cn,"default_container",description,"direct_user_rights","group_scope","inherited_user_rights","obj_type","special_note","type_flag"
"access control assistance operators","Built-in container","Members of this group can remotely query authorization attributes and permissions for resources on this computer.",None,"Domain-local","Access this computer from the network; Add workstations to domain;Bypass traverse checking:Increase a process working set)",group,"Active Directory in Windows Server 2012","built-in"
"account operators","Built-in container","Members can administer domain user and group accounts.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set;Built-in account for administering the domain.",group,NA,"built-in"
administrators,"Built-in container","Administrators have complete and unrestricted access to the domain.","Access this computer from the network;Adjust memory quotas for a process;Allow log on locally;Allow log on through Remote Desktop Services;Back up files and directories;Bypass traverse checking;Change the system time;Change the time zone;Create a pagefile;Create global objects;Create symbolic links;Debug programs;Enable computer and user accounts to be trusted for delegation;Force shutdown from a remote system;Impersonate a client after authentication;Increase scheduling priority;Load and unload device drivers;Log on as a batch job;Manage auditing and security log;Modify firmware environment values;Perform volume maintenance tasks;Profile single process;Profile system performance;Remove computer from docking station;Restore files and directories;Shut down the system;Take ownership of files or other objects","Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"allowed rodc password replication group","Users container","Members in this group can have their passwords replicated to all read-only domain controllers in the domain.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"backup operators","Built-in container","Backup Operators can override security restrictions for the sole purpose of backing up or restoring files.","Allow log on locally;Back up files and directories;Log on as a batch job;Restore files and directories;Shut down the system","Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set)",group,NA,"built-in"
"cert publishers","Users container","Members of this group are permitted to publish certificates to the directory.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"certificate service dcom access","Built-in container","If Certificate Services is installed on a domain controller (not recommended), this group grants DCOM enrollment access to Domain Users and Domain Computers.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"cloneable domain controllers","Users container","Members of this group that are domain controllers may be cloned.,",None,Global,"Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,"AD DS in Windows Server 2012AD DS","built-in"
"cryptographic operators","Built-in container","Members are authorized to perform cryptographic operations.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"dhcp administrators","Users container","Members of this group have administrative access to the DHCP Server service.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"dhcp users","Users container","Members of this group have view-only access to the DHCP Server service.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"debugger users",NA,"The presence of a Debugger Users group indicates that debugging tools have been installed on the system at some point, whether via Visual Studio, SQL, Office, or other applications that require and support a debugging environment. This group allows remote debugging access to computers. When this group exists at the domain level, it indicates that a debugger or an application that contains a debugger has been installed on a domain controller.",None,NA,None,group,"This is neither a default nor a built-in group, but when present in AD DS, is cause for further investigation.","potential_security"
"denied rodc password replication group","Users container","Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"distributed com users","Built-in container","Members of this group are allowed to launch, activate, and use distributed COM objects on this computer.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
dnsadmins,"Users container","Members of this group have administrative access to the DNS Server service.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
dnsupdateproxy,"Users container","Members of this group are DNS clients who are permitted to perform dynamic updates on behalf of clients that cannot themselves perform dynamic updates. Members of this group are typically DHCP servers.",None,Global,"Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"domain admins","Users container","Designated administrators of the domain; Domain Admins is a member of every domain-joined computer's local Administrators group and receives rights and permissions granted to the local Administrators group, in addition to the domain's Administrators group.","None,",Global,"(Access this computer from the network;Add workstations to domain;Adjust memory quotas for a process;Allow log on locally;Allow log on through Remote Desktop Services;Back up files and directories;Bypass traverse checking;Change the system time;Change the time zone;Create a pagefile;Create global objects;Create symbolic links;Debug programs;Enable computer and user accounts to be trusted for delegation;Force shutdown from a remote system;Impersonate a client after authentication;Increase a process working set;Increase scheduling priority;Load and unload device drivers;Log on as a batch job;Manage auditing and security log;Modify firmware environment values;Perform volume maintenance tasks;Profile single process;Profile system performance;Remove computer from docking station;Restore files and directories;Shut down the system;Take ownership of files or other objects",group,NA,"built-in"
