Skip to content

List and Compare

An attacker with a valid account doesn't need an exploit. Before you change anything, find out exactly who has one and compare that to the README.

Get the README's lists

Open the README and write down, on paper or in Notepad:

  • Every authorized user
  • Which of them are administrators
  • Any groups the README mentions

List what's on the machine

net user

User accounts for \\WORKSTATION

-------------------------------------------------------------------------------
Administrator            alice                    bob
Guest                    hacker                   svc_backup
WDAGUtilityAccount
The command completed successfully.

WDAGUtilityAccount and DefaultAccount are built-in Windows accounts and are normal. Administrator and Guest are built in too; a later page covers them.

PowerShell shows more per account:

Get-LocalUser | Select Name, Enabled, PasswordRequired, PasswordExpires, LastLogon

Name               Enabled PasswordRequired PasswordExpires LastLogon
----               ------- ---------------- --------------- ---------
Administrator        False             True                 
alice                 True             True 12/1/2026 10:15 9/2/2026 8:03
bob                   True            False                 8/30/2026 14:22
Guest                False            False                 
hacker                True             True                 9/1/2026 23:47
svc_backup            True             True

Two things already stand out: bob has no password required, and hacker isn't in the README.

List the groups that matter

net localgroup Administrators
net localgroup "Remote Desktop Users"
net localgroup "Backup Operators"

Alias name     Administrators
Members
-------------------------------------------------------------------------------
Administrator
alice
bob
hacker

Build three lists

From the comparison, write down:

  1. Accounts to remove: on the machine, not in the README. Here: hacker, and svc_backup unless the README mentions a backup service.
  2. Accounts to create: in the README, not on the machine.
  3. Group fixes: in a privileged group but not supposed to be. Here: bob in Administrators if the README says he's a standard user.

The next four pages work through those lists.

Save the before picture

net user > C:\before-users.txt
net localgroup Administrators > C:\before-admins.txt

Try it

  1. Create two extra local accounts on a practice image, one disabled, one with no password required. Run the PowerShell listing and find both in the output.
  2. Write a fake README with three authorized users, then compare it to net user by hand and mark every difference.

Build it

A script that reads a text file of authorized usernames (one per line) and prints every local account that isn't in it, plus every listed user that doesn't exist. Read-only; it reports, you decide.

Next

Groups and What They Grant