What are the Windows local account groups?

You can view existing groups as follows: From the Start menu, right-click My Computer (or Computer); select Manage, then Local Users and Groups, and then Groups.

Following are some default Windows local account access groups (also called "memberships") with a description of the rights of each group:

Note: If you install additional services (e.g., .Net or SQL), those services may install additional groups or memberships. The list below contains the most common "default" groups installed with Windows. Depending on what services you have running you may have more or fewer of these groups.

• Restricted Users: Restricted Users are prevented from making system-wide changes. These users can only run certified applications, but cannot run most legacy applications.
  
  
• Standard Power Users: Power Users possess most administrative powers with some restrictions. Power Users can run legacy applications in addition to certified applications.
  
  
• Administrators: Administrators have complete and unrestricted access to the computer.

  Note: At Indiana University, the University Information Security Office (UISO) recommends that you normally refrain from running your Windows computer as an administrator. For more, see What is the principle of least privilege?

• Backup Operators: Backup Operators can override security restrictions for the sole purpose of backing up or restoring files.
  
  
• Debugger Users: Debugger Users can debug processes on the computer, both locally and remotely.
  
  
• Guests: By default, users in the Guests group have the same access as members of the Users group, except for the special Guest account, which is further restricted.
  
  
• HelpServicesGroup: This group is for the Help and Support Center utility built into Windows (not the UITS Support Center).
  
  
• Network Configuration Operators: Members in this group have some administrative privileges to manage the configuration of networking features.
  
  
• Remote Desktop Users: Members in this group are granted the right to remotely log in.
  
  
• Replicator: The Replicator account is used to support file replication across computers in a domain.

Comments/Questions/Corrections