Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I’m trying to find a way to get a comprehensive list of user accounts on a Windows 7 system, including hidden ones. The User Accounts dialog (>control userpasswords2) only shows the normal user accounts, and even the Local User and Groups editor only shows normal user accounts and standard hidden/disabled ones like Administrator and Guest. The Select Users or Groups dialog has a Find Now button which which combines users and groups, but alas, it has the same contents as the LUG.

I’m looking for a more comprehensive list that includes “super-hidden” / virtual user accounts like TrustedInstaller (or to be more accurate, NT Service\TrustedInstaller—notice the different “domain”).

I checked HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList, but the SpecialAccounts key does not exist.

I also checked HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList, and while it does have the SystemProfile, LocalService, and NetworkService accounts listed, it does not have others (like TrustedInstaller and its ilk).

TrustedInstaller specifically is a little confusing because it is a user, a service, and an executable file. I am using it as an example because it is “super hidden” in that it does not seem to be listed in any sort of user list. (As an experiment, I tried searching the whole registry for “trustedinstaller” to see if I could find a place where it is listed as a user, but found none.)

To be clear, what I am looking for is a list of all accounts that can be used in a user input-field such as in permissions dialogs or as a runas argument.

share|improve this question
add comment

5 Answers

up vote 5 down vote accepted

I don't think there is an ultimate list of all possible accounts.

There are different types of names you can use in the user input-field such as in permissions dialogs.

First up are standard Win32_Accounts, to get a full list open a PowerShell session and run:

get-wmiobject -class "win32_account" -namespace "root\cimv2" | sort caption | format-table caption, __CLASS, FullName

These are the usual users, groups and the builtin accounts.

Since Vista, there is a new class of accounts, called virtual accounts, because they do not show up in the usual management tools. There are sometimes called service accounts as well, and there are at least three different types of these:

  • Windows Service Accounts

Since Vista every windows service has an virtual account associated with it, even it it runs under a different user account and even if it does not run at all. It looks like NT Service\MSSQLSERVER

To get a list of those use:

get-service | foreach {Write-Host NT Service\$($_.Name)}
  • IIS Application Pools

Each IIS application pool that runs under the ApplicationPoolIdentity runs under a special account called IIS APPPOOL\NameOfThePool

Assuming you have the IIS Management scripting tools installed, you can run:

Get-WebConfiguration system.applicationHost/applicationPools/* /* | where {$_.ProcessModel.identitytype -eq 'ApplicationPoolIdentity'} | foreach {Write-Host IIS APPPOOL\$($_.Name)}
  • Hyper-V Virtual Machines

On Server 2008+ and Windows 8+ you have Hyper-V, each virtual machine creates it own virtual account, which looks like: NT VIRTUAL MACHINE\1043F032-2199-4DEA-8E69-72031FAA50C5

to get a list use:

get-vm | foreach {Write-Host NT VIRTUAL MACHINE\$($_.Id) - $($_.VMName)}

Ever though these accounts are not accepted in the permissions dialog, you can use them with icacls.exe to set permissions.

There is also a special group NT Virtual Machine\Virtual Machines, which doesn't show up elsewhere. All of the virtual machine accounts are members of this group, so you can use this to set permissions for all VM files.

These names are language specific, e.g. in German it is named NT Virtual Machine\Virtuelle Computer

  • Desktop Window Manager

The dvm.exe process (Desktop Window Manager) runs under a user Windows Manager\DWM-1

Again you can not use this type of users in the permissions dialogs. It is not really possible to enumerate these either because one exists for each 'Desktop session', so when using two RDP sessions, you also have DWM-2 and DWM-3 in addition to DVM-1. So there are as many as there are desktops available.

  • Computer Names

In certain cases you can also use computer names in the permissions dialog, usually when being part of an Active Directory domain.

Even these lists don't give you every possible account.

For example, you can create an application pool FooBarPool then delete it again, you can still use IIS APPPOOL\FooBarPool in the permissions dialog, so there must be an internal list somewhere.

share|improve this answer
    
Very nice! The first query returned special “users” like everyone, restricted, etc., and your discussion of NT Service\* accounts explains others like TrustedInstaller. You also covered for more exotic special cases, but it looks like all of the common ones are accounted for. –  Synetech Aug 29 '13 at 19:47
add comment

This is because TrustedInstaller is a service and not a "user" object. With Vista, Services are now security principals and can be assigned permissions.

http://technet.microsoft.com/en-us/magazine/2007.06.acl.aspx

share|improve this answer
    
Yes; that's exactly what I'm talking about. I'm looking for a comprehensive list of things that can be given permissions be they users, services, or what have you. Is there a complete list of “security principals”? –  Synetech Apr 9 '11 at 19:13
    
I don't think there is a way to tap into the ACLs and find a COMPLETE list of security principals. I'm not sure why you want a complete list of security principals in the first place. Technically, the Windows Modules Installer (TRUSTEDINSTALLER's service name) runs under the Local SYSTEM account. –  surfasb Apr 10 '11 at 21:28
1  
> I'm not sure why you want a complete list of security principals in the first place. Curiosity. (Does anybody have that anymore these days…?) –  Synetech Feb 5 '12 at 21:10
    
You can point that curiosity towards the MSDN library. –  surfasb Feb 6 '12 at 3:51
add comment
  1. Go to any file on your hard drive, right-click, and select properties.
  2. Go to the security tab and click Edit

    edit security settings

  3. Click Add...
  4. Click Advanced...

    select users or groups

  5. Click Object Types... and uncheck Groups, then click OK

    object types

  6. Click Find Now. This will list all regular users and built-in system users ("built in security principles", as Windows calls them).

    find now

Note that not all accounts that appear on this page can be used in a Run-As command, though they can all be used in a permissions dialog.

share|improve this answer
2  
I’m familiar with that dialog, and already mentioned it in the question: “find now”. Note that while the “user” SYSTEM is (or at least should be) in there, TrustedInstaller is not. –  Synetech Mar 4 '11 at 0:10
    
Sorry, I thought you were referring to the find now button in the Users and Groups control panel, which is similar but slightly different. To my knowledge, the only account which does not appear here is TrustedInstaller. This is because Microsoft goes to great lengths to prevent you from ever doing anything to/with the TrustedInstaller account. I'll let you know if I think of any other ways to do this. –  nhinkle Mar 4 '11 at 0:17
    
That’s why I’m asking; I’m wondering what other undocumented users exist… –  Synetech Mar 6 '11 at 20:21
    
There is a Microsoft TechNet article with information about most of them, but TrustedInstaller isn't on there. support.microsoft.com/kb/243330 –  nhinkle Mar 6 '11 at 21:39
    
That list is only of SIDs; a separate list would be needed to map them to the “user names” (where applicable). –  Synetech Feb 5 '12 at 21:12
show 1 more comment

From Windows Vista on, services are treated like users. That is, each a SID is assigned to every service. This is not specific to TrustedInstaller service. You can view the SID assigned to any service using the sc showsid command:

USAGE: sc showsid [name]

DESCRIPTION: Displays the service SID string corresponding to an arbitrary name. The name can be that of an existing or non-existent service.

Note that there is no need for the service to exist on the system. Examples:

C:\> sc showsid TrustedInstaller
NAME: TrustedInstaller
SERVICE SID: S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464

or, for the service Windows Management Instrumentation (Winmgmt):

C:\> sc showsid Winmgmt
NAME: Winmgmt
SERVICE SID: S-1-5-80-3750560858-172214265-3889451188-1914796615-4100997547

and, finally, for a fake service:

C:\> sc showsid FakeService
NAME: FakeService
SERVICE SID: S-1-5-80-3664595232-2741676599-416037805-3299632516-2952235698

Note that all SIDs start with S-1-5-80, where 80 is assigned to SECURITY_SERVICE_ID_BASE_RID sub-authority. Moreover, this assignment is deterministic: No RIDs are used, and the SID will be the same across all systems (see the references at the end of this post for more information).

As an example, I will assign the NT Service\Winmgmt service, write permission to some file:

enter image description here

Windows underlines the name Winmgmt, confirming that it's a valid identity:

enter image description here

Now, click OK, and then assign the write permission:

enter image description here

This confirms that any service name can be used as a user identity. Therefore, I wouldn't call them "supper-hidden" accounts :D

For more information, please read the following articles:

share|improve this answer
1  
Very interesting. Thanks for the information! –  Synetech Apr 23 '13 at 18:39
add comment

You can use NetQueryDisplayInformation API, combine with bitwise check on user info flag. I have exactly same requirement, so I cook a sample code (modified from MSDN GROUP query).

The user flag I used are UF_NORMAL_ACCOUNT UF_ACCOUNTDISABLE UF_PASSWD_NOTREQD ---> this ensure we get Human account, Human account always requires password.

working code at: http://www.cceye.com/list-system-normal-user-account-only/

share|improve this answer
    
Please expand your answer to directly contain relevant information to the question at hand. If this link ever stops working your answer will not be as useful. –  Mxx Dec 17 '13 at 5:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.