List of Hidden / Virtual Windows User Accounts

Question

I’m trying to find a way to get a comprehensive list of user accounts on a Windows 7 system, including hidden ones. The User Accounts dialog (>control userpasswords2) only shows the normal user accounts, and even the Local User and Groups editor only shows normal user accounts and standard hidden/disabled ones like Administrator and Guest. The Select Users or Groups dialog has a Find Now button which which combines users and groups, but alas, it has the same contents as the LUG.

I’m looking for a more comprehensive list that includes “super-hidden” / virtual user accounts like TrustedInstaller (or to be more accurate, NT Service\TrustedInstaller—notice the different “domain”).

I checked HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList, but the SpecialAccounts key does not exist.

I also checked HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList, and while it does have the SystemProfile, LocalService, and NetworkService accounts listed, it does not have others (like TrustedInstaller and its ilk).

TrustedInstaller specifically is a little confusing because it is a user, a service, and an executable file. I am using it as an example because it is “super hidden” in that it does not seem to be listed in any sort of user list. (As an experiment, I tried searching the whole registry for “trustedinstaller” to see if I could find a place where it is listed as a user, but found none.)

To be clear, what I am looking for is a list of all accounts that can be used in a user input-field such as in permissions dialogs or as a runas argument.

Answer 1

This is because TrustedInstaller is a service and not a "user" object. With Vista, Services are now security principals and can be assigned permissions.

http://technet.microsoft.com/en-us/magazine/2007.06.acl.aspx

Answer 2

1. Go to any file on your hard drive, right-click, and select properties.

2. Go to the security tab and click Edit

   

3. Click Add...

4. Click Advanced...

   

5. Click Object Types... and uncheck Groups, then click OK

   

6. Click Find Now. This will list all regular users and built-in system users ("built in security principles", as Windows calls them).

   

Note that not all accounts that appear on this page can be used in a Run-As command, though they can all be used in a permissions dialog.