SAM Local Group Membership
Who is in each local group, such as Administrators and Remote Desktop Users.
Use it to list who is in Administrators and Remote Desktop Users, and spot an account added to either.
- SAM
- Accounts and RDP
What It Is
A local group is a named list of accounts that Windows gives the same rights, so adding someone to Administrators gives them full control of the machine. The SAM keeps the built-in groups under Builtin\Aliases, one subkey per group, named by its RID, the number that ends the group's SID. Administrators is RID 544 and Remote Desktop Users is RID 555. Each group's C value holds its name, its description and the SIDs of its members.
What It Proves
The listed accounts were members of the group when the hive was saved. A member of Administrators has full control of the machine, and a member of Remote Desktop Users may sign in over Remote Desktop.
What It Does Not Prove
The SAM keeps the current members only, not who added them, though the group key's last write time usually dates the latest change. Domain members appear as SIDs alone, so resolve them against the domain.
Where It Lives
SAM Local Group Membership lives in the SAM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SAM\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you. The C values are packed binary, so each shows the members a parser decodes, with the long middle of each SID cut to three dots.
| Registry Value | What It Tells You |
|---|---|
| Administrators holds the built-in Administrator, alice and CORP\ |
| The Administrators group last changed a minute after support was created, which fits support being added then. Event 4732 in the Security log names who added it. |
| support is the only member of Remote Desktop Users, so it may sign in over Remote Desktop. Check the Remote Desktop Enabled key, then event 4624 with logon type 10 in the Security log. |
How to Read It
Each subkey under Builtin\Aliases is a group RID in hexadecimal, so 00000220 is 544 (Administrators) and 0000022B is 555 (Remote Desktop Users). The C value lists the members' SIDs. Registry Explorer's SAMBuiltin plugin and RegRipper's samparse plugin decode it into the group name, its description and its members. A member SID with the machine's prefix is a local account, and one with the domain's prefix is a domain account or group, such as Domain Admins (RID 512). Compare the members with a clean build. Setup leaves the built-in Administrator and the account made at install, and joining a domain adds Domain Admins.
- When Windows Writes It
- When an account or group is added to or removed from the group.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer (SAMBuiltin), RegRipper (samparse), RECmd
Hunt It
Group membership sits in the SAM hive and is not an event of its own, so parse the hive, or read it with Velociraptor. The Security log records each member added or removed in events 4732 and 4733, with Security Group Management auditing on.
IsLocalAdmin marks a sign-in by a local administrator, so a new name here is a new administrator. It shows sign-ins, not the group itself.
// Accounts signing in with local admin rights on the deviceDeviceLogonEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what SAM Local Group Membership shows.
- SAM User AccountsShows when the new member was created and when it last logged on.
- Remote Desktop EnabledTells whether Remote Desktop Users membership could be used, since Remote Desktop must be on.
- Member Added to a Local Group, Security Event 4732Not in the RegistryNames who added the member and when, which the SAM does not record.
Sources
The facts on this page come from these public pages, which say more on each point.