Enumeration follows scanning and turns open services into named objects: users, shares, groups and service versions. This writeup explains what each enumeration step produces, why the order matters, and how defenders detect it. It is conceptual and defensive in framing, with no target-specific instructions.