windows privesc

For single boxes such as this, my enumeration includes:

    Open network ports
    Running processes (tasklist, for example)
    What programs are installed (on windows, I look for folders directly under : c:\, c:\program files, c:\program files (x86)) .
    Local users (and those who have logged in, which can be inferred by folders in c:\users.

with rdp: 1. to check quick access

For networks, then things like BloodHound, PowerSQLUp, and other tools.
For AD CS - Certipy