Command Prompt, PowerShell, and Environment Variables

This book introduces the basics of Windows for both local systems and domain-joined systems, with an eye towards security. It assumes that readers are familiar with Windows operations, either as a user of Windows or as a system administrator. It covers workstations running Windows 10 and Windows 11, as well as the foundations for Windows Servers. This chapter starts with the Windows command prompt from a security perspective, including how to configure autoruns and the command prompt history. It continues with PowerShell, introducing both PowerShell 5 and PowerShell 7. PowerShell execution policies are presented, as well as extensions via PowerShell modules, COM, DCOM, and .NET. Attackers using PowerShell often try to hide their intent, so common obfuscation techniques are presented. The chapter ends with a discussion of Windows environment variables.