Practical Lab: Authentication Exploration

Objective

Look at your own identity inside Windows: your user name, SID, groups, privileges, saved credentials and sign-in methods. You only look. Nothing in this lab changes a setting, and nothing reveals a password.

Time: 25–30 minutes
You need: A Windows 10 or 11 PC. No extra software. A normal (non-admin) window is enough, except where noted.

What to Open

Tool	How to open it
Command Prompt	Press `Win`, type `cmd`, press Enter (normal, not admin)
PowerShell	Press `Win`, type `PowerShell`, press Enter (normal, not admin)
Task Manager	Press `Ctrl + Shift + Esc`
Credential Manager	Press `Win`, type `Credential Manager`, press Enter
Settings	Press `Win + I`

Part 1: Who Am I? (whoami)

In Command Prompt, type each line and press Enter:

whoami
whoami /user

Your name (computer\user or domain\user): ________________
Your SID: ________________
The RID (last number of your SID): ________________

On a home PC, your RID is usually 1000 or higher. If it ended in 500, you would be using the built-in Administrator account.

Part 2: Which Groups Am I In? (whoami /groups)

whoami /groups

Do you see Everyone (S-1-1-0)? ________________
Do you see BUILTIN\Users (S-1-5-32-545)? ________________
Do you see BUILTIN\Administrators (S-1-5-32-544)? What does its Attributes column say (for example "Group used for deny only")? ________________
What is your Mandatory Label (integrity level)? Medium, High or something else? ________________

If you are an administrator, in a normal window the Administrators group is marked "Group used for deny only". That is the filtered token from Section 3. It only becomes active when you elevate.

Part 3: What Rights Do I Have? (whoami /priv)

whoami /priv

How many privileges are listed? ________________
Is SeShutdownPrivilege listed? Is it Enabled or Disabled? ________________
Is SeDebugPrivilege listed? ________________ (A standard user will not see it; in a normal, non-elevated window an administrator usually will not either.)

Now see everything in one go:

whoami /all

Find your logon ID or session-related details, if shown. Where does your token's information list User Name, SID, Groups and Privileges? ________________

Part 4: Local Users and Groups

In PowerShell (normal window):

Get-LocalUser
Get-LocalGroup

How many local users are listed? ________________
Is Administrator shown as Enabled True or False? ________________
Is Guest enabled? ________________

Or, in Command Prompt:

net user
net localgroup

Does the list from net user match Get-LocalUser? ________________

net localgroup administrators lists the members of the Administrators group. Your account may be in it. This is read-only.

To see the SID of each local user (read-only):

Get-LocalUser | Select-Object Name, Enabled, SID

Which user has the RID 501? ________________

Part 5: Look at the Running Parts (Task Manager)

Open Task Manager, click More details, then the Details tab. Right-click a column header, choose Select columns, and tick User name and Session ID (if available).

What is the User name of winlogon.exe? ________________
What is the User name of lsass.exe? ________________
What is the User name of explorer.exe? ________________
Is there only one lsass.exe? ________________

Admin rights may be needed to see some details for system processes. If a column is blank, that is normal for non-admin windows.

Part 6: Credential Manager (View Only)

Open Credential Manager (Control Panel). Click Web Credentials, then Windows Credentials.

How many entries do you see under Windows Credentials? ________________
Pick one and click its arrow. What Type is it (Generic, Windows, certificate)? ________________

Do not click Remove or Edit unless you know you no longer need the entry. Viewing is enough.

In Command Prompt:

cmdkey /list

Do the entries match what you saw in the control panel? ________________ (The list shows names only, never passwords.)

Part 7: Kerberos Tickets (klist)

klist

Does it show Cached Tickets: (0) or a list? ________________

On a home PC (not in a domain) the list is empty. That is normal. Kerberos is mainly for domains. On a work PC joined to a domain, you will see tickets, including one for krbtgt (the TGT).

Part 8: Windows Hello Status (View Only)

Open Settings → Accounts → Sign-in options.

Which sign-in options are listed (face, fingerprint, PIN, security key, password)? ________________
Which are available on your PC and which are not supported? ________________
Is a PIN set up? (Do not change anything.) ________________

This needs administrator rights, so only try it on your own PC. Open Event Viewer (Win + R, type eventvwr.msc) → Windows Logs → Security. Use Filter Current Log and type 4624 (sign-in succeeded) or 4625 (sign-in failed).

How many 4624 events can you find from today? ________________

Hedge: the Security log may be empty or very large depending on settings. If you cannot open it, skip this part.

What Should Happen

Part 1 to 3 show your SID, groups and privileges, matching Sections 3 and 4.
Part 4 shows built-in accounts, with Administrator and Guest normally disabled.
Part 5 shows winlogon.exe and lsass.exe as SYSTEM and explorer.exe as you.
Parts 6 and 7 show saved credentials, and an empty Kerberos list on a home PC.
Part 8 shows which Windows Hello methods your PC supports.

Interpretation Guide

What you see	What it means
SID ends in 1000+	A normal user account you (or Windows setup) created
SID ends in 500	The built-in Administrator account (unusual to use daily)
`BUILTIN\Administrators` is "Group used for deny only"	Filtered token: you are an administrator but not elevated yet
Mandatory Label Medium	Normal, non-elevated process
Mandatory Label High	You are in an elevated (administrator) window
Many privileges Disabled	Normal: present but switched off until needed
`winlogon.exe`, `lsass.exe` run as SYSTEM	Expected
`explorer.exe` runs as your name	It carries your token (Section 8.5)
`klist` shows 0 tickets	No Kerberos in use (home PC or no domain)
Credential Manager entries named `MicrosoftAccount:...`	Normal items tied to your Microsoft account sign-in
Two `lsass.exe` or a wrong folder	Unusual: scan with your antivirus

Follow-Up Questions

Which command showed you a SID, and what does the RID tell you?
Why does whoami /groups show Administrators as "deny only" in a normal window but not in an "Run as administrator" window?
Why does explorer.exe show your name while lsass.exe shows SYSTEM?
Why is the klist list empty on a home PC?
Name two things this lab showed you that are invisible when you only use the desktop.