Windows looks simple.

You click an application.

You open a folder.

You browse the web.

You shut down the PC.

But underneath that familiar desktop is an entire collection of command interpreters, scripting engines, configuration databases, administrative utilities, automation interfaces, and system components.

And security researchers know something important:

You don’t always need to install a hacking tool to learn how Windows works.

Windows already comes with many tools that can teach you how attackers automate tasks, inspect systems, change configuration, execute commands, and interact with the operating system.

You can learn a surprising amount using nothing more than:

CMD
BAT / CMD scripts
VBScript
Registry Editor
Windows built-in utilities

This doesn’t mean turning your computer into a malware lab.

Instead, we’re going to build a safe Windows hacking laboratory using harmless scripts and registry experiments.

You’ll learn how:

• .bat and .cmd files work
• .vbs scripts interact with Windows
• BAT files can automate security checks
• Windows Registry values can be queried
• Scripts can detect administrator privileges
• Windows commands can collect system information
• VBS can interact with Windows components
• Registry keys influence Windows behavior
• Attackers abuse legitimate Windows components
• Security researchers identify suspicious script behavior
• You can build your own mini Windows security toolkit

And the best part?

You can do most of it with tools already installed on Windows.

⚠️ Before We Start

Everything in this article is intended for:

• Your own computer
• A virtual machine
• A controlled cybersecurity lab
• Authorized security testing

The examples are designed to be non-destructive.

We’re deliberately avoiding scripts that:

• Delete files
• Encrypt someone’s data
• Steal credentials
• Disable security software
• Establish covert persistence
• Destroy system recovery
• Spread across networks
• Damage another computer

The goal is to understand Windows—not break somebody else’s machine.

🧠 Why BAT, CMD, VBS and Registry Matter in Cybersecurity

When people hear “ethical hacking,” they often imagine:

Kali Linux
Metasploit
Burp Suite
Nmap
Wireshark

Those tools are useful.

But Windows itself is also a huge security research environment.

A Windows machine contains:

                 WINDOWS
                    │
        ┌───────────┼───────────┐
        │           │           │
       CMD         VBS       Registry
        │           │           │
       BAT       Automation   Config
        │           │           │
        └───────────┼───────────┘
                    │
              Windows APIs
                    │
             System Components

Understanding these components helps you recognize both legitimate administration and suspicious behavior.

For example, a security analyst seeing:

cmd.exe
wscript.exe
cscript.exe
reg.exe
schtasks.exe

shouldn’t automatically assume malware.

These are legitimate Windows components.

The important question is:

Why is the process being used, by whom, with what arguments, and what happens next?

That is a much more useful security mindset.

1. Your First BAT File

Let’s start with the simplest possible Windows script.

Open Notepad and enter:

@echo off
echo ==========================
echo   WINDOWS SECURITY LAB
echo ==========================
echo.
echo Hello from your BAT file!
echo.
pause

Save it as:

security-lab.bat

Make sure Windows isn’t secretly saving it as:

security-lab.bat.txt

Run it.

You’ll see a Command Prompt window containing your message.

That’s it.

But you just created an executable script using nothing except Windows and Notepad.

2. Understand What @echo off Does

You’ll frequently see:

@echo off

at the beginning of BAT files.

Without it, CMD may display the commands while executing them.

With:

@echo off

the script looks cleaner.

For example:

echo Hello

prints:

Hello

rather than showing every command being executed.

This is mostly presentation—not a security feature.

And that’s an important lesson:

A script hiding its commands from the console does not make it invisible to security software.

3. Make BAT Files Collect System Information

Here’s a harmless cybersecurity-style system inventory script:

@echo off
echo ==========================
echo SYSTEM INFORMATION
echo ==========================
echo.
systeminfo
echo.
echo ==========================
echo NETWORK CONFIGURATION
echo ==========================
ipconfig
echo.
pause

Save it as:

system-info.bat

Run it.

You now have a tiny Windows information-gathering tool.

This teaches an important concept:

Enumeration

Before interacting with a system, security professionals often need to understand what the system actually contains.

4. Build a Mini Security Recon Script

Let’s make it more useful.

@echo off
echo ==================================
echo       WINDOWS RECON LAB
echo ==================================
echo.
echo [1] Computer Name
hostname
echo.
echo [2] Current User
whoami
echo.
echo [3] Windows Version
ver
echo.
echo [4] IP Configuration
ipconfig
echo.
echo [5] Active Network Connections
netstat -ano
echo.
echo [6] Running Processes
tasklist
echo.
echo ==================================
echo Recon complete.
echo ==================================
pause

Now you’ve created a miniature Windows reconnaissance script.

