> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/accounts-and-and-groups-in-depth.md). # Accounts && Groups In-Depth ## Groups For more group information see the following links * [How-to: Windows Built-in Users, Default Groups and Special Identities](https://ss64.com/nt/syntax-security_groups.html) * [Active Directory Security Groups](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups) | Group | Description | | ------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Default Administrators | Domain Admins and Enterprise Admins are "super groups" | | [Server Operators](/breakpoint/windows/windows-privilege-escalation/accounts-and-and-groups-in-depth/server-operators.md) | Members can modify services, access SMB shares, and backup files | | [Backup Operators](/breakpoint/windows/windows-privilege-escalation/accounts-and-and-groups-in-depth/backup-operators.md) | Members are allowed onto DCs locally and should be considered Domain Admins as they can make shadow copies of the SAM/NTDS db, read the registry remotely, and access the file system on the DC via SMB. This group is sometimes added to the **local** Backup Operators group on non-DCs. | | Print Operators | Members can log on to DCs locally and "trick" Windows into loading malicious drivers | | Hyper-V Administrators | If there are virtual DCs, any virtualization admins, such as members of Hyper-V Administrators, should be considered Domain Admins | | Account Operators | Members can **modify non-protected** accounts and groups in the domain. | | Remote Desktop Users | Members are not given any useful permissions by default but often are allowed rights such as **Allow Login Through Remote Desktop Services** and can move laterally through RDP | | Remote Management Users | Members can log onto DCs with PSRemoting (group sometimes added to the local remote management group on non-DCs). | | Group Policy Creator Owners | Members can create new GPOs but would need to be delegated additional permissions to link GPOs to a container such as a domain or OU. | | Schema Admins | Members can modify the AD schema structure and backdoor any-to-be-created Group/GPO by adding a compromised account to the default object ACL | | DNS Admins | Members can load a DLL on a DC, but do not have the permissions to restart the DNS server. They can load a malicious DLL and wait for a reboot as a persistence mechanism. Loading a DLL will often result in the service crashing. A more reliable way to exploit this group is to create a [WPAD record](https://web.archive.org/web/20231115070425/https://cube0x0.github.io/Pocing-Beyond-DA/). | | Event Log Readers | Members can read Windows event logs, which may expose process creation, command lines, PowerShell activity, and occasional credentials. | ## AYSK (Accounts You Should Know) #### `NT AUTHORITY\SYSTEM` a.k.a. `LocalSystem` A highly privileged account with more privileges than a local administrator account and is used to run most Windows services. This account doesn't have a password. It's a predefined local account used by the service control manager and is not recognized by the security subsystem. * #### Administrators Group A local account that is a member of the local `Administrators` group will have the same privileges as the built-in `administrator` account. A standard (non-privileged) domain user who is part of the local **`Administrators`** group is good to target. There is also a domain admin (highly privileged account in AD environment) that is part of the local **`Administrators`** group as well. ## Roaming Profiles Roaming profiles store a user's profile data on a central file share instead of only on the local workstation. When the user signs in, Windows pulls that profile from the network and loads it onto the machine. When the user signs out, Windows can sync changes back to the share so the same desktop, files, and application settings follow the user across multiple systems. From an operator perspective, this matters because those profile locations may expose useful data outside the local host. You may find documents, scripts, application configs, saved connections, and other artifacts that reveal credentials, internal paths, or additional systems to target. Roaming profiles also help explain why a user's `HOME DRIVE` or mapped share can be interesting during enumeration. Even if the local machine is locked down, the backing share may still hold sensitive data or be misconfigured. * ### Enumerating Windows Accounts It's incredibly important to understand user accounts, specifically, their privileges, password policy information, and other logged on users we may be able to target. We may find we can browse directories of other users. {% code title="View logged-in users" %} ```batch query user ``` {% endcode %} {% code title="Show current user" %} ```batch echo %USERNAME% ``` {% endcode %} {% code title="List current user privileges" %} ```batch whoami /priv ``` {% endcode %} {% code title="List current user group information" %} ```batch whoami /groups ``` {% endcode %} {% code title="Get all users and groups" %} ```batch net user net localgroup ``` {% endcode %} {% code title="Check details about a group and password policy" %} ```batch net localgroup administrators net accounts ``` {% endcode %}