NameAdminCountGroupCategoryGroupScopeManagedBySIDSIDHistoryDescriptionwhenCreatedwhenChangedDistinguishedNameCanonicalName
Administrators1SecurityDomainLocalS-1-5-32-544Administrators have complete and unrestricted access to the computer/domain16/03/2018 5:21:13 PM21/03/2018 4:47:52 PMCN=Administrators,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Administrators
UsersSecurityDomainLocalS-1-5-32-545Users are prevented from making accidental or intentional system-wide changes and can run most applications16/03/2018 5:21:13 PM16/03/2018 5:22:29 PMCN=Users,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Users
GuestsSecurityDomainLocalS-1-5-32-546Guests have the same access as members of the Users group by default, except for the Guest account which is further restricted16/03/2018 5:21:13 PM16/03/2018 5:22:29 PMCN=Guests,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Guests
Print Operators1SecurityDomainLocalS-1-5-32-550Members can administer printers installed on domain controllers16/03/2018 5:21:13 PM21/03/2018 4:47:52 PMCN=Print Operators,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Print Operators
Backup Operators1SecurityDomainLocalS-1-5-32-551Backup Operators can override security restrictions for the sole purpose of backing up or restoring files16/03/2018 5:21:13 PM21/03/2018 4:47:52 PMCN=Backup Operators,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Backup Operators
Replicator1SecurityDomainLocalS-1-5-32-552Supports file replication in a domain16/03/2018 5:21:13 PM16/03/2018 5:37:40 PMCN=Replicator,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Replicator
Remote Desktop UsersSecurityDomainLocalS-1-5-32-555Members in this group are granted the right to logon remotely16/03/2018 5:21:13 PM16/03/2018 5:21:13 PMCN=Remote Desktop Users,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Remote Desktop Users
Network Configuration OperatorsSecurityDomainLocalS-1-5-32-556Members in this group can have some administrative privileges to manage configuration of networking features16/03/2018 5:21:13 PM21/03/2018 4:47:52 PMCN=Network Configuration Operators,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Network Configuration Operators
Performance Monitor UsersSecurityDomainLocalS-1-5-32-558Members of this group can access performance counter data locally and remotely16/03/2018 5:21:13 PM16/03/2018 5:21:13 PMCN=Performance Monitor Users,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Performance Monitor Users
Performance Log UsersSecurityDomainLocalS-1-5-32-559Members of this group may schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computer16/03/2018 5:21:13 PM16/03/2018 5:21:13 PMCN=Performance Log Users,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Performance Log Users
Distributed COM UsersSecurityDomainLocalS-1-5-32-562Members are allowed to launch, activate and use Distributed COM objects on this machine.16/03/2018 5:21:13 PM16/03/2018 5:21:13 PMCN=Distributed COM Users,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Distributed COM Users
IIS_IUSRSSecurityDomainLocalS-1-5-32-568Built-in group used by Internet Information Services.16/03/2018 5:21:13 PM16/03/2018 5:21:13 PMCN=IIS_IUSRS,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/IIS_IUSRS
Cryptographic OperatorsSecurityDomainLocalS-1-5-32-569Members are authorized to perform cryptographic operations.16/03/2018 5:21:13 PM21/03/2018 4:47:52 PMCN=Cryptographic Operators,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Cryptographic Operators
Event Log ReadersSecurityDomainLocalS-1-5-32-573Members of this group can read event logs from local machine16/03/2018 5:21:13 PM13/07/2018 2:23:59 PMCN=Event Log Readers,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Event Log Readers
Certificate Service DCOM AccessSecurityDomainLocalS-1-5-32-574Members of this group are allowed to connect to Certification Authorities in the enterprise16/03/2018 5:21:13 PM16/03/2018 5:21:13 PMCN=Certificate Service DCOM Access,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Certificate Service DCOM Access
RDS Remote Access ServersSecurityDomainLocalS-1-5-32-575Servers in this group enable users of RemoteApp programs and personal virtual desktops access to these resources. In Internet-facing deployments, these servers are typically deployed in an edge network. This group needs to be populated on servers running RD Connection Broker. RD Gateway servers and RD Web Access servers used in the deployment need to be in this group.16/03/2018 5:21:13 PM16/03/2018 5:21:13 PMCN=RDS Remote Access Servers,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/RDS Remote Access Servers
RDS Endpoint ServersSecurityDomainLocalS-1-5-32-576Servers in this group run virtual machines and host sessions where users RemoteApp programs and personal virtual desktops run. This group needs to be populated on servers running RD Connection Broker. RD Session Host servers and RD Virtualization Host servers used in the deployment need to be in this group.16/03/2018 5:21:13 PM16/03/2018 5:21:13 PMCN=RDS Endpoint Servers,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/RDS Endpoint Servers
RDS Management ServersSecurityDomainLocalS-1-5-32-577Servers in this group can perform routine administrative actions on servers running Remote Desktop Services. This group needs to be populated on all servers in a Remote Desktop Services deployment. The servers running the RDS Central Management service must be included in this group.16/03/2018 5:21:13 PM16/03/2018 5:21:13 PMCN=RDS Management Servers,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/RDS Management Servers
Hyper-V AdministratorsSecurityDomainLocalS-1-5-32-578Members of this group have complete and unrestricted access to all features of Hyper-V.16/03/2018 5:21:13 PM16/03/2018 5:21:13 PMCN=Hyper-V Administrators,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Hyper-V Administrators
Access Control Assistance OperatorsSecurityDomainLocalS-1-5-32-579Members of this group can remotely query authorization attributes and permissions for resources on this computer.16/03/2018 5:21:13 PM16/03/2018 5:21:13 PMCN=Access Control Assistance Operators,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Access Control Assistance Operators
Remote Management UsersSecurityDomainLocalS-1-5-32-580Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user.16/03/2018 5:21:13 PM16/03/2018 5:21:13 PMCN=Remote Management Users,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Remote Management Users
System Managed Accounts GroupSecurityDomainLocalS-1-5-32-581Members of this group are managed by the system.16/03/2018 5:21:13 PM16/03/2018 5:21:13 PMCN=System Managed Accounts Group,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/System Managed Accounts Group
Storage Replica AdministratorsSecurityDomainLocalS-1-5-32-582Members of this group have complete and unrestricted access to all features of Storage Replica.16/03/2018 5:21:13 PM16/03/2018 5:21:13 PMCN=Storage Replica Administrators,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Storage Replica Administrators
Domain ComputersSecurityGlobalS-1-5-21-2872888145-3513486857-3924934394-515All workstations and servers joined to the domain16/03/2018 5:22:29 PM16/03/2018 5:22:29 PMCN=Domain Computers,CN=Users,DC=sos,DC=labssos.labs/Users/Domain Computers
Domain Controllers1SecurityGlobalS-1-5-21-2872888145-3513486857-3924934394-516All domain controllers in the domain16/03/2018 5:22:29 PM16/03/2018 5:37:40 PMCN=Domain Controllers,CN=Users,DC=sos,DC=labssos.labs/Users/Domain Controllers
Schema Admins1SecurityUniversalS-1-5-21-2872888145-3513486857-3924934394-518Designated administrators of the schema16/03/2018 5:22:29 PM21/03/2018 4:47:52 PMCN=Schema Admins,CN=Users,DC=sos,DC=labssos.labs/Users/Schema Admins
Enterprise Admins1SecurityUniversalS-1-5-21-2872888145-3513486857-3924934394-519Designated administrators of the enterprise16/03/2018 5:22:29 PM21/03/2018 4:47:52 PMCN=Enterprise Admins,CN=Users,DC=sos,DC=labssos.labs/Users/Enterprise Admins
