Windows User Groups

Question 1

Name the 3 user account types.

Answer 1

• Administrator, Full Control
• Standard, day to day access
• Guest, Limited access

Question 2

What is a SID?

Answer 2

Its a unique User and Security Identifier, each user has one.

Question 3

What is the SID format?

Answer 3

S-1-5-2-……-…….-……1007
Where:
S = An SID allways begins with this char
1 = Revision number
5 = Identifier Authority (found in every SID)
21 = Sub Authority value
1007 = RID

Question 4

What is RID?

Answer 4

Is means Relative IDentifier. (Written as HEX eg 0x3EA = 1002)
The portion of a SID that uniquely identifies a user or custom group.

Question 5

What RID number do Administrator, User and Guest have?

Answer 5

• Admin has number 500
• Guest has number 501
• Users and Groups begins with 1000 and increment by 1.

Question 6

Name several well know User SID’s.

Answer 6

• S-1-5-18 = Local system
• S-1-5-19 = local service
• S-1-5-20 = network service
• S-1-5-21- xxxx - 500 = local admin
• S-1-5-21- xxxx - 501 = local guest.

Question 7

What means “SAM” ?

Answer 7

SAM stands for “Security Account Manager”.
It contains info about local user accounts:
- usernames
- passwords hashes (with syskey encryption)
- account restrictions

It is stored in C:\Windows\System32\config\SAM

Question 8

Name several well know Group SID’s. And where are they stored in the registry?

Answer 8

• S-1-5-32-544 = Aministrators
• S-1-5-32-545 = Users
• S-1-5-32-546 = Guests
• S-1-5-32-547 = Power Users
• S-1-5-32-551 = Backup Operators
• S-1-5-32-552 = Replicator

HKLM\SAM\SAM\Domains\Builtin\Aliases

Question 9

Where are User Profiles stored in the registry?

Answer 9

They are located in the following location:
HKLM\SOTFWARE\Microsoft\WindowsNT\CurrentVersion\Profilelist

Question 10

Where are all the Users stored in the registry?

Answer 10

They are located in the following location:
HKLM\SAM\SAM\Domains\Account\Users

(It contains all the users of this system)

Question 11

Where is the User Group Memberships stored in the registry?

Answer 11

HKLM\SOTFWARE\Microsoft\WindowsNT\CurrentVersion\GroupPolicy\user_id\GroupMemberShip

Question 12

Where is the Windows ProfileList stored in the registry?

Answer 12

HKLM\SOTFWARE\Microsoft\WindowsNT\CurrentVersion\ProfileList

Question 13

Name the 2 most important Registry hives.

Answer 13

• HKLM\System => C:\Windows\System32\config\System
• HKLM\Software => C:\Windows\System32\config\Software