Background

While attempting to set up Scoop as a package manager (useful for installing various GitHub-hosted open source applications), I encountered an installation restriction—it cannot run under elevated administrator privileges. This limitation prompted me to investigate Windows user groups more thoroughly.

After troubleshooting, I discovered that my user account was exclusively assigned to the Administrators group, which explained why I could not access a standard (non-elevated) command-line environment regardless of what I tried.

Local User Groups

Local user groups are essentially the groups configurable through the Computer Management console on your local machine.

Listing All Local Groups

The following command retrieves all local groups on the system:

Get-LocalGroup

Checking Current User's Group Membership

To view which groups the current user belongs to:

whoami /groups

This command syntax originates from CMD, but it functions correctly in PowerShell aswell.

Administrator Group

Administrators have unrestricted access to system configuration and management tasks. This role is comparable to root in Linux systems.

Using Windows without administrator privileges is akin to using Android without unlocking the bootloader—your control over the system remains fundamentally limited.

User Group

Standard users operate with restricted permissions, suitable for daily tasks without system-level modifications.

Guest Group

Guest accounts provide temporary access with minimal privileges. In most scenarios, this group remains unused on personal systems.

The three groups above represent the categories capable of logging into the computer.

Additional System Groups

Beyond the primary login groups, Windows maintains numerous built-in groups that govern various system behaviors. The output below represents complete group information on a typical Windows installation:

Group Name                                Type   SID          Description
======================================== ====== ============ ==========================================
Everyone                                  Well-k S-1-1-0      All users on the system
NT AUTHORITY\Local account and admin      Well-k S-1-5-114    Local accounts and admin members
BUILTIN\Administrators                    Alias  S-1-5-32-544  System administrators with full control
BUILTIN\Users                             Alias  S-1-5-32-545  Standard users with basic access
BUILTIN\Performance Log Users             Alias  S-1-5-32-559  Users with performance monitoring access
NT AUTHORITY\INTERACTIVE                  Well-k S-1-5-4      Users logged in interactively
CONSOLE LOGON                             Well-k S-1-2-1      Console session users
NT AUTHORITY\Authenticated Users          Well-k S-1-5-11     All authenticated users
NT AUTHORITY\This Organization            Well-k S-1-5-15     Organization members
NT AUTHORITY\Local Account                Well-k S-1-5-113    All local accounts
LOCAL                                     Well-k S-1-2-0      Local computer identifier
NT AUTHORITY\NTLM Authentication          Well-k S-1-5-64-10 NTLM authentication sessions
Mandatory Label\High Mandatory Level     Label  S-1-16-12288  High integrity level processes

Understanding these system groups can be challenging. The following section provides functional descriptions of each group:

Everyone (S-1-1-0)

A collective group encompassing all user accounts on the system. Commonly referenced when granting shared permissions across all users.

NT AUTHORITY\Local account and admin members (S-1-5-114)

Contains members of local accounts combined with administrative roles. Provides elevated local system capabilities.

BUILTIN\Administrators (S-1-5-32-544)

System administrators with complete management permissions. This group holds ownership of critical system objects and possesses unrestricted operational capabilities.

BUILTIN\Users (S-1-5-32-545)

Standard users with basic system interaction permissions. Members can run applications and perform routine tasks without administrative modifications.

BUILTIN\Performance Log Users (S-1-5-32-559)

Users granted access to performance monitoring and logging functionality. Essential for system diagnostics and performance analysis.

NT AUTHORITY\INTERACTIVE (S-1-5-4)

All users authenticated through interactive login sessions. Provides baseline permissions for direct system interaction.

CONSOLE LOGON (S-1-2-1)

Users with physical or remote console access. Distinguishes local login sessions from network or terminal connections.

NT AUTHORITY\Authenticated Users (S-1-5-11)

Any user who has successfully authenticated to the system. Used when assigning permissions requiring verified identity.

NT AUTHORITY\This Organization (S-1-5-15)

Members belonging to the same organizational domain. Facilitates resource sharing and permission management within enterprise environments.

NT AUTHORITY\Local Account (S-1-5-113)

Designates all locally created accounts versus domain accounts. Useful for identifying non-domain users.

LOCAL (S-1-2-0)

Identifier for resources originating from the local computer. Enables local resource distinction from network resources.

NT AUTHORITY\NTLM Authentication (S-1-5-64-10)

Sessions authenticated using NTLM protocol. Impacts compatibility with legacy authentication mechanisms.

Mandatory Label\High Mandatory Level (S-1-16-12288)

Security label indicating high integrity level. Processes running under this label possess elevated system access capabilities.