Cert PublishersSecurityDomainLocalS-1-5-21-2872888145-3513486857-3924934394-517Members of this group are permitted to publish certificates to the directory16/03/2018 5:22:29 PM21/03/2018 4:47:52 PMCN=Cert Publishers,CN=Users,DC=sos,DC=labssos.labs/Users/Cert Publishers
Domain Admins1SecurityGlobalS-1-5-21-2872888145-3513486857-3924934394-512Designated administrators of the domain16/03/2018 5:22:29 PM21/03/2018 4:47:58 PMCN=Domain Admins,CN=Users,DC=sos,DC=labssos.labs/Users/Domain Admins
Domain UsersSecurityGlobalS-1-5-21-2872888145-3513486857-3924934394-513All domain users16/03/2018 5:22:29 PM21/03/2018 4:47:58 PMCN=Domain Users,CN=Users,DC=sos,DC=labssos.labs/Users/Domain Users
Domain GuestsSecurityGlobalS-1-5-21-2872888145-3513486857-3924934394-514All domain guests16/03/2018 5:22:29 PM16/03/2018 5:22:29 PMCN=Domain Guests,CN=Users,DC=sos,DC=labssos.labs/Users/Domain Guests
Group Policy Creator OwnersSecurityGlobalS-1-5-21-2872888145-3513486857-3924934394-520Members in this group can modify group policy for the domain16/03/2018 5:22:29 PM16/03/2018 5:22:29 PMCN=Group Policy Creator Owners,CN=Users,DC=sos,DC=labssos.labs/Users/Group Policy Creator Owners
RAS and IAS ServersSecurityDomainLocalS-1-5-21-2872888145-3513486857-3924934394-553Servers in this group can access remote access properties of users16/03/2018 5:22:29 PM16/03/2018 5:22:29 PMCN=RAS and IAS Servers,CN=Users,DC=sos,DC=labssos.labs/Users/RAS and IAS Servers
Server Operators1SecurityDomainLocalS-1-5-32-549Members can administer domain servers16/03/2018 5:22:29 PM21/03/2018 4:47:52 PMCN=Server Operators,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Server Operators
Account Operators1SecurityDomainLocalS-1-5-32-548Members can administer domain user and group accounts16/03/2018 5:22:29 PM21/03/2018 4:47:52 PMCN=Account Operators,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Account Operators
Pre-Windows 2000 Compatible AccessSecurityDomainLocalS-1-5-32-554A backward compatibility group which allows read access on all users and groups in the domain16/03/2018 5:22:29 PM16/03/2018 5:22:29 PMCN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Pre-Windows 2000 Compatible Access
Incoming Forest Trust BuildersSecurityDomainLocalS-1-5-32-557Members of this group can create incoming, one-way trusts to this forest16/03/2018 5:22:29 PM21/03/2018 4:47:52 PMCN=Incoming Forest Trust Builders,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Incoming Forest Trust Builders
Windows Authorization Access GroupSecurityDomainLocalS-1-5-32-560Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects16/03/2018 5:22:29 PM16/03/2018 5:22:29 PMCN=Windows Authorization Access Group,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Windows Authorization Access Group
Terminal Server License ServersSecurityDomainLocalS-1-5-32-561Members of this group can update user accounts in Active Directory with information about license issuance, for the purpose of tracking and reporting TS Per User CAL usage16/03/2018 5:22:29 PM16/03/2018 5:22:29 PMCN=Terminal Server License Servers,CN=Builtin,DC=sos,DC=labssos.labs/Builtin/Terminal Server License Servers
Allowed RODC Password Replication GroupSecurityDomainLocalS-1-5-21-2872888145-3513486857-3924934394-571Members in this group can have their passwords replicated to all read-only domain controllers in the domain16/03/2018 5:22:29 PM16/03/2018 5:22:29 PMCN=Allowed RODC Password Replication Group,CN=Users,DC=sos,DC=labssos.labs/Users/Allowed RODC Password Replication Group
Denied RODC Password Replication GroupSecurityDomainLocalS-1-5-21-2872888145-3513486857-3924934394-572Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain16/03/2018 5:22:29 PM16/03/2018 5:22:29 PMCN=Denied RODC Password Replication Group,CN=Users,DC=sos,DC=labssos.labs/Users/Denied RODC Password Replication Group
Read-only Domain Controllers1SecurityGlobalS-1-5-21-2872888145-3513486857-3924934394-521Members of this group are Read-Only Domain Controllers in the domain16/03/2018 5:22:29 PM16/03/2018 5:37:40 PMCN=Read-only Domain Controllers,CN=Users,DC=sos,DC=labssos.labs/Users/Read-only Domain Controllers
