[Answered] Deleted LocalService/NetworkService - broke Admin Privilege detection

Discussion in 'Windows 10' started by OpenSourceGhost, Jul 22, 2022.

  1. OpenSourceGhost

    OpenSourceGhost MDL Member

    Feb 14, 2022
    170
    24
    10
    #1 OpenSourceGhost, Jul 22, 2022
    Last edited: Jul 23, 2022
    There was an accidental deletion of the following directories:
    "C:\Windows\ServiceProfiles\LocalService"
    "C:\Windows\ServiceProfiles\NetworkService"

    Afterwards, administrator privileges stopped being detected by some scripts, such as the scripts made by abbodi1406 (KMS_VL_ALL_AIO, VC++ Redist), but actual privileges remained functional. Administrative privilege application itself was not affected. I continued to be able to execute programs as administrator and as TrustedInstaller via NSudo. Only detection of privileges was affected. For example, attempting to run KMS_VL_ALL_AIO.cmd as administrator or System or TrustedInstaller began displaying the following error:
    Code:
    ==== ERROR ====
    This script requires administrator privileges.
    To do so, right-click on this script and select 'Run as administrator'
    
    Press any key to exit.
    Again, only administrative privilege detection was affected. Would it be possible to restore it without restoring contents from "LocalService" and "NetworkService" directories?
     
  2. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    17,223
    90,880
    340
    You could try to replace
    Code:
    reg query HKU\S-1-5-19
    with
    Code:
    whoami /groups | find /i "S-1-16-12288"
     
  3. OpenSourceGhost

    OpenSourceGhost MDL Member

    Feb 14, 2022
    170
    24
    10
    Didn't work - same error... Is it possible to completely remove admin verification from the script or force it to assume admin privileges as default?
     
  4. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    17,223
    90,880
    340
    Add
    Code:
    goto :Passed
    above this line
    Code:
    1>nul 2>nul reg query HKU\S-1-5-19 && (
     
  5. AveYo

    AveYo MDL Expert

    Feb 10, 2009
    1,836
    5,730
    60
    That's good for admin level, but he's using system / ti, so it should be:
    Code:
    whoami /groups | findstr /i /c:"S-1-16-16384" /c:"S-1-16-12288" >nul
    or just
    Code:
    whoami | findstr /i /c:"nt authority\system" >nul
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    17,223
    90,880
    340
    This seems to work
    Code:
    whoami /priv | find /i "SeTakeOwnershipPrivilege"
     
  7. ohenry

    ohenry MDL Senior Member

    Aug 10, 2009
    436
    270
    10

    Works here. 22622.436
    Code:
    
    C:\Windows\System32>whoami /priv | find /i "SeTakeOwnershipPrivilege"
    
    C:\Windows\System32>sudo whoami /priv | find /i "SeTakeOwnershipPrivilege"
    SeTakeOwnershipPrivilege                  Take ownership of files or other objects                           Disabled
    
    C:\Windows\System32>
    
    The "sudo" is from the "gsudo" package.
     
  8. OpenSourceGhost

    OpenSourceGhost MDL Member

    Feb 14, 2022
    170
    24
    10
    That worked! Thank you!