# Windows User and Group Enumeration

> Techniques for enumerating local and domain users, groups, and memberships on Windows systems using built-in tools and commands.

- **URL:** https://hackindex.io/platforms/windows/enumeration/windows-user-and-group-enumeration
- **Path:** Windows > Enumeration
- **Up:** [Enumeration](https://hackindex.io/platforms/windows/enumeration.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

User and group enumeration maps the access control landscape on the target. In domain environments, this extends to all users and groups across the domain. Focus on:

- Local admin group members (who can escalate on this host)
- Domain admin and high-privilege group memberships
- Current token privileges (impersonation, backup, restore)
- Password policy settings (lockout threshold, complexity requirements)

These details reveal which accounts are viable targets for credential attacks or lateral movement.

## Local users and groups

**Local user enumeration**

```powershell
# All local users
net user
Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordLastSet, PasswordNeverExpires

# Details on specific user
net user $USER
Get-LocalUser -Name $USER | Select-Object *

# Currently logged in users
query user
qwinsta

# Current user context
whoami
whoami /all
whoami /priv
```

**Local group enumeration**

```powershell
# All local groups
net localgroup
Get-LocalGroup

# High-value group memberships
net localgroup Administrators
net localgroup "Remote Desktop Users"
net localgroup "Remote Management Users"
net localgroup "Backup Operators"

# PowerShell
Get-LocalGroupMember -Group 'Administrators'
Get-LocalGroupMember -Group 'Remote Desktop Users'
```

## Domain users and groups

These commands require domain connectivity and run in the context of the current domain-joined user. No additional tools needed beyond what is built into Windows.

**Domain user enumeration**

```powershell
# All domain users
net user /domain

# Details on specific domain user
net user $USER /domain

# Domain admins
net group "Domain Admins" /domain

# Enterprise Admins
net group "Enterprise Admins" /domain

# All domain groups
net group /domain

# PowerShell with ADSI (no RSAT needed)
([adsisearcher]"objectCategory=person").FindAll() | ForEach-Object { $_.Properties['samaccountname'] }

# Find users with no pre-auth required (ASREPRoasting candidates)
([adsisearcher]"(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=4194304))").FindAll() | ForEach-Object { $_.Properties['samaccountname'] }
```

**Domain group enumeration**

```powershell
# All domain groups
net group /domain

# Privileged groups
net group "Domain Admins" /domain
net group "Schema Admins" /domain
net group "Group Policy Creator Owners" /domain
net group "DnsAdmins" /domain

# Find groups with admin-like names
([adsisearcher]"objectCategory=group").FindAll() | ForEach-Object { $_.Properties['cn'] } | Select-String -Pattern 'admin|operator|helpdesk|it|support' -CaseSensitive:$false
```

## Token privileges

Dangerous token privileges give direct escalation paths regardless of group membership. Check these before anything else.

**Token privilege enumeration**

```powershell
whoami /priv

# Filter for dangerous privileges
whoami /priv | findstr /i "SeImpersonate SeBackup SeRestore SeDebug SeTakeOwnership SeAssignPrimaryToken SeLoadDriver"
# Privilege Name                Description                               State
# ============================= ========================================= ========
# SeImpersonatePrivilege        Impersonate a client after authentication Enabled
# SeBackupPrivilege             Back up files and directories             Disabled
```

Disabled privileges can still be enabled programmatically: a `Disabled` state does not mean the privilege is unavailable. If `SeImpersonatePrivilege` is present in any state, escalation to SYSTEM is likely possible. See [Token Impersonation](https://hackindex.io/platforms/windows/privilege-escalation/token-impersonation-seimpersonateprivilege-exploitation).

## Password policy

The password policy tells you whether brute force or spraying is viable without risking account lockouts.

**Password and lockout policy**

```powershell
# Local policy
net accounts

# Domain policy
net accounts /domain

# Fine-grained password policies (AD)
([adsisearcher]"objectClass=msDS-PasswordSettings").FindAll()
# Lockout threshold:                            5
# Lockout duration (minutes):                   30
# Lockout observation window (minutes):         30
```