# Users & Groups

> Master Windows identity and access management. Explore local accounts, the SAM database, NTLM vs. Kerberos, and how attackers abuse tokens and UAC for privilege escalation.

Canonical: https://codelivly.com/rooms/users-groups
Last updated: 2026-07-02

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 200 |

Dive into the core of Windows identity and access management. The Users & Groups module breaks down how Windows authenticates users, stores credentials, and assigns privileges.

You will explore the local SAM database, the critical role of the LSASS process, and the fundamental differences between NTLM and Kerberos authentication protocols. We will then examine how Security Identifiers (SIDs) and Access Tokens control resource access, and how attackers abuse User Account Control (UAC) and token manipulation to escalate privileges from standard user to SYSTEM. By the end of this module, you will understand how to secure Windows identities and detect credential theft and privilege escalation attacks.

## Lessons

1. Local Accounts, the SAM Database, and LSASS (30 min)
2. Windows Authentication Protocols (30 min)
3. Security Groups, SIDs, and Token Privileges (30 min)
4. User Account Control (UAC) & Privilege Escala (30 min)

## Related

- [Learning path: Windows Fundamentals](https://codelivly.com/learning-paths/windows-fundamentals)
- [All rooms](https://codelivly.com/rooms)