regf ) )R Q \SystemRoot\System32\Config\SAMZC x+:WZC x+:WZC x+:WrmtmD ,e.&hbinR Qpnk,P6F839CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}91Enk MtF 8C&YQSAM /skRdHX4?  lfSAMnk P6F( RXACTpPvk vkhC;vkACvkBuil8skx !? ?? PxD041?   nk @;FDomainsnk ?[7hEH BuiltinvkFԲ8F}@vkV( xD0z4    nk Բ8Fp UsersXvknk Բ8FNameslfhNamevknk Բ8Fp@ Groupsvkervknk Բ8FHNameslfpNamevknk MtFpKp AliaseslfAliaGrouUser@nk Y"?K FNamesp x vk nk w"?@O PMembers `vknk Y"?x #Administrators08vk 26??nk Y"?x  Users1F4 Xvk!nk Y"?x h Backup Operatorsvk'stXB vk,lf*Nonenk ?[7hEX 00000220vk 800C Memb0vk pC LxD04    AdministratorsAdministrators have complete and unrestricted access to the computer/domainJFxFѢ 2nk Y"?x pI Replicatorvkvk#%nk HR0^Eh 00000221vksCnk Y"?x $ Power Userslfvk/hbinnk Y"?x ` DGuestsvk.nk Y"?x 2Distributed COM Usersk nk Y"?x p Repl IIS_IUSRSvkvk8nk Y"?x PEvent Log Readersower Us7$vkPF8vk"nk Y"?x RDS Management Serverspp*nk w"?  00000222vk00C0000lfAccopBuilx" D0d   $ #  GuestsGuests have the same access as members of the Users group by default, except for the Guest account which is further restrictedJFxFѢ 2nk pj4-$000003E9vkqV7Nonenk @;F 00000227vkPC8' xD04    Backup OperatorsBackup Operators can override security restrictions for the sole purpose of backing up or restoring filesopj4-\4ږm.t Lolf $0000g0000H%0000Dvkx9plCUsernk @;FD00000228vkD0C(JD0L   $  ReplicatorSupports file replication in a domainnk HR0^E pY'S-1-5-21-2017872536-547541318-338824442nk @;F00000223nk oF`p20000022F2(#D0d   $ #  Power Users Power Users are included for backwards compatibility and possess limited administrative powersnk 4ږ"@AccountvkF@;F 86:Uo)l2ۤ7~s mYfV؟r83`umz6ڟ,JNOA+÷@:vk@ PVnk X$^E*0Users!X"vknk X$^EhONames++NameP!hbin nk Y"?x CDRDS Endpoint Serversnk "?@< Administratort S !&vkHY Cemo vkr>8E8Ivknk @;F$hGroupsvkervknk "?h!0 pNames$&vknk [cFf"Aliaseslfp"Aliah!GrouUser!nk [cFp"_x#*Names# 'vk`#nk @;Fp"P#Membersf @-vkvknk w"?x`E$000001F4 nk X$^Eh!H"|00000201lf$0000!Namevk|-CvkForcePasswordResetnk ?[7hEx8!000003E9L  $  NoneOrdinary usersnk "? Guestistrxvknk iӍB)$P000001F4vk&mevkPX'F(tAiӍBkvkPlV p,,,,,,,,,48<@D0DL  $  GuestBuilt-in account for guest access to the computer/domainX,8''fnk "?!Nonetlf Admi@&Guesvk"nk 8000001F5lf&0000*0000`0000NamevkP(+F8vk'Vnk ,"?x X#Print Operatorsnk oF)00000226vk 0Cnk Y"?x #DRemote Desktop Usersnk FqF8-x,00000232;vk+;vk3tCrs`-dD0L  $  NoneOrdinary usersV}  AdministratordBuilt-in account for administering the computer/domainvk5C/hbin0x&~PD0L   $  Print OperatorsMembers can administer printers installed on domain controllersnk oF-0000022Bnk Y"?x x$DNetwork Configuration Operatorsnk oF/0000022Cvk22vk`H<UCersp+(zTD0L   $  Remote Desktop UsersMembers in this group are granted the right to logon remotelynk Y"?x &DPerformance Monitor Usersnk oF20000022Enk oF8n LastSkuUpgrade,>D0L   $  Network Configuration OperatorsMembers in this group can have some administrative privileges to manage configuration of networking featuresvkAvkBnk X$^E administrationnk Y"?x &DPerformance Log UserslfDomah5LastRXAC Xnk Y"?x p9 Cryptographic Operatorsvk9X9H.2D0L   $  Performance Monitor UsersMembers of this group can access performance counter data locally and remotelynk FqFXEt200000240vkthUinC7RDS vk ervk @C vk=vk?vkDvkOp(</*P,D0L   $  Performance Log UsersMembers of this group may schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computervk?nk FqF@?p00000238vkpFC ?Bnk e4F ` DiS-1-5u! 00000000vkLLvk8hbin@82*D0L   $  Distributed COM UsersMembers are allowed to launch, activate