List and Compare¶
An attacker with a valid account doesn't need an exploit. Before you change anything, find out exactly who has one and compare that to the README.
Get the README's lists¶
Open the README and write down, on paper or in Notepad:
- Every authorized user
- Which of them are administrators
- Any groups the README mentions
List what's on the machine¶
net user
User accounts for \\WORKSTATION
-------------------------------------------------------------------------------
Administrator alice bob
Guest hacker svc_backup
WDAGUtilityAccount
The command completed successfully.
WDAGUtilityAccount and DefaultAccount are built-in Windows accounts and are normal. Administrator and Guest are built in too; a later page covers them.
PowerShell shows more per account:
Get-LocalUser | Select Name, Enabled, PasswordRequired, PasswordExpires, LastLogon
Name Enabled PasswordRequired PasswordExpires LastLogon
---- ------- ---------------- --------------- ---------
Administrator False True
alice True True 12/1/2026 10:15 9/2/2026 8:03
bob True False 8/30/2026 14:22
Guest False False
hacker True True 9/1/2026 23:47
svc_backup True True
Two things already stand out: bob has no password required, and hacker isn't in the README.
List the groups that matter¶
net localgroup Administrators
net localgroup "Remote Desktop Users"
net localgroup "Backup Operators"
Alias name Administrators
Members
-------------------------------------------------------------------------------
Administrator
alice
bob
hacker
Build three lists¶
From the comparison, write down:
- Accounts to remove: on the machine, not in the README. Here:
hacker, andsvc_backupunless the README mentions a backup service. - Accounts to create: in the README, not on the machine.
- Group fixes: in a privileged group but not supposed to be. Here:
bobin Administrators if the README says he's a standard user.
The next four pages work through those lists.
Save the before picture¶
net user > C:\before-users.txt
net localgroup Administrators > C:\before-admins.txt