User details

[Shahwaz_Md]

Hi Team,

Can we check user details on the XDR console - Local user with admin privileges?

Any way to identify such users?

Regards,

Shahwaz

[Vinothkumar_SBA]

Yes, you can easily check user privileges in the Cortex XDR console by following these steps:

1. Log in to the Cortex XDR management console.

2. Select Settings → Configurations → Access Management → Users.

3. In the Users page, you will find a variety of options to assist you in managing users

4. Please help out other users and “Accept as Solution” if a post helps solve your problem !
   
   Read more about how and why to accept solutions https://live.paloaltonetworks.com/t5/general-topics/how-and-why-to-accept-a-solution-to-your-post/td...

[aspatil]

Hello Shahwaz,

Do you mean the windows local account with admin rights?

[Shahwaz_Md]

Yes, correct. Any way to identify that through XDR.

[PiyushKohli]

Hi @Shahwaz_Md 

Thank you for writing to live community! Yes, you can identify windows user accounts with admin rights however it would require Host Insights License. If you have HI License, you may use "Users to Groups" under Host Inventory locate at Incident Response → Investigation → Host Inventory. User to Groups shows a list mapping of all the users, local and in your domain, to the existing user groups on an endpoint. And you may filter Group names by "Administrator" to look for users with Admin rights. 

For details you may check under here

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

[BrockJudd]

Accept as Solution