Windows is a multi-user operating system.
Multiple users may exist on the same system simultaneously.
Examples:
- Alice
- Bob
- Administrator
- SYSTEM
Each user possesses their own:
- Identity
- Files
- Settings
- Permissions
Windows uses users and groups to determine who can access resources and perform actions.
Why This Matters
Nearly every security decision within Windows ultimately involves an identity.
Examples:
- Logging in
- Reading files
- Installing software
- Starting services
- Accessing shares
- Running scheduled tasks
- Accessing Active Directory
Users
A user represents an identity recognized by Windows.
Examples:
Alice
Bob
Administrator
Users may be:
- Human users
- Service accounts
- Built-in accounts
Conceptually:
User
↓
Logs In
↓
Receives Access
Built-in Accounts
Windows includes several built-in accounts.
Common examples:
| Account | Purpose |
|---|---|
| Administrator | Administrative account |
| Guest | Restricted account |
| SYSTEM | Operating system account |
Example:
NT AUTHORITY\SYSTEM
This account is heavily used internally by Windows.
Many services execute as SYSTEM.
This account is also the highest level of authority in the OS.
User Profiles
Each user typically receives a profile directory.
Examples:
C:\Users\Alice
C:\Users\Bob
C:\Users\Administrator
These directories commonly contain:
- Desktop
- Documents
- Downloads
- Pictures
- AppData
User profiles often become important during investigations.
Groups
Managing permissions individually becomes difficult as the number of users grows.
Windows therefore uses groups.
Conceptually:
Users
↓
Groups
↓
Permissions
Example:
Alice
Bob
Charlie
↓
Administrators
Instead of assigning permissions three times, permissions can be assigned once to the group.
Common Groups
Windows includes many built-in groups.
Examples:
| Group | Purpose |
|---|---|
| Administrators | Full administrative control |
| Users | Standard users |
| Remote Desktop Users | RDP access |
| Backup Operators | Backup operations |
| Event Log Readers | Read event logs |
Most systems contain additional groups created by administrators or software.
Local Users and Groups
Windows systems maintain local users and groups.
Examples:
Local User
↓
Exists only on this computer
Local Group
↓
Exists only on this computer
Examples:
PC01\Alice
PC01\Bob
These identities are managed independently of other systems.
Domain Users and Groups
In enterprise environments, identities are commonly managed centrally through Active Directory.
Examples:
CORP\Alice
CORP\Bob
These accounts exist within the domain rather than on a single computer.
Conceptually:
Domain Controller
↓
Creates User
↓
User Can Access Multiple Systems
Active Directory will be explored later.
Group Membership
A user may belong to multiple groups simultaneously.
Example:
Alice
├─ Users
├─ Remote Desktop Users
└─ Backup Operators
Windows combines permissions from all group memberships.
This is one reason why group membership is frequently examined during investigations.
Viewing Users
Common commands:
Command Prompt:
net user
PowerShell:
Get-LocalUser
Examples:
Administrator
DefaultAccount
Guest
Alice
Viewing Groups
Command Prompt:
net localgroup
PowerShell:
Get-LocalGroup
Examples:
Administrators
Users
Remote Desktop Users
Viewing Group Membership
Command Prompt:
net localgroup Administrators
PowerShell:
Get-LocalGroupMember Administrators
Example:
Administrator
Alice
Operator Perspective
When approaching an unfamiliar Windows system, Operators typically ask:
Users
- What users exist?
- Which users are active?
- Which users appear unusual?
Groups
- What groups exist?
- What groups have elevated access?
Membership
- Who belongs to Administrators?
- Who can access the system remotely?
- Who can manage backups?
Enterprise
- Is this a local account?
- Is this a domain account?
Security
- Are unnecessary administrators present?
- Are privileged groups overly populated?
- Are service accounts being used appropriately?
Understanding users and groups provides the foundation for understanding access control.
Key Takeaways
- Users represent identities recognized by Windows.
- Groups simplify permission management.
- Windows includes several built-in accounts.
- Windows includes several built-in groups.
- A user may belong to multiple groups.
- User profiles store personal data and settings.
- Local accounts exist only on a single system.
- Domain accounts can access multiple systems.
- Group membership directly affects access and permissions.
- Understanding users and groups is foundational for both offensive and defensive operations.
The next lesson explores Privileges & Integrity Levels and how Windows determines what an identity is allowed to do.