Using the domain security identifier (SID), Nessus was able to enumerate the domain users on the remote Windows system using the Security Accounts Manager.

Using the host security identifier (SID), Nessus was able to enumerate local users on the remote Windows system, without credentials.

Using the supplied credentials it was possible to extract the password policy for the remote Windows host. The password policy must conform to the Informational System Policy.

Using the supplied credentials, Nessus was able to list local users that are enabled and whose passwords never expire.

Using the supplied credentials, Nessus was able to list local users who have never logged into their accounts.

Using the supplied credentials, Nessus was able to list local users who have never changed their passwords.

Using the supplied credentials, Nessus was able to list local user accounts that have been disabled.

Using the supplied credentials, Nessus was able to list local users who can not change their own passwords.

Using the supplied credentials, Nessus was able to list local user accounts that have been automatically disabled. These accounts may have been disabled for security reasons or due to brute-force attack attempts.

Using the supplied credentials, Nessus was able to retrieve information for each local user.

Note that this plugin itself does not issue a report and only serves to store information about each local user in the KB for further checks.

Using the supplied credentials, it is possible to extract the member list of the 'Domain Administrators' group. Members of this group have complete access to the Windows Domain.

Using the supplied credentials, Nessus was able to determine that the 'Guest' user belongs to groups other than 'Guests' (RID 546) or 'Domain Guests' (RID 514). Guest users should not have any additional privileges.

Using the supplied credentials, it is possible to extract the member list of the 'Replicator' group. Members of this group can replicate (or copy) files or directories within a domain.

Using the supplied credentials, it is possible to extract the member list of the 'Print Operators' group. Members of this group can manage printers within a Windows Domain or shutdown a server.

Using the supplied credentials, it is possible to extract the member list of the 'Backup Operators' group. Members of this group can logon to the remote host and perform backup operations (read/write files) but have no administrative rights.

Using the supplied credentials, it is possible to extract the member list of the 'Server Operators' group. Members of this group can perform most common administrative tasks.

Using the supplied credentials, it is possible to extract the member list of the 'Administrators' group. Members of this group have complete access to the remote system.

Using the supplied credentials, it is possible to extract the member list of the 'Account Operators' group. Members of this group can create or modify local user accounts but can not modify or create administrative accounts or edit user rights.

Using the supplied credentials, Nessus was able to list users that are enabled and whose passwords never expire.

Using the supplied credentials, Nessus was able to list users who have never logged into their accounts.

Using the supplied credentials, Nessus was able to list users who have never changed their passwords.

Using the supplied credentials, Nessus was able to list user accounts that have been disabled.

Using the supplied credentials, Nessus was able to list users who can not change their own passwords.

Using the supplied credentials, Nessus was able to list user accounts that have been automatically disabled. These accounts may have been disabled for security reasons or due to brute-force attack attempts.

Using the supplied credentials it was possible to retrieve the list of groups each user belongs to.
Groups are stored in the KB for further checks.

Using the supplied credentials it was possible to retrieve the list of groups each user belong to.
Aliases are stored in the KB for further checks.

Using the supplied credentials, Nessus was able to retrieve information for each domain user.

Note that this plugin itself does not issue a report and only serves to store information about each domain user in the KB for further checks.

Using the host security identifier (SID), Nessus was able to enumerate local users on the remote Windows system.

Using the domain security identifier (SID), Nessus was able to enumerate the domain users on the remote Windows system.

ID	Name	Severity
126527	Microsoft Windows SAM user enumeration	info
56211	SMB Use Host SID to Enumerate Local Users Without Credentials	medium
17651	Microsoft Windows SMB : Obtains the Password Policy	info
10916	Microsoft Windows - Local Users Information : Passwords Never Expire	info
10915	Microsoft Windows - Local Users Information : User Has Never Logged In	info
10914	Microsoft Windows - Local Users Information : Never Changed Passwords	info
10913	Microsoft Windows - Local Users Information : Disabled Accounts	info
10912	Microsoft Windows - Local Users Information : Can't Change Password	info
10911	Microsoft Windows - Local Users Information : Automatically Disabled Accounts	info
10910	Microsoft Windows Local User Information	info
10908	Microsoft Windows 'Domain Administrators' Group User List	info
10907	Microsoft Windows Guest Account Belongs to a Group	high
10906	Microsoft Windows 'Replicator' Group User List	info
10905	Microsoft Windows 'Print Operators' Group User List	info
10904	Microsoft Windows 'Backup Operators' Group User List	info
10903	Microsoft Windows 'Server Operators' Group User List	info
10902	Microsoft Windows 'Administrators' Group User List	info
10901	Microsoft Windows 'Account Operators' Group User List	info
10900	Microsoft Windows - Users Information : Passwords Never Expire	info
10899	Microsoft Windows - Users Information : User Has Never Logged In	info
10898	Microsoft Windows - Users Information : Never Changed Password	info
10897	Microsoft Windows - Users Information : Disabled Accounts	info
10896	Microsoft Windows - Users Information : Can't Change Password	info
10895	Microsoft Windows - Users Information : Automatically Disabled Accounts	info
10894	Microsoft Windows User Groups List	info
10893	Microsoft Windows User Aliases List	info
10892	Microsoft Windows Domain User Information	info
10860	SMB Use Host SID to Enumerate Local Users	info
10399	SMB Use Domain SID to Enumerate Users	info

Detections

Analytics

Windows : User management Family for Nessus

info

medium

info

info

info

info

info

info

info

info

info

high

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info