16.9 Local Administrators

Source: NT resource kit

Client OS: Windows NT

Target OS: Windows NT

Description:  You can use the Local Administrators tool to identify the local administrators on a target system. In order to be successful, the Local Administrators utility requires a null connection to the target server. By enumerating the members of the local administrators group, you can target accounts for password guessing and brute force attempts. Frequently, local administrator accounts do not have account lockout enabled or strong passwords enforced. The Passprop utility can be used to enable remote account lockout on administrator accounts. Even though Passprop only locks out a remote user, most system administrators do not implement it on the servers.

Use:  Use the following command to determine the local administrators' group.

C:\>local administrators \\server_name
EXAMPLE:
C:\tools>local administrators \\SERVER1
SERVER1\Administrator
Domain1\ADMIN
Domain1\Helpdesk

Benefit:  The tool enables you to target local administrator accounts.

Con:  The tool requires NetBIOS to work.