Audit users

The auditing feature of users validates if the user may call the method SamrConnect on the target.

Why Should I Harden This?

Knowing local groups and their members may help a malicious actor to orientate their actions. Indeed, if they learn that a specific user is privileged on a system that they would like to gain access to, they can aim to compromise that user through other vectors.

The tool BloodHound leverages this to draw a map of where a user is privileged or can authenticate to. See CollectionMethod, section "LocalGroup".

How To Harden

Network access: Restrict clients allowed to make remote calls to SAM.