member name

(is | is not) literal name
(like | not like) wildcard expression
(matches | not matches) regular expression

Purpose

Warns when the specified local group's member account name do not match the specification.

Notes

This requirement may be repeated in the same section.

For “is”, “matches”, and “like” operators, one matching group member will satisfy the requirement.

Users are referenced in domain\user format
Don't forget that users in groups are referenced in domain\user format, not just the username.

Examples

# If any local group member's name matches wildcard expression "*MyUnit*",
# Martinet will not generate a warning about that group.
member name like *MyUnit*

Example output

Line 5: Found 21 local groups with immediate members whose name does not match wildcard expression “*MyUnit*”:

SID	Local group name	Local group description
S-1-5-32-579	Access Control Assistance Operators	Members of this group can remotely query authorization attributes and permissions for resources on this computer.
S-1-5-32-544	Administrators	Administrators have complete and unrestricted access to the computer/domain
S-1-5-32-551	Backup Operators	Backup Operators can override security restrictions for the sole purpose of backing up or restoring files
S-1-5-32-569	Cryptographic Operators	Members are authorized to perform cryptographic operations.
S-1-5-32-583	Device Owners	Members of this group can change system-wide settings.
S-1-5-32-562	Distributed COM Users	Members are allowed to launch, activate and use Distributed COM objects on this machine.
S-1-5-32-573	Event Log Readers	Members of this group can read event logs from local machine
S-1-5-32-546	Guests	Guests have the same access as members of the Users group by default, except for the Guest account which is further restricted
S-1-5-32-578	Hyper-V Administrators	Members of this group have complete and unrestricted access to all features of Hyper-V.
S-1-5-32-568	IIS_IUSRS	Built-in group used by Internet Information Services.
S-1-5-32-556	Network Configuration Operators	Members in this group can have some administrative privileges to manage configuration of networking features
S-1-5-32-585	OpenSSH Users	Members of this group may connect to this computer using SSH.
S-1-5-32-559	Performance Log Users	Members of this group may schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computer
S-1-5-32-558	Performance Monitor Users	Members of this group can access performance counter data locally and remotely
S-1-5-32-547	Power Users	Power Users are included for backwards compatibility and possess limited administrative powers
S-1-5-32-555	Remote Desktop Users	Members in this group are granted the right to logon remotely
S-1-5-32-580	Remote Management Users	Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user.
S-1-5-32-552	Replicator	Supports file replication in a domain
S-1-5-32-581	System Managed Accounts Group	Members of this group are managed by the system.
S-1-5-32-584	User Mode Hardware Operators	Members of this group may operate hardware from user mode.
S-1-5-32-545	Users	Users are prevented from making accidental or intentional system-wide changes and can run most applications

Examples

[local-group:Users]
# Local or domain user "fred" should be a member of the Users group.
member name matches ^.*\\fred$

Example output

Line 5: Found 1 local group with no member names which match regular expression /^.*\\fred$/:

SID	Local group name	Local group description	Local group members
S-1-5-32-545	Users	Users are prevented from making accidental or intentional system-wide changes and can run most applications	DESKTOP-RSL0MVD\jbn; NT AUTHORITY\Authenticated Users; NT AUTHORITY\INTERