is this user accoun...
 
Notifications
Clear all

is this user account a member of local administrators?

3 Posts
2 Users
0 Reactions
960 Views
(@ashley_thorn)
New Member
Joined: 17 years ago
Posts: 4
Topic starter  

hi guys,

I'm trying to identify whether a user a/c is a member of the local admins group? where is this info stored?

i'm hunting around in

–HKLM\SAM\SAM\Domains\Account\Users

–HKLM\Software\Microsoft\WindowsNT\CurrentVersion\ProfileList

but have had no joy thus far.

Thanks in advance


   
Quote
nybella
(@nybella)
Active Member
Joined: 16 years ago
Posts: 6
 

Information about group membership is maintained in the SAM\SAM\Domains\Builtin\Aliases key. Each of the RID subkeys beneath the Aliases key has a C value that is a binary data type and needs to be parsed to determine which users are members of the group. Messieurs Carvey and Schuster have covered this beautifully in their blogs, and there you should find everything you need

http//windowsir.blogspot.com/2006/02/determining-group-membership-from.html

http//computer.forensikblog.de/en/2006/02/list_members_of_a_windows_group.html


   
ReplyQuote
nybella
(@nybella)
Active Member
Joined: 16 years ago
Posts: 6
 

You'll need to elevate to SYSTEM privileges in order to take this info down from a running system.


   
ReplyQuote
Share: