Windows 10: system user issuing this command: c:\windows\system32\net1 localgroup administrators

I had alarm in SIEM : T1087:Account Discovery. the user name is either "system" OR xyz$ computer name ending with $.The commands issued are:1 c:\windows\system32\net1 localgroup administrators2 c:\windows\system32\windowspowershell\v1.0\powershell.exe -command "$approvedadmins = \"administrator\";$membersad = net localgroup administrators where {$_ -and $_ -notmatch \"command completed successfully\"} select -skip 4;$membersad = $membersad -join \";\";$membersad = \";\" + $membersad + \";\";$members=get-wmiobject -class win32_useraccount -filter \"localaccount='true'\" select name;$i

:)

 

When attempt to access the WindowsApps folder with either administrator account, the system says I need administrator rights and denies access

Hi,

Thank you for posting your query in Microsoft Community.

I suggest you to enable built in administrator by following the steps below, create a new user profile and check if the issue persist.

• 
  Open a CMD window by right clicking on the Start icon, and selecting
  Command prompt (Admin).
  

• 
  Type the following command: net user administrator /active: yes
  
• 
  Login into the built in administrator user profile and create a new user profile with administrator privileges.
  
• 
  Delete the corrupted user account from the built in administrator.
  
• 
  Then lock your screen by pressing Windows key + L, and sign-in as the Administrator account.
  

Check if the issue persist and you can disable built in administrator account by typing the command: net user administrator /active: no
in the Command prompt (Admin).

To create a new user account follow the steps below:

• 
  On the Search bar type cmd and
  press ctrl + shift + Enter on the keyboard to open the Elevated
  Command Prompt.
  
• 
  Type net user NewAccount password /add and click Enter.
  
• 
  Type net localgroup Administrators NewAccount /add and click Enter.
  
• 
  Log off from the system and login to the new user account.
  

Hope this helps!

 

Having Issues with Built-In Administrator


From an elevated ("run as administrator") command prompt type:

net localgroup administrators

What user accounts are listed in the administrators group?

 

Administrator level User

A standard user can open a command prompt and use net users to list all user accounts. They can also use net localgroup administrators to list all administrator accounts.