User details

Showing results for 
Show  only  | Search instead for 
Did you mean: 

User details

L3 Networker

Hi Team,


Can we check user details on the XDR console - Local user with admin privileges?


Any way to identify such users?





L2 Linker

Yes, you can easily check user privileges in the Cortex XDR console by following these steps:

  1. Log in to the Cortex XDR management console.

  2. Select Settings → Configurations → Access Management → Users.

  3. In the Users page, you will find a variety of options to assist you in managing users

  4. Please help out other users and “Accept as Solution” if a post helps solve your problem !

    Read more about how and why to accept solutions

L3 Networker

Hello Shahwaz,


Do you mean the windows local account with admin rights?

Yes, correct. Any way to identify that through XDR.

L4 Transporter

Hi @Shahwaz_Md 


Thank you for writing to live community! Yes, you can identify windows user accounts with admin rights however it would require Host Insights License. If you have HI License, you may use "Users to Groups" under Host Inventory locate at Incident Response → Investigation → Host Inventory. User to Groups shows a list mapping of all the users, local and in your domain, to the existing user groups on an endpoint. And you may filter Group names by "Administrator" to look for users with Admin rights. 

For details you may check under here


Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

L0 Member

Accept as Solution

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!