP addresses?

Step 5.3: Connections by Protocol​

Statistics by protocol:

netstat -s

Displays detailed statistics for TCP, UDP, ICMP, etc.

Part 6: Installed Software​

Step 6.1: List via WMIC​

Execute:

wmic product get name, version, vendor

WARNING: This command may take time and may trigger repairs of some software.

Step 6.2: Alternative via Registry​

For a faster list (PowerShell):

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher

Questions: 26. How many applications are installed on your system? 27. Are there any software you do not recognize?

Part 7: Updates and Security Patches​

Step 7.1: List Installed Hotfixes​

Execute:

wmic qfe list full

QFE = Quick Fix Engineering = Windows Patches/Updates

Displayed information:

  • KB (Knowledge Base) number
  • Installation date
  • Type (Security Update, Update, etc.)

Questions: 28. What is the last security patch installed? 29. Are there any recent updates (less than 30 days)?

Step 7.2: Detailed Information​

To see only security updates:

wmic qfe where "Description='Security Update'" get HotFixID, InstalledOn

Part 8: Security Configuration​

Step 8.1: Password Policy​

Execute:

net accounts

Displays:

  • Minimum password length
  • Maximum password age
  • Password history
  • Lockout threshold

Questions: 30. What is the minimum required password length? 31. After how many failed attempts is an account locked?

Step 8.2: Firewall Status​

Execute:

netsh advfirewall show allprofiles

Displays the firewall status for all profiles (Domain, Private, Public).

Questions: 32. Is the firewall enabled on all profiles? 33. What is the default state for inbound connections?

Step 8.3: Windows Defender​

Execute (PowerShell):

Get-MpComputerStatus

Displays the complete status of Windows Defender.

Questions: 34. Is real-time protection enabled? 35. When was the last full scan performed?

Part 9: Creating a Complete Inventory Report​

Step 9.1: Automated Collection Script​

Create a file inventory.bat with the following content:

@echo off
echo ========================================
echo SYSTEM INVENTORY - %COMPUTERNAME%
echo Date: %DATE% %TIME%
echo ========================================
echo.

echo [SYSTEM INFORMATION]
systeminfo | findstr /C:"Host Name" /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Total Physical Memory"
echo.

echo [LOCAL USERS]
net user
echo.

echo [LOCAL GROUPS]
net localgroup
echo.

echo [ACTIVE PROCESSES (Top 10)]
tasklist /v | more +1 | findstr /V "N/A" | sort /R /+65 | more +1 | findstr /V "======" | more +1 > temp.txt
more +0 temp.txt
del temp.txt
echo.

echo [RUNNING SERVICES]
sc query type= service state= running | findstr "SERVICE_NAME DISPLAY_NAME"
echo.

echo [ACTIVE NETWORK CONNECTIONS]
netstat -ano | findstr "ESTABLISHED LISTENING"
echo.

echo [FIREWALL]
netsh advfirewall show allprofiles state
echo.

echo [LATEST UPDATES]
wmic qfe list brief | more +1
echo.

echo ========================================
echo Inventory complete
echo ========================================
pause

Step 9.2: Execution and Export​

Execute the script and save the result:

inventory.bat > complete_inventory_%COMPUTERNAME%_%DATE:~-4,4%%DATE:~-10,2%%DATE:~-7,2%.txt

This creates a file with the date in the name.

Part 10: Analysis and Documentation​

Step 10.1: Inventory Review​

Analyze your inventory and answer:

Security:

  • Are there any unnecessary services running?
  • Are there any open ports you do not recognize?
  • Are security updates up to date?
  • Is the firewall properly configured?

Performance:

  • Are there too many active processes?
  • Does memory usage seem normal?
  • Are there unknown programs that start automatically?

Compliance:

  • Is the password policy adequate?
  • Is Windows Defender active and up to date?
  • Are all user accounts necessary?

Step 10.2: Recommendations​

Based on your inventory, list 3-5 recommendations to improve:

  1. System security
  2. Performance
  3. Maintenance

Deliverables​

To submit:

  1. Complete inventory file generated by the script

  2. Analysis document (Word/PDF, 2-3 pages) containing:

    • Answers to the 35 questions
    • Summary table of key information
    • "Observations" section with what surprised you
    • "Recommendations" section with 3-5 improvement suggestions

  3. Screenshots (minimum 5):

    • systeminfo
    • whoami /all
    • tasklist with processes sorted by memory
    • netstat -ano with active connections
    • Firewall status

Evaluation Criteria​

CriterionPoints
Complete and well-formatted inventory file25%
Answers to questions (understanding)30%
Relevant analysis of collected information20%
Realistic and justified recommendations15%
Quality of documentation and screenshots10%

Quick Reference Commands​

System Information​

systeminfo                          # Comprehensive overview
wmic cpu get name                   # Processor info
wmic memorychip get capacity        # Memory info
wmic diskdrive get model,size       # Disk info

Users and Groups​

net user                            # List users
net user <username>                 # User details
net localgroup                      # List groups
whoami /all                         # Current user info

Processes and Services​

tasklist                            # List processes
tasklist /svc                       # Processes with services
sc query type= service              # List services
sc qc <service>                     # Specific service info

Network​

netstat -ano                        # Active connections
netstat -anob                       # Connections with programs
netstat -s                          # Network statistics

Security​

net accounts                        # Password policy
netsh advfirewall show allprofiles  # Firewall status
wmic qfe list                       # Installed updates

Troubleshooting​

Problem: "Access Denied"​

Solution: Run the command prompt as an administrator.

Problem: WMIC does not work​

Solution: WMIC is deprecated in newer versions of Windows. Use PowerShell instead:

Get-CimInstance Win32_OperatingSystem
Get-CimInstance Win32_Processor
Get-CimInstance Win32_PhysicalMemory

Problem: The .bat script does not run​

Solution:

  • Ensure the file has the .bat extension and not .txt
  • Right-click → Run as administrator

Going Further (Optional)​

Challenge 1: Advanced PowerShell Script​

Create a PowerShell script that generates an HTML report with all system information.

Challenge 2: Temporal Comparison​

Run the inventory once a week for a month. Identify changes.

Challenge 3: Security Audit​

Use CIS-CAT or Microsoft Security Compliance Toolkit tools for a full audit.

Additional Resources​

Conclusion​

You now have the skills to:

  • Collect comprehensive information about a Windows system
  • Identify active processes, services, and connections
  • Document security configuration
  • Create automated inventory reports

These skills are fundamental for:

  • System administration
  • Troubleshooting
  • Security incident response
  • Compliance auditing
  • Maintenance planning

Next step: MODULE 2 where you will learn to create and configure virtual machines for your tests!

Important Notes​

Data Privacy:

System inventory may contain sensitive information:

  • Usernames
  • Network configuration
  • Installed software
  • Potential vulnerabilities

Best practices:

  1. Never share your inventory files publicly
  2. Store them securely
  3. Remove sensitive information before sharing for learning
  4. Respect your organization's privacy policies

Professional use:

  • Always obtain permission before auditing a system
  • Document why you are collecting this information
  • Comply with regulations (GDPR, etc.)
  • Only collect necessary information