Skip to main content

​
Overview

The OptionalFeatures command enumerates Windows optional features and roles installed on the system via WMI. These features include server roles, administrative tools, and optional Windows components that may affect the system’s attack surface.

​
Syntax

Seatbelt.exe OptionalFeatures

​
Remote Execution

Seatbelt.exe OptionalFeatures -computername=TARGET.domain.com [-username=DOMAIN\user -password=pass]

​
Output

Returns optional feature information:
  • Feature name
  • Installation state (Enabled/Disabled)
  • Feature description

​
Use Cases

  • Red Team
  • Blue Team
  • Identify installed server roles
  • Discover administrative features
  • Find potential attack vectors
  • Determine system purpose (web server, file server, etc.)

​
Example Output

====== OptionalFeatures ======

Name        : IIS-WebServer
State       : Enabled
Description : Web Server (IIS)

Name        : TelnetClient
State       : Disabled
Description : Telnet Client

Name        : SMB1Protocol
State       : Disabled
Description : SMB 1.0/CIFS File Sharing Support

​
Remote Execution

This command supports remote execution using the -computername parameter.

​
Detection Considerations

Low detection risk - queries WMI for feature information.