I've set up a test domain with a Windows 2012 domain controller, and a Windows 7 client. The domain user 'User1' is logged on to the client machine, and is only a member of Domain Users:

C:\Users\User1.HYPERION> net user User1 /domain
Local Group Memberships
Global Group memberships     *Domain Users

This user is not a member of the local administrators group on the domain controller:

C:\Users\Administrator> net localgroup Administrators
Domain Admins
Enterprise Admins

Why does this domain user, logged on to a client, seem to have permission to query services on the domain controller?

C:\Users\User1.HYPERION> sc \\DC qc spooler
[SC] QueryServiceConfig SUCCESS

AFAIK, Authenticated Users have permissions to query services, as defined on the security descriptor of those services.

Have a read at the link for more info:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.