Sorry for the confusing question earlier. I have edited it to make it to be more in accordance with the site.
I am conducting a penetration test on a network where they have Windows 2008 R2 for all the servers (File server, DC etc) and Windows 7 for desktops(end users). One thing I have found that they are somewhat behind on patching schedule, but nothing serious so as to get a shell on any important system.
I understand it is difficult to get a shell straight away on these systems, thus I want to know what procedure people follow when testing such secure networks. What should be my methodology to tackle this situation and where should I focus most?