Groups and What They Grant¶
A standard user can run programs and manage their own files. Every power beyond that comes from a group. So the question "is this account dangerous?" is really "what groups is it in?"
The groups that matter¶
| Group | What membership grants | Who should be in it |
|---|---|---|
| Administrators | Everything: install software, change any setting, read any file, create other admins | Only the administrators the README names |
| Backup Operators | Read and write any file regardless of permissions. Meant for backup software. An attacker in this group can copy the SAM database and crack every password offline. | Nobody, unless the README names a backup account |
| Remote Desktop Users | Log in over RDP | Only if the README requires RDP, and only the people it names |
| Remote Management Users | Manage the machine through PowerShell remoting | Nobody on a workstation |
| Hyper-V Administrators | Full control of virtual machines on the host | Nobody unless the machine runs Hyper-V |
| Power Users | Legacy; nearly the same as Users now | Nobody |
| Users | Standard access | Everyone authorized |
| Guests | Minimal access | Nobody |
On a Server 2022 domain controller, add Domain Admins, Enterprise Admins, Schema Admins, Account Operators, and Server Operators. See Active Directory.
Administrators don't browse¶
A STIG rule with no setting behind it: administrator accounts must not be used for web browsing or email. If an admin's browser is exploited, the attacker has admin. Each administrator should have a separate standard account for daily work. On an image, an administrator account with a browser profile full of history is worth noting in your findings.
See every group's members at once¶
Get-LocalGroup | ForEach-Object { "== $($_.Name)"; Get-LocalGroupMember $_.Name | Select -Expand Name }
Skim the output for names in groups where they don't belong.
Remove someone from a group¶
They keep their account and lose the power.
net localgroup Administrators bob /delete
net localgroup "Backup Operators" svc_backup /delete
net localgroup "Remote Desktop Users" hacker /delete
lusrmgr.msc → Groups → double-click the group → select the name → Remove → OK.
Add someone to a group¶
Only when the README says they should be there.
net localgroup Administrators alice /add
Example¶
The README says: "alice and carol are the IT administrators. Everyone else is a standard user." The Administrators group contains Administrator, alice, bob, hacker.
bob: remove from Administrators. He stays a user.hacker: remove from Administrators, then delete the account (next page).carol: not in the group. Add her.Administrator: built in; handled on the built-in accounts page.
Verify¶
net localgroup Administrators
Only the README's administrators (plus the built-in Administrator, if you're keeping it) should be listed.