System information and patch level - User and group enumeration - Token privileges - Service configurations (unquoted paths, weak permissions) - Scheduled tasks - Network information - Installed software - Registry autorun keys - Credential files and history - Interesting files (configs, backups) -