hi guys,
I'm trying to identify whether a user a/c is a member of the local admins group? where is this info stored?
i'm hunting around in
–HKLM\SAM\SAM\Domains\Account\Users
–HKLM\Software\Microsoft\WindowsNT\CurrentVersion\ProfileList
but have had no joy thus far.
Thanks in advance
Information about group membership is maintained in the SAM\SAM\Domains\Builtin\Aliases key. Each of the RID subkeys beneath the Aliases key has a C value that is a binary data type and needs to be parsed to determine which users are members of the group. Messieurs Carvey and Schuster have covered this beautifully in their blogs, and there you should find everything you need
http//
http//
You'll need to elevate to SYSTEM privileges in order to take this info down from a running system.