Overview
The LocalGroups command enumerates local group memberships on the system. By default, it shows only non-empty groups, but the-full flag displays all local groups. This is crucial for understanding privilege levels and access controls.
Syntax
Remote Execution
Output
Returns local group information:- Group name
- Group members (users and groups)
- Member types (local, domain)
- SID information
Use Cases
- Red Team
- Blue Team
- Identify privileged users (Administrators, Remote Desktop Users)
- Find domain users in local admin groups
- Discover service accounts
- Plan privilege escalation paths
- Identify lateral movement targets
Example Output
Remote Execution
This command supports remote execution using the
-computername parameter.Detection Considerations
- API Calls: Uses NetLocalGroupEnum/NetLocalGroupGetMembers
- WMI Activity: Remote execution generates WMI events
- Network Traffic: Remote queries over SMB/RPC
- Event Logs: May trigger 4799 (local group membership enumerated)
Related Commands
- LocalUsers - Local user accounts
- LogonSessions - Active logon sessions
- TokenGroups - Current token groups
- UserRightAssignments - User rights