Able to see if a Windows User has Admin Rights or not?

[schuetzdentalCB 8]

Hey,

am i able to check in ESET ERA if a System which is controlled by Endpoint Security has a logged in user with adminrights? i know i can grab windows systemlog etc. but i didnt found out where or if its possible to see if a user has local admin rights.

thanks for any idea.

[Cousin Vinny 6]

It is possible but there is no built-in functionality specific to this purpose.

You need to execute a Run Command task on the host(s) you want to check.  Since the Run Command task simply creates a local batch file and then executes it, the output is not returned to ERA and you will need to output the command to a file.

Here's the command you want:

"hostname & net localgroup administrators > \\%HOSTNAME%\%SHARE%\filename.log"

Replace %HOSTNAME% and %SHARE% with your environment or just output the file locally.

Edited February 22, 2018 by Cousin Vinny
spelling

[schuetzdentalCB 8]

thanks. thats a great idea.

unfortunately this is not working. i think the user which is used from eset to run the batch file doesn't have access to the network share. is there any workaround?

best regards

[Cousin Vinny 6]

Sure you don't have to output to a network share, it would just simplify collecting the results had you ran this command on multiple machines.

"hostname & net localgroup administrators > C:\filename.log"

[schuetzdentalCB 8]

but then i can't collect the files over network  - the first one with network path is a good idea but its not working. is eset creating logs which i could check to find out whats happening? ERA tells me the task was successfull but nothing stored in the network path.

 

thanks

[Cousin Vinny 6]

Make sure the share has permission granted to "Domain Computers" group - ESET executes the command as a local system account rather than a domain user.

I did overlook something in my original reply though - it prints the hostname first and then outputs only the 'net' command to file... so the command needs to be modified a little.

Edit: Or you could just simply output the file with the hostname as filename.

net localgroup administrators > \\servername\sharename\%COMPUTERNAME%.log

This way it writes the hostname to file and then appends the net command results to the same file.

I tested this just now from ERA and it works fine.

Edited March 1, 2018 by Cousin Vinny
simplified command

[schuetzdentalCB 8]

perfect!!! thank you very much. adding domain pcs worked.