> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/priv-esc/windows-privilege-escalation/ab-using-windows-groups.md).

# (Ab)using Windows Groups

## Groups to (ab)use

### [Event Log Readers](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#event-log-readers) <a href="#event-log-readers" id="event-log-readers"></a>

* Can read (all?) event logs from local computers

### [Remote Desktop Users](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#remote-desktop-users) <a href="#remote-desktop-users" id="remote-desktop-users"></a>

* Can access the machine with RDP (e.g. xfreerdp, remmina, mstsc.exe)

### [Remote Management Users](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#remote-management-users) <a href="#remote-management-users" id="remote-management-users"></a>

* Can access the machine with Win RM (e.g. winrs, PS remoting, evil-winrm)

## Resources

Active Directory security groups - Microsoft Learn: <https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups>

Special identity groups - Microsoft Learn: <https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-special-identities-groups>