It demonstrates several concepts security students encounter constantly:

Identity
    ↓
System information
    ↓
Network configuration
    ↓
Connections
    ↓
Processes

5. Check Who You Are

One of the most useful Windows commands is:

whoami

It tells you the current Windows identity.

Try:

whoami

Then:

whoami /groups

The second command provides information about groups associated with the current security token.

This is useful when learning Windows permissions.

For security research, identity matters.

A command executed as:

Standard User

is very different from the same command executed as:

Administrator

6. Detect Administrator Privileges

Here’s a useful BAT exercise.

@echo off
net session >nul 2>&1
if %errorlevel% == 0 (
    echo Running with administrative privileges.
) else (
    echo Running without administrative privileges.
)
pause

This demonstrates how a script can inspect whether it has the privileges required for a particular administrative operation.

It’s also a good introduction to:

%errorlevel%

which represents the result of the previous command.

7. Make BAT Scripts Interactive

BAT files don’t have to be boring.

You can ask the user for input.

@echo off
set /p name=Enter your name: 
echo.
echo Hello %name%!
echo Welcome to the Windows Security Lab.
pause

Now the script becomes interactive.

The structure is:

User Input
    ↓
Environment Variable
    ↓
BAT Script
    ↓
Output

This is an excellent way to start understanding how user-controlled input moves through scripts.

And that’s directly relevant to cybersecurity.

8. Create a Simple Security Checklist

Let’s make something actually useful.

@echo off
echo ==============================
echo WINDOWS QUICK SECURITY CHECK
echo ==============================
echo.
echo [*] Current User
whoami
echo.
echo [*] Windows Version
ver
echo.
echo [*] Firewall Profiles
netsh advfirewall show allprofiles
echo.
echo [*] Active Connections
netstat -ano
echo.
echo [*] Running Processes
tasklist
echo.
echo [*] Recent ARP Entries
arp -a
echo.
echo ==============================
echo CHECK COMPLETE
echo ==============================
pause

This isn’t a replacement for an endpoint security product.

But it’s a great learning exercise.

9. The Windows Registry

Now we get into one of the most interesting parts.

The Windows Registry is essentially a hierarchical configuration database used by Windows and applications.

You can open Registry Editor with:

Win + R

then:

regedit

You’ll see structures such as:

HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_USERS
HKEY_CURRENT_CONFIG

Think of the Registry conceptually as:

Registry
│
├── Keys
│   ├── Subkeys
│   └── Values
│
└── Configuration Data

10. Don’t Randomly Edit the Registry

This is extremely important.

The Registry isn’t a toy.

Before experimenting:

Create a restore point

and/or export the relevant registry key.

You can also perform experiments inside a Windows virtual machine.

For cybersecurity students, a VM is ideal.

You can break things there without risking your main machine.

11. Read Registry Values From CMD

You don’t need to open regedit every time.

Windows includes:

reg

Try:

reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer"

This demonstrates an important concept:

GUI Registry Editor
        ↕
     reg.exe
        ↕
Windows Registry

The command-line interface gives scripts a way to interact with registry data.

12. Search the Registry From a BAT File

You can automate registry inspection.

For example:

@echo off
echo Checking Windows Explorer configuration...
echo.
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer"
echo.
pause

Now your BAT script is interacting with Windows configuration data.

This is where BAT scripting starts becoming interesting for security research.

13. Check Windows Version Information From the Registry

You can query Windows version information:

@echo off
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
pause

This can expose information about the installed Windows version and related configuration.

Security tools frequently need basic system information before deciding what checks to perform.

14. Your First VBScript

Now let’s move to .vbs.

Create:

hello.vbs

Put this inside:

MsgBox "Welcome to the Windows Security Lab!"

Double-click it.

Windows Script Host will display a message box.

That’s your first VBScript.

15. Make Windows Speak

VBScript can interact with Windows text-to-speech components.

Create:

speak.vbs

with:

Set voice = CreateObject("SAPI.SpVoice")
voice.Speak "Welcome to the Windows Security Lab."

Run it.

Your computer should speak the sentence.

This is harmless—but it demonstrates something important:

Scripts can interact with Windows components through automation interfaces.

