In the real-world C/S communication architecture, the server is often considered more vital than the client from a security perspective. Many privileged services in Windows also play the role of remote servers whose security is highly prioritized by Microsoft. Many of them have been reviewed and audited by the best security researchers worldwide. So we looked at these services and asked ourselves: what else has been overlooked? Five months ago, after discovering an RCE vulnerability in the Distributed File System Replication service, a Peer-to-Peer file-sharing component, we realized that there are engaging scenarios where the client is as important (or even more critical) as the server. Nonetheless, we were impressed by how often these client components were used and how fragile they were to potential attacks. In the subsequent months, we conducted extensive research and found more than 10 RCE vulnerabilities confirmed by MSRC in crucial client components such as Performance Monitor, Event Viewer, Routing and Remote Access, Task Scheduler, Services, and Windows Admin Center. In this presentation, we aim to introduce a new approach to massively discovering RCE vulnerabilities in Windows client components. We will begin by discussing the attack surface we found and then move on to explore several important client components. We will analyze important component's architecture, underlying protocols, strategies we adopted to uncover those 0-day bugs and a real-world vulnerability demonstration including attacking C# memory-safety features. Finally, we will share our experience and offer some tips on conducting attack surface analysis for a new client target.