Local Administrators: Who Has Local Admin, RDP and PowerShell Remoting

Overview

Local administrator rights are a main route for lateral movement. An account that holds local administrator rights on a computer can dump credentials from it and move on. Local Administrators lists every such grant in one Active Directory domain. It covers three kinds of access:

Most of these grants come from Group Policy, so the page explains each one: which GPO, which local group, and which OU link delivers it. A policy only asserts a grant, so each row also shows how much evidence backs it, on the Tiered Fidelity™ ladder.

---

Prerequisites

• Role: Operator or Admin. The Local Administrators entry in the Analysis sidebar section doesn't appear for Viewers.
• Data: A finished sync of an Active Directory domain. The bridge must read the domain's Group Policy files from SYSVOL. See Identity Bridge.
• Telemetry (for Validated): Windows Security events from your computers, in particular Event 4672. See Telemetry Pipeline. Without it, rows stay at Theoretical or Constrained.

Local administrator data is built after a sync. A domain that hasn't been analyzed yet shows "Local administrators aren't analyzed for this domain yet. They're analyzed after the next sync."

---

How Each Grant Is Found

GraphnAI reads two kinds of Group Policy setting that put accounts into the three local groups:

• Restricted Groups: the group membership settings in a GPO's security template.
• Group Policy Preferences: Local Users and Groups items in Groups.xml.

For each GPO, GraphnAI works out the OUs it links to and the computers under them. It then creates one edge per named account or group and candidate computer. A policy that names one group of 5,000 members over 500 computers makes 500 edges, one per computer, not one per member.

Directive shows how the policy sets the group:

---

Tiered Fidelity™ for Local Administrator Access

Every grant earns one of three levels. The flyout shows them as a ladder, with the time each was reached.

Constrained: The scope check

The scope check looks at links, enforcement, Block Inheritance, the GPO's computer configuration setting and WMI filters. It has three outcomes:

• Confirmed: the policy reaches the computer.
• Blocked: the policy provably doesn't reach it. For example, the link is disabled or Block Inheritance is set. The row shows an Activation required badge and the reason, because the access isn't walkable today.
• Not yet decided: GraphnAI can't tell, and the row stays Theoretical. The ladder lists why. The reasons are:
  • The policy has a WMI filter, which only the computer can evaluate.
  • The policy's explicit exclusions aren't read yet.
  • The policy's permissions aren't read yet, so the computers it targets aren't known.
  • The computer's OU isn't traced to the policy's link yet.
  • The computer's group memberships aren't fully resolved yet.
  • Another policy sets the same group on this computer, and which one wins isn't determined.

GraphnAI reads a GPO's security filtering, the accounts and groups allowed to apply it. It doesn't read the deny permissions that can exclude a computer yet. So a row whose security filter matches stays Not yet decided, and most rows are still Theoretical.

Blocked by a Deny log on right

A GPO's User Rights Assignment can deny accounts the logons that local administrator, Remote Desktop and Remote management access need. GraphnAI reads these rights from each GPO's GptTmpl.inf and marks the access they block.

User rights don't add up across GPOs. When several GPOs that apply to a computer set the same right, the one with the highest precedence replaces the others. GraphnAI finds that GPO the way Windows does: enforced links first, then the deepest OU, then link order inside an OU. A GPO that sets a right with no accounts clears it, so a deny from a lower-precedence GPO doesn't apply there.

"Deny log on locally", "Deny log on as a batch job" and "Deny log on as a service" block none of these, because none of the three is reached through a console, batch or service logon.

A deny wins over the grant. It blocks an account it names, or any group the account belongs to, directly or nested. A deny that names only some members of a group doesn't block the group's row, because the other members can still use it.

A blocked row shows the Activation required badge. Its ladder names each setting and the GPO's GUID, for example: Blocked by "Deny access to this computer from the network" in Group Policy {31B2F340-016D-11D2-945F-00C04FB984F9}. In the graph, the edge panel lists the same entries under Blocked by, and Constrained by shows User Rights Assignment with the GUID of each GPO it checked. The access stays in the graph, but attack paths through it rank last.

GraphnAI marks access blocked only when it's sure. It doesn't block anything when the GPO that might win has a WMI filter, a deny of Apply Group Policy, or security filtering it can't match to the computer, when the GPO's SYSVOL files couldn't be read, or when two GPOs in one OU disagree and their link order isn't known. When no GPO sets the right, the computer's local policy decides, which GraphnAI can't read, so nothing is blocked either.

A row that was checked and isn't denied still counts as Constrained: the deny was evaluated and cleared it.

When you remove a deny, or remove an account from a denied group, the next sync lifts the block. Windows keeps the last user rights setting it applied in the computer's local policy after a GPO stops setting it, so the computer may still deny the logon until something else changes that setting.

Validated: A logon on the host

When the telemetry pipeline sees an Event 4672 (special privileges assigned to a new logon) for an account with a sensitive privilege, it checks for a local administrator, Remote Desktop or Remote management edge from that same account to that computer. If one exists, the edge becomes Validated, with the time of the logon. Telemetry never creates an edge. A Validated edge that a blocked scope had marked dormant is released, because the logon shows the access works.

Only an edge whose Account or group is the account that logged on is promoted. An edge that names a group stays at its earlier level, even when a member of the group logs on.

An unconfirmed row isn't a clean row. The ladder says: "No collector on this computer has reported this membership yet. It may still be there."

---

Step-by-Step

View local administrators for a domain

1. Open Analysis > Local Administrators.
2. If you have several Active Directory domains, pick one in the Domain list. The page opens on the first synced domain.
3. Read the cards above the table (see Summary Cards). Rows load as a stream, so large domains fill in as they arrive.
4. Select a row to open the flyout. Select the close button to return to the full table.

Filter the list

Use the three lists in the table toolbar. They combine.

With filters set and no match, the table says "No local administrators match these filters". Clear a filter to see more.

Find out why an account is a local administrator

1. Select the row.
2. In Tiered Fidelity™, read which levels the grant has reached.
3. In Where it comes from, read the fields in the table below.
4. Select the GPO name to open the GPO in Graph Explorer.

The same ladder and fields appear in the edge panel in Graph Explorer when you select an AdminTo, CanRDP or CanPSRemote edge.

Investigate an unexplained or contradicted grant

1. Set Source to Unexplained or Policy contradicted.
2. Select a row.
3. For Unexplained, the flyout reads "A collector observed this membership on the host, and no Group Policy explains it." No current policy grants the access, so check how the account got it.
4. For Policy contradicted, the flyout names the GPO and says it "didn't reach this computer when last evaluated. The account is in [group] on it anyway." Check whether the GPO is linked as you expect, or whether another route grants the access.

Remove an access with Select Fire

1. Select the row.
2. Select Select Fire at the bottom of the flyout. It opens Manual Preview with the account or group as the subject.
3. Continue through Preview, Simulate and Decision. See Select Fire.

---

Summary Cards

Below the cards, Memberships by fidelity shows Validated ("Seen on the computer"), Constrained ("Policy scope or logon rights checked") and Theoretical ("Asserted by policy only") as one bar. The bar only shows when there are memberships.

Unexplained and Policy contradicted are separate counts and aren't added together.

---

Table Columns

---

Configuration

There is nothing to set for this page. It reads the data the bridge and the telemetry pipeline collect.

---

Limits

• Site-linked GPOs aren't read. A Deny log on right set by a GPO linked to an Active Directory site isn't seen.
• The allow log on rights aren't used. A GPO that sets "Access this computer from the network" or "Allow log on through Remote Desktop Services" without an account blocks its access the same way, and GraphnAI doesn't mark that yet.
• An older bridge misses a deny cleared by a higher GPO. An older bridge drops a Deny log on right that a GPO sets for no accounts, so a lower GPO's deny can show as blocking there. Update the bridge to read it.
• Deny permissions on a GPO aren't read. A deny can exclude a computer from a GPO, so a row whose security filter matches stays Theoretical, even when a deny filters the GPO away from that computer.
• Validated depends on telemetry. Without Event 4672 from a computer, its rows can't reach Validated.
• Groups aren't expanded. An edge from a group counts once per computer, not once per member.
• One domain at a time. The page lists one Active Directory domain.

---

Troubleshooting

The page says "No Active Directory domain has synced yet"

Most likely cause: No on-premises domain has finished a sync.

Fix: Run a sync from the bridge and check the domain on Identity Bridge.

The banner says "No local administrator data for [domain]"

Most likely cause: The analysis refused or didn't run. The banner gives the reason.

Fix:

1. For "A Group Policy object's settings couldn't be read", give the bridge account read access to SYSVOL.
2. For "more policy memberships than the safety limit allows", the domain is too large to analyze in full. The page shows no rows rather than partial ones.
3. For "aren't analyzed for this domain yet", wait for the next sync to finish.

The cards show dashes in these cases. A dash means "not known", and 0 means "none found".

The banner says "This list is incomplete"

Most likely cause: Loading stopped early.

Fix: Reload the page. Don't use the partial list as a full count.

Every row is Theoretical

Most likely cause: GPO scope can't be decided, or no telemetry arrives.

Fix: Open a row and read the reasons under Constrained. For Validated, confirm Event 4672 reaches GraphnAI. See Telemetry Pipeline.