Enumerating Users & Groups (Windows)
Classification: Host & Network Penetration Testing / Post-Exploitation
Target: Windows host (Meterpreter via Rejetto HFS)
1. Executive Summary
After exploiting Rejetto HFS, we enumerate the Windows host’s users, privileges and groups — identifying the current context, logged-on users, local accounts and privileged-group membership (Administrators, Remote Desktop Users).
2. Foothold & Current User
getuid
getprivs
3. Logged-on Users
run post/windows/gather/enum_logged_on_users
shell
whoami /priv
query user
4. Local Accounts
net user
net user administrator
net user guest
5. Groups
net localgroup
net localgroup Administrators
6. Notes
Membership in Administrators (full control), Remote Desktop Users (RDP logon) and backup/privileged groups directly informs privilege escalation and lateral movement.