16. Make a VBScript Display System Information

Try:

Set shell = CreateObject("WScript.Shell")
computer = shell.ExpandEnvironmentStrings("%COMPUTERNAME%")
username = shell.ExpandEnvironmentStrings("%USERNAME%")
MsgBox "Computer: " & computer & vbCrLf & _
       "User: " & username

Now your script can retrieve environment information.

The structure is:

VBScript
   ↓
WScript.Shell
   ↓
Windows Environment

This is the kind of relationship security researchers need to understand.

17. BAT + VBS Together

You can combine different scripting technologies.

Create:

launcher.bat

@echo off
echo Starting Windows Security Lab...
cscript //nologo speak.vbs
echo.
echo Script finished.
pause

Now:

BAT
 ↓
cscript.exe
 ↓
VBScript
 ↓
Windows component

You’ve created a tiny multi-stage script.

This same concept is important when analyzing malware.

Attackers sometimes chain legitimate interpreters and utilities.

The fact that multiple Windows components are involved doesn’t automatically mean something malicious happened.

You need to examine the entire chain.

18. What Is wscript.exe?

You may encounter:

wscript.exe

and:

cscript.exe

Both are Windows Script Host components.

The difference is primarily how scripts are hosted.

wscript.exe is generally associated with Windows-based graphical script execution.

cscript.exe is designed for command-line script execution.

For example:

cscript //nologo speak.vbs

runs the VBScript from the console.

19. Why Security Tools Watch Script Interpreters

Here’s where this becomes cybersecurity.

Security products often pay attention to process behavior involving components such as:

cmd.exe
wscript.exe
cscript.exe
powershell.exe
mshta.exe

Why?

Because legitimate Windows tools can also be abused by attackers.

This concept is commonly associated with:

Living Off the Land

Instead of bringing every tool from outside, an attacker may attempt to use software already present on the system.

Conceptually:

Traditional Malware
Attacker
   ↓
Downloads Tool
   ↓
Runs Tool

versus:

Living Off the Land
Attacker
   ↓
Existing Windows Component
   ↓
System Action

This doesn’t make built-in tools malicious.

It makes context important.

20. Watch the Process Tree

Here’s an important defensive exercise.

Open:

Task Manager

and look at running processes.

Better yet, use Microsoft’s Sysinternals tools in a controlled lab, particularly Process Explorer, to study parent-child process relationships.

You might see something conceptually like:

explorer.exe
      │
      └── cmd.exe
             │
             └── cscript.exe

Ask:

Who launched it?
What command line was used?
What file was executed?
What happened afterward?

This is exactly how defenders investigate suspicious process activity.

21. Build a BAT Process Viewer

Here’s another harmless lab script:

@echo off
echo ==============================
echo RUNNING PROCESSES
echo ==============================
tasklist
echo.
echo ==============================
echo NETWORK CONNECTIONS
echo ==============================
netstat -ano
echo.
echo Done.
pause

Notice something interesting:

netstat -ano

includes process IDs.

Those PIDs can then be compared against:

tasklist

This lets you start connecting:

Network Connection
       ↓
PID
       ↓
Process

That’s a fundamental incident-response skill.

22. Build a Windows Network Snapshot Script

Let’s combine several commands.

@echo off
set OUTPUT=windows_snapshot.txt
echo WINDOWS SECURITY SNAPSHOT > "%OUTPUT%"
echo ========================= >> "%OUTPUT%"
echo. >> "%OUTPUT%"
echo [USER] >> "%OUTPUT%"
whoami >> "%OUTPUT%"
echo. >> "%OUTPUT%"
echo [HOST] >> "%OUTPUT%"
hostname >> "%OUTPUT%"
echo. >> "%OUTPUT%"
echo [IP CONFIGURATION] >> "%OUTPUT%"
ipconfig >> "%OUTPUT%"
echo. >> "%OUTPUT%"
echo [CONNECTIONS] >> "%OUTPUT%"
netstat -ano >> "%OUTPUT%"
echo. >> "%OUTPUT%"
echo [PROCESSES] >> "%OUTPUT%"
tasklist >> "%OUTPUT%"
echo.
echo Snapshot saved to:
echo %OUTPUT%
pause

Run it.

You’ll get:

windows_snapshot.txt

Now you’re starting to build an actual Windows investigation utility.

