Which of the following commands or tools would a penetration tester use to enumerate permissions on a local Windows machine in order to determine which user accounts have access to specific directories or files?

• A. Get-Process
• B. Get-Acl
• C. Get-Service
• D. Set-ACL

Answer: (B)

Reading who can access a file or folder on Windows comes from inspecting the Access Control List that defines permissions for users and groups. Get-Acl is the PowerShell cmdlet that fetches that ACL for a given path, exposing the access rules (who, what rights) so you can determine which accounts have access to specific directories or files. For example, you can pull ACLs across a tree with Get-ChildItem -Path C:\Shared -Recurse | Get-Acl and then look at the Access property to see each IdentityReference and its FileSystemRights. Get-Acl can also be used directly on a single item like (Get-Acl "C:\path").Access to inspect its rules.

The other options don’t serve this purpose: Get-Process lists running processes, not permissions; Get-Service lists services and their status; Set-ACL changes permissions rather than enumerating them.