Local administrator account remote logon in Windows

What it is

A pentest walkthrough of why local administrator accounts on domain-joined Windows hosts fail to get an admin token over network logon, and the two registry keys that govern the exception. Demonstrated against a Windows 11 target (DESKTOP-5TJUSRP) from Kali using nxc, impacket psexec/smbexec, and WinRM.

How it works

NTLM network logons for local admins are subject to UAC remote restrictions: the token is filtered to a standard-user token, so admin actions (writing to admin shares for psexec/smbexec DLL drop, WinRM) return access-denied — even with valid credentials that authenticate successfully. Two registry values change this, both under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System:

• LocalAccountTokenFilterPolicy — governs non-RID-500 local admins. Default is absent, treated as 0 (filtered). Set to 1, the logon builds a full admin token and psexec works.
• FilterAdministratorToken — governs the RID 500 account (default name Administrator). Default is 0, meaning the RID 500 account is not filtered and retains admin rights remotely by default.

flowchart TD
    A[Local admin, NTLM network logon] --> B{RID 500 account?}
    B -->|Yes| C{FilterAdministratorToken}
    C -->|0, default| G[Full admin token]
    C -->|1| F[Filtered token]
    B -->|No| D{LocalAccountTokenFilterPolicy}
    D -->|absent/0, default| F
    D -->|1| G
    A -.SSH / RDP.-> G

Preconditions / Affected

You need valid credentials for a local account in the target's Administrators group — typically obtained by dumping the SAM of one host and replaying against others built from the same "gold image" that shares a local admin. Note: RID 500 Administrator is disabled by default on Windows 11 install (the author had to enable it to test), and LAPS in AD environments makes RID 500 compromise unlikely.

What to do

During assessments, check both keys — a non-default value is uncommon but admins sometimes enable it:

• If LocalAccountTokenFilterPolicy is 1, non-RID-500 local admins get full remote tokens.
• If FilterAdministratorToken is 1, the RID 500 account is filtered (not the default).

Even with a filtered token, some protocols are not UAC-filtered and give full access:

• SSH
• RDP (interactive logon, per Microsoft's guidance for SAM-account administration)

A filtered token still permits enumerating and browsing SMB shares the user can access.

Caveats

The author notes Will Schroeder documented this same behaviour in 2017; this post reframes it with commands. The page's final "SMB shares" section is cut off mid-sentence, and several steps reference screenshots not present in the text.