23. Learn Redirection: > and >>

This is one of the most useful BAT concepts.

command > output.txt

creates/replaces the output file.

While:

command >> output.txt

adds output to an existing file.

For example:

whoami > user.txt

and:

ipconfig >> user.txt

Now the same file contains multiple command results.

This simple concept appears everywhere in automation and security scripts.

24. Learn Pipes

Another important CMD feature is:

|

called a pipe.

For example:

tasklist | findstr /i "chrome"

Conceptually:

tasklist
    ↓
Output
    ↓
findstr
    ↓
Filtered result

This is incredibly useful for Windows troubleshooting and security analysis.

25. Make Your Script Search Processes

Here’s a harmless example:

@echo off
set /p process=Enter process name: 
echo.
echo Searching for:
echo %process%
echo.
tasklist | findstr /i "%process%"
echo.
pause

Enter:

chrome

or:

notepad

and the script searches the process list.

You’ve just learned:

Input
 ↓
Variable
 ↓
Command
 ↓
Pipe
 ↓
Filtering

These are foundational scripting concepts.

26. Registry + BAT = Automation

Here’s a simple example that checks whether a particular Registry location exists:

@echo off
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion" >nul 2>&1
if %errorlevel% == 0 (
    echo Registry key exists.
) else (
    echo Registry key was not found.
)
pause

This is much more useful than manually clicking through Registry Editor.

Security tools can automate hundreds or thousands of checks this way.

27. Build a Simple Windows Security Dashboard

Let’s combine everything.

@echo off
title Windows Security Lab
:menu
cls
echo ==================================
echo       WINDOWS SECURITY LAB
echo ==================================
echo.
echo [1] Current User
echo [2] System Information
echo [3] Network Configuration
echo [4] Active Connections
echo [5] Running Processes
echo [6] Registry Information
echo [7] Exit
echo.
set /p choice=Select an option: 
if "%choice%"=="1" goto user
if "%choice%"=="2" goto system
if "%choice%"=="3" goto network
if "%choice%"=="4" goto connections
if "%choice%"=="5" goto processes
if "%choice%"=="6" goto registry
if "%choice%"=="7" exit
goto menu
:user
whoami
pause
goto menu
:system
systeminfo
pause
goto menu
:network
ipconfig
pause
goto menu
:connections
netstat -ano
pause
goto menu
:processes
tasklist
pause
goto menu
:registry
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion"
pause
goto menu

Now you’ve built an interactive Windows security utility.

No external Python package.

No framework.

No hacking tool.

Just Windows.

28. What Attackers Can Learn From This

Now imagine an attacker obtains unauthorized access to a Windows machine.

They may want to understand:

Who am I?
What OS is this?
What network am I on?
What processes are running?
What connections exist?
What privileges do I have?
What configuration is present?

Those are essentially the same questions your harmless script is asking.

The difference is authorization and intent.

This is an important cybersecurity lesson:

The same operating-system capability can be useful for administration, incident response, penetration testing, or abuse.

The command itself isn’t the whole story.

29. Why .bat Files Can Be Dangerous

A BAT file is just text.

That’s precisely why users shouldn’t automatically trust one.

A file containing:

something.bat

can execute commands when opened.

For example, a legitimate script might:

Collect system information

while another could attempt to:

Modify configuration
Download software
Launch other processes

Therefore:

Never run an unknown BAT, CMD, VBS, or REG file simply because someone sent it to you.

Treat scripts as executable content.

30. Why .vbs Files Deserve Attention

VBScript has legitimate uses.

Organizations have historically used it for:

• Administration
• Automation
• Logon scripts
• Legacy applications
• Windows management

But attackers have also abused scripting hosts.

That’s why receiving something like:

invoice.vbs
photo.vbs
document.vbs
update.vbs

should make you cautious.

The filename tells you almost nothing.

The contents matter.

31. The Registry Can Also Be an Attack Surface

The Registry controls or stores enormous amounts of Windows configuration.

That makes it interesting to:

Administrators
Developers
Security Researchers
Digital Forensics Analysts
Malware Analysts
Attackers

A security analyst may inspect Registry artifacts to determine:

What configuration changed?
What software was installed?
What applications start automatically?
What devices were connected?
What settings changed?

This is why Registry knowledge is useful beyond Windows customization.

32. Don’t Confuse “Registry Hack” With Hacking a Computer

The word “hack” is often used loosely online.

Changing:

Windows UI behavior

through the Registry is a customization.

Finding:

A vulnerable Registry permission

could be a security issue.

Using:

Registry-based persistence

in malware would be malicious behavior.

The underlying technology can be the same.

The security context is different.

33. Build Your Own Windows Cybersecurity Lab

If you want to go deeper, create a virtual machine.

A simple lab could look like:

Your Main PC
      │
      ▼
VirtualBox / VMware
      │
      ▼
Windows VM
      │
      ├── BAT experiments
      ├── VBS experiments
      ├── Registry experiments
      ├── Process monitoring
      ├── Event log analysis
      └── Malware-analysis exercises

Take a snapshot before experiments.

If you break the VM:

Restore Snapshot
      ↓
Clean Lab

This is far safer than experimenting on your primary computer.

34. Turn Windows Into a Cybersecurity Playground

Here are some projects you can build next.

Project 1 — Windows Recon Script

Collect:

Username
Hostname
Windows version
IP configuration
Processes
Connections

Project 2 — Security Snapshot

Save the information into:

snapshot.txt

and compare snapshots over time.

Project 3 — Process Monitor

Create a script that periodically records:

tasklist

and stores the results.

Project 4 — Network Snapshot

Record:

ipconfig
netstat
arp

for troubleshooting and lab analysis.

Project 5 — Registry Explorer

Create a BAT menu that safely queries selected Registry locations.

Project 6 — Windows Security Dashboard

Combine all of the above into one menu-driven script.

Project 7 — VBS Automation

Use VBScript to:

Display messages
Read environment variables
Interact with Windows automation objects
Launch authorized lab applications

35. The Bigger Cybersecurity Lesson

The most important thing you can learn from these experiments isn’t BAT syntax.

It’s this:

Windows is programmable.

A graphical interface is only one way of interacting with Windows.

Underneath it are:

Command shells
Scripting engines
APIs
Registry
Services
Processes
Scheduled tasks
Event logs
Security tokens
Network components

Once you understand those pieces, Windows becomes much easier to investigate.

And that’s exactly what cybersecurity professionals need to understand.

36. The Hacker Mindset Without the Malware

You don’t need to write malware to learn how attackers think.

Ask questions like:

What does this command actually do?
What permissions does it require?
What process executes it?
What parent process launched it?
What Registry keys does it interact with?
What files does it access?
What network connections does it create?
What would this look like in an EDR?
What evidence would it leave behind?

Those questions turn a simple Windows command into a cybersecurity exercise.

37. A Simple Challenge for You

Try building this yourself.

Create:

cyberlab.bat

Your script should display:

================================
        CYBER LAB
================================
[1] Username
[2] Hostname
[3] Windows Version
[4] IP Address
[5] Running Processes
[6] Network Connections
[7] Registry Information
[8] Save Full Report
[9] Exit

Then implement each option.

Once you’ve completed that, you’ve created your first Windows reconnaissance framework.

From there, you can move into:

PowerShell
WMI
Windows Event Logs
Sysinternals
Windows APIs
Active Directory
Defensive scripting
Malware analysis
Digital forensics

That’s where Windows security becomes seriously interesting.

Windows BAT / VBS / Registry Cheat Sheet

🚨 The Most Important Security Rule

If you remember only one thing from this article, remember this:

Never execute a script just because someone tells you it is harmless.

This includes:

.bat
.cmd
.vbs
.vbe
.js
.ps1
.reg
.hta

A file extension isn’t a safety guarantee.

If you don’t understand what a script does:

Don’t run it on your primary computer.

Inspect it first.

Use a VM when experimenting.

And keep backups.

Final Thoughts

Windows is much more interesting than it looks.

Behind the desktop are dozens of technologies that can be controlled through commands and scripts.

With just:

BAT
CMD
VBS
Registry

you can learn the fundamentals of:

• Windows automation
• System enumeration
• Process analysis
• Network investigation
• Registry analysis
• Scripting
• Privilege concepts
• Security monitoring
• Living-off-the-land techniques
• Incident response

And you don’t need to start with complicated hacking frameworks.

Start with the operating system itself.

Understand what Windows is doing.

Understand why it is doing it.

Understand what evidence it leaves behind.

Then learn how attackers abuse those same capabilities—and, more importantly, how defenders detect and stop them.

Because the best Windows security researchers don’t just know how to run commands.

They know:

What those commands mean.

Think Like an Attacker. Secure Like a Pro.