"domain computers","Users container","All workstations and servers that are joined to the domain are by default members of this group. - Default",None,Global,"Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set)",group,NA,"built-in"
"domain controllers","Users container","All domain controllers in the domain. Note: Domain controllers are not a member of the Domain Computers group.",None,Global,"Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set)",group,NA,"built-in"
"domain guests","Users container","All guests in the domain",None,Global,"Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set)",group,NA,"built-in"
"domain users","Users container","All users in the domain",None,Global,"Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set)",group,NA,"built-in"
"enterprise admins","Users container","Enterprise Admins have permissions to change forest-wide configuration settings; Enterprise Admins is a member of every domain's Administrators group and receives rights and permissions granted to that group.",None,Universal,"Access this computer from the network;Add workstations to domain;Adjust memory quotas for a process;Allow log on locally;Allow log on through Remote Desktop Services;Back up files and directories;Bypass traverse checking;Change the system time;Change the time zone;Create a pagefile;Create global objects;Create symbolic links;Debug programs;Enable computer and user accounts to be trusted for delegation;Force shutdown from a remote system;Impersonate a client after authentication;Increase a process working setIncrease scheduling priority;Load and unload device drivers;Log on as a batch job;Manage auditing and security log;Modify firmware environment values;Perform volume maintenance tasks;Profile single process;Profile system performance;Remove computer from docking station;Restore files and directories;Shut down the system;Take ownership of files or other objects)",group,"exists only in forest root domain","built-in"
"enterprise read-only domain controllers","Users container","This group contains the accounts for all read-only domain controllers in the forest.",None,Universal,"Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set)",group,NA,"built-in"
"event log readers","Built-in container","Members of this group in can read the event logs on domain controllers.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set)",group,NA,"built-in"
"group policy creator owners","Users container","Members of this group can create and modify Group Policy Objects in the domain.",None,Global,"Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set)",group,NA,"built-in"
guests,"Built-in container","Guests have the same access as members of the Users group by default, except for the Guest account, which is further restricted as described earlier.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"hyper-v administrators","Built-in container","Members of this group have complete and unrestricted access to all features of Hyper-V.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,"Windows Server 2012","built-in"
"iis_iusrs","Built-in container","Built-in group used by Internet Information Services.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"incoming forest trust builders","Built-in container","Members of this group can create incoming, one-way trusts to this forest. (Creation of outbound forest trusts is reserved for Enterprise Admins.)",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,"exists only in forest root domain","built-in"
"network configuration operators","Built-in container","Members of this group are granted privileges that allow them to manage configuration of networking features.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"performance log users","Built-in container","Members of this group can schedule logging of performance counters, enable trace providers, and collect event traces locally and via remote access to the computer.","Log on as a batch job","Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"performance monitor users","Built-in container","Members of this group can access performance counter data locally and remotely.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"pre-windows 2000 compatible access","Built-in container","This group exists for backward compatibility with operating systems prior to Windows 2000 Server, and it provides the ability for members to read user and group information in the domain.","Access this computer from the network;Bypass traverse checking","Domain-local","Add workstations to domain;Increase a process working set",group,NA,"built-in"
"print operators","Built-in container","Members of this group can administer domain printers.","Allow log on locally;Load and unload device drivers;Shut down the system","Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"ras and ias servers","Users container","Servers in this group can read remote access properties on user accounts in the domain.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"rds endpoint servers","Built-in container","Servers in this group run virtual machines and host sessions where users RemoteApp programs and personal virtual desktops run. This group needs to be populated on servers running RD Connection Broker. RD Session Host servers and RD Virtualization Host servers used in the deployment need to be in this group.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,"Windows Server 2012","built-in"
"rds management servers","Built-in container","Servers in this group can perform routine administrative actions on servers running Remote Desktop Services. This group needs to be populated on all servers in a Remote Desktop Services deployment. The servers running the RDS Central Management service must be included in this group.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,"Windows Server 2012","built-in"
"rds remote access servers","Built-in container","Servers in this group enable users of RemoteApp programs and personal virtual desktops access to these resources. In Internet-facing deployments, these servers are typically deployed in an edge network. This group needs to be populated on servers running RD Connection Broker. RD Gateway servers and RD Web Access servers used in the deployment need to be in this group.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,"Windows Server 2012","built-in"
"read-only domain controllers","Users container","This group contains all read-only domain controllers in the domain.",None,Global,"Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"remote desktop services users","Built-in container","Members of this group are granted the right to log on remotely using RDP.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"remote desktop users","Built-in container","Members of this group are granted the right to log on remotely using RDP.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"remote management servers","Built-in container","Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,"Windows Server 2012","built-in"
replicator,"Built-in container","Supports legacy file replication in a domain.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"schema admins","Users container","Schema admins are the only users who can make modifications to the Active Directory schema, and only if the schema is write-enabled.",None,Universal,"Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,"exists only in forest root domain","built-in"
"server operators","Built-in container","Members of this group can administer domain servers.","Allow log on locally;Back up files and directories;Change the system time;Change the time zone;Force shutdown from a remote system;Restore files and directories;Shut down the system","Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"terminal server license servers","Built-in container","Members of this group can update user accounts in Active Directory with information about license issuance, for the purpose of tracking and reporting TS Per User CAL usage.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
users,"Built-in container","Users have permissions that allow them to read many objects and attributes in Active Directory, although they cannot change most. Users are prevented from making accidental or intentional system-wide changes and can run most applications.","Increase a process working set","Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking",group,NA,"built-in"
"winrmremotewmiusers__","Users container","Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,"Windows Server 2012","built-in"
"remote management users","Users container","Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user.",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"windows authorization access group","Built-in container","Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects",None,"Domain-local","Access this computer from the network;Add workstations to domain;Bypass traverse checking;Increase a process working set",group,NA,"built-in"
"protected users","Users container","Members of this group are afforded additional protections against the compromise of credentials during authentication processes. This security group is designed as part of a strategy to effectively protect and manage credentials within the enterprise. Members of this group automatically have non-configurable protections applied to their accounts. Membership in the Protected Users group is meant to be restrictive and proactively secure by default. The only method to modify these protections for an account is to remove the account from the security group.",None,Global,None,group,"Windows Server 2012 R2","built-in"
administrator,"Users container","Built-in account for administering the domain.",None,NA,"Access this computer from the network;Add workstations to domain;Adjust memory quotas for a process;Allow log on locally;Allow log on through Remote Desktop Services;Back up files and directories;Bypass traverse checking;Change the system time;Change the time zone;Create a pagefile;Create global objects;Create symbolic links;Debug programs;Enable computer and user accounts to be trusted for delegation;Force shutdown from a remote system;Impersonate a client after authentication;Increase a process working set;Increase scheduling priority;Load and unload device drivers;Log on as a batch job;Manage auditing and security log;Modify firmware environment values;Perform volume maintenance tasks;Profile single process;Profile system performance;Remove computer from docking station;Restore files and directories;Shut down the system",user,NA,"built-in"
guest,"Users container","This is the only account in an AD DS domain that does not have the Authenticated Users SID added to its access token. Therefore, any resources that are configured to grant access to the Authenticated Users group will not be accessible to this account. This behavior is not true of members of the Domain Guests and Guests groups, however- members of those groups do have the Authenticated Users SID added to their access tokens.",None,NA,"Access this computer from the network;Bypass traverse checking;Increase a process working set",user,NA,"built-in"
krbtgt,"Users container","The Krbtgt account is the service account for the Kerberos Key Distribution Center in the domain. This account has access to all accounts' credentials stored in Active Directory. This account is disabled by default and should never be enabled.",None,NA,None,user,NA,"built-in"