Enterprise Read-only Domain ControllersSecurityUniversalS-1-5-21-2872888145-3513486857-3924934394-498Members of this group are Read-Only Domain Controllers in the enterprise16/03/2018 5:22:29 PM16/03/2018 5:22:29 PMCN=Enterprise Read-only Domain Controllers,CN=Users,DC=sos,DC=labssos.labs/Users/Enterprise Read-only Domain Controllers
Cloneable Domain ControllersSecurityGlobalS-1-5-21-2872888145-3513486857-3924934394-522Members of this group that are domain controllers may be cloned.16/03/2018 5:22:29 PM16/03/2018 5:22:29 PMCN=Cloneable Domain Controllers,CN=Users,DC=sos,DC=labssos.labs/Users/Cloneable Domain Controllers
Protected UsersSecurityGlobalS-1-5-21-2872888145-3513486857-3924934394-525Members of this group are afforded additional protections against authentication security threats. See http://go.microsoft.com/fwlink/?LinkId=298939 for more information.16/03/2018 5:22:29 PM16/03/2018 5:22:29 PMCN=Protected Users,CN=Users,DC=sos,DC=labssos.labs/Users/Protected Users
Key AdminsSecurityGlobalS-1-5-21-2872888145-3513486857-3924934394-526Members of this group can perform administrative actions on key objects within the domain.16/03/2018 5:22:29 PM16/03/2018 5:22:29 PMCN=Key Admins,CN=Users,DC=sos,DC=labssos.labs/Users/Key Admins
Enterprise Key AdminsSecurityUniversalS-1-5-21-2872888145-3513486857-3924934394-527Members of this group can perform administrative actions on key objects within the forest.16/03/2018 5:22:29 PM21/03/2018 4:47:52 PMCN=Enterprise Key Admins,CN=Users,DC=sos,DC=labssos.labs/Users/Enterprise Key Admins
DnsAdminsSecurityDomainLocalS-1-5-21-2872888145-3513486857-3924934394-1101DNS Administrators Group16/03/2018 5:23:09 PM21/03/2018 4:47:52 PMCN=DnsAdmins,CN=Users,DC=sos,DC=labssos.labs/Users/DnsAdmins
DnsUpdateProxySecurityGlobalS-1-5-21-2872888145-3513486857-3924934394-1102DNS clients who are permitted to perform dynamic updates on behalf of some other clients (such as DHCP servers).16/03/2018 5:23:09 PM16/03/2018 5:23:09 PMCN=DnsUpdateProxy,CN=Users,DC=sos,DC=labssos.labs/Users/DnsUpdateProxy
DHCP UsersSecurityDomainLocalS-1-5-21-2872888145-3513486857-3924934394-1106Members who have view-only access to the DHCP service18/03/2018 5:15:31 PM18/03/2018 5:15:31 PMCN=DHCP Users,CN=Users,DC=sos,DC=labssos.labs/Users/DHCP Users
DHCP AdministratorsSecurityDomainLocalS-1-5-21-2872888145-3513486857-3924934394-1107Members who have administrative access to the DHCP Service18/03/2018 5:15:31 PM18/03/2018 5:15:31 PMCN=DHCP Administrators,CN=Users,DC=sos,DC=labssos.labs/Users/DHCP Administrators
Workstation AdminsSecurityGlobalS-1-5-21-2872888145-3513486857-3924934394-1119S-1-5-21-2872888145-3513486857-3924934394-51221/03/2018 4:37:54 PM17/07/2018 1:10:33 PMCN=Workstation Admins,OU=Lab Users,DC=sos,DC=labssos.labs/Lab Users/Workstation Admins
Microsoft Advanced Threat Analytics AdministratorsSecurityDomainLocalS-1-5-21-2872888145-3513486857-3924934394-1129Microsoft Advanced Threat Analytics Administrators11/07/2018 8:17:26 PM11/07/2018 8:17:26 PMCN=Microsoft Advanced Threat Analytics Administrators,CN=Users,DC=sos,DC=labssos.labs/Users/Microsoft Advanced Threat Analytics Administrators
Microsoft Advanced Threat Analytics UsersSecurityDomainLocalS-1-5-21-2872888145-3513486857-3924934394-1130Microsoft Advanced Threat Analytics Users11/07/2018 8:17:26 PM11/07/2018 8:17:26 PMCN=Microsoft Advanced Threat Analytics Users,CN=Users,DC=sos,DC=labssos.labs/Users/Microsoft Advanced Threat Analytics Users
Microsoft Advanced Threat Analytics ViewersSecurityDomainLocalS-1-5-21-2872888145-3513486857-3924934394-1131Microsoft Advanced Threat Analytics Viewers11/07/2018 8:17:26 PM11/07/2018 8:17:26 PMCN=Microsoft Advanced Threat Analytics Viewers,CN=Users,DC=sos,DC=labssos.labs/Users/Microsoft Advanced Threat Analytics Viewers
TestSecurityGlobalS-1-5-21-2872888145-3513486857-3924934394-1132S-1-5-21-2872888145-3513486857-3924934394-512,S-1-5-21-2872888145-3513486857-3924934394-111917/07/2018 1:10:56 PM17/07/2018 1:11:24 PMCN=Test,OU=Lab Users,DC=sos,DC=labssos.labs/Lab Users/Test