Common Windows User Types
The account types encountered on Windows systems, roughly ordered by privilege within their scope. The critical distinction is local vs. domain scope — the same name (“admin”) means very different things on each side.
| Type | Scope | Notes |
|---|---|---|
| Guest | Local | Disabled by default; minimal privileges. |
| Local User | Local | Standard account on one machine; no admin rights by default. |
| Local Admin | Local | Full control of that machine only — can install software, dump local credentials, and pivot to any local account. |
| Domain User | Domain | Standard AD account; authenticates to domain resources but holds no special rights on member machines unless explicitly granted. |
| Domain Admin | Domain | Admin rights on (by default) every domain-joined machine via membership in the local Administrators group — the crown jewels of an AD environment. |
The overlap that matters
Non-admin domain users may still be local admins. Local Administrators group membership is per-machine, and it commonly contains domain users or domain groups (helpdesk staff, developers, “Domain Admins” itself). This is the pivot of most AD lateral movement: compromising one machine where a domain user is local admin can yield credentials or tokens for that user, which then authenticate elsewhere.
Corollaries for offense and defense:
net localgroup administrators(see windows-reconnaissance-commands) is one of the first things to check on a foothold — it reveals which domain identities are worth hunting on this box.- From the defense side, over-broad local admin grants are one of the most common AD hygiene failures; tools like Microsoft’s LAPS exist precisely to make per-machine local admin passwords unique so a single machine compromise doesn’t cascade.
- Local accounts other than the built-in Administrator (RID 500) authenticate only locally by default in modern Windows (LocalAccountTokenFilterPolicy), which limits their lateral-movement value — domain accounts don’t have this restriction.
Sources
Related: windows-reconnaissance-commands, windows-services, ntlm-relay-attacks