Windows Privilege Escalation

Local Windows privilege escalation can occur when a vulnerable component, unsafe privilege configuration, writable privileged file path, or exposed credential permits a lower-privileged user to gain higher privileges. The checks recorded here are a limited discovery subset: collect OS and QFE data, inspect DACLs on three common directories, and query the Winlogon DefaultPassword value. A finding is a lead, not proof that it can be exploited or that elevation succeeded. The query does not detect credentials stored as an LSA secret by Microsoft Sysinternals Autologon.