and use Distributed COM objects on this machine.nk Y"?x  DCertificate Service DCOM Accessvk>nk FqFH? 00000239vkhERCvkServerDomainUpdates00Bnk Y"?x X- RDS Remote Access Serversvk(D7nk FqF Din0000023DvkItCrneDvk@e IEnk FqFP? D00000011nk Y"?x CHyper-V AdministratorsOM<vkMC vkhQiC Op;;p9.vXD0L   $  Cryptographic OperatorsMembers are authorized to perform cryptographic operations.8j0 D0L   $  IIS_IUSRSBuilt-in group used by Internet Information Services.nk FqFHDD0000023Enk FqF@!0000023FvkCvkH]C vk(eXIYx="xLD0L   $  Event Log ReadersMembers of this group can read event logs from local machine(lf@ 0000000000000000,00000000000010000p2000050000H0000,0000>0000pB0000C0000pH0000H00000;0000N0000O0000XY0000x_0000 Membx Name(lfXAcce Admi BackACert8CrypDistpEven GuesDHypeIIS_2NetwX8Perf4PerfPowe+Prin RDS RDS (CRDS x,Remo_RemoRepl User $ vk!00vk!vvkcL >>D0L   $  Certificate Service DCOM AccessMembers of this group are allowed to connect to Certification Authorities in the enterprisenk FqF!HD00000241lfP?S-1-xS-1- S-1-lf7admi Admi@&Guesr-V Administratorsnk FqFH!ve00000242hbinPD0z !  # $P #  JFxFѢ 2?2D0L   $  RDS Remote Access ServersServers in this group enable users of RemoteApp programs and personal virtual desktops access to these resources. In Internet-facing deployments, these servers are typically deployed in an edge network. This group needs to be populated on servers running RD Connection Broker. RD Gateway servers and RD Web Access servers used in the deployment need to be in this group.@(h@D0L   $  RDS Endpoint ServersServers in this group run virtual machines and host sessions where users RemoteApp programs and personal virtual desktops run. This group needs to be populated on servers running RD Connection Broker. RD Session Host servers and RD Virtualization Host servers used in the deployment need to be in this group.nk Y"?x @DD#Access Control Assistance Operatorsnk FqFxI 00000243vkPaCypevktY_A,8D0L   $  RDS Management ServersServers in this group can perform routine administrative actions on servers running Remote Desktop Services. This group needs to be populated on all servers in a Remote Desktop Services deployment. The servers running the RDS Central Management service must be included in this group.8B,D0L   $  Hyper-V AdministratorsMembers of this group have complete and unrestricted access to all features of Hyper-V.nk Y"?x ERemote Management Usersnk MtFY00000244vkhcClf fWinRhbin`nk e4FP??D00000004nk e4FP??0000000Blf `0000x`0000PD0000 nk [cFp"#er000003E8CFD0L   $  Access Control Assistance OperatorsMembers of this group can remotely query authorization attributes and permissions for resources on this computer.HD.|D0L   $  Remote Management UsersMembers of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user.nk [cF"MDWinRMRemoteWMIUsers__lf`0000#Memb"Name vkjC vkForcePasswordResetnk w"?x000001F5  $  WinRMRemoteWMIUsers__st(pplications! D0d   $ #  UsersUsers are prevented from making accidental or intentional system-wide changes and can run most applications P*xD0L   $  WinRMRemoteWMIUsers__Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user.lDDDDDDDD\dh|D0DX[ $DJFxFѢ 2  AdministratordBuilt-in account for administering the computer/domainz~^$UZ!hbinp@ L8xD04    AdministratorsAdministrators have complete and unrestricted access to the computer/domainJFxFѢ 2JFxFѢ 2onD0DX$DJFxFѢ 2 [  administrationѨl!þѨlb! 4D0d   $ #  UsersUsers are prevented from making accidental or intentional system-wide changes and can run most applications JFxFѢ 2