> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/network/windows-privilege-escalation/domain-and-local-groups.md).

# Domain and Local Groups

### Backup Operators

Members of the `Backup Operators` group may create privileged backups of any file on the system, including the `HKLM\SAM` and `HKLM\SECURITY` registry hives. These hives contain the NTLM password hashes of all local users on the system, including the local Administrator account. 

The attack has been highly automated through `nxc`:

```
nxc smb 10.10.10.10 -u backupop -p password -M backup_operator
```