Security Basics mailing list archives

Re: Export list of usernames WinNT and Win2K servers


From: GuidoZ <uberguidoz () gmail com>
Date: Fri, 10 Dec 2004 02:53:55 -0500

I've found the NET commands to be quite handy for such a purpose. Try
typing this from a command prompt:

net users

It will generate a list of all users on the system. If you'd rather
have it as a text file, simply typ this:

net users > PATH_YOU_WANT\name.txt

To append to an existing text file, change ">" to ">>". If you'd like
to gather more info on a specific user, simply type:

net user <NAME>

Where NAME is the exact user name. (Use quotes around user names with
spaces.) Use the same method above to send it to a text file. If
you're an admin, you can easily change a password of any account by
typing:

net user <NAME> *

It will then prompt you to enter a new password for that user. This is
used widely to gain access to machines when an administrative account
is logged in and you'd like to login under another profile. A good
example - while traveling early this month, the hotel I was at had a
public machine. The "Hotel Guest" account they logged you in as was an
admin. The "Manager" account was passworded. I could of easily reset
the manager password, then logged in under them.

Check out the other NET commands (just type net and hit enter for a
list) for some other very useful info gathering tools. I carry a batch
file with me when doing onsite work (or recon) that executes the ones
I like (plus others) and saves it to a text file. Takes only seconds
and a double-click to gather a wealth of information on the system,
users, and network.

--
Peace. ~G


On Thu, 9 Dec 2004 16:06:05 -0500, Raoul Armfield <armfield () amnh org> wrote:
In Linux/Unix you can less the passwd file and get a list of all the users
their usernames etc and have it be a regular text file.  I would like to
know if there is some way to get something similar for Windows servers.

Raoul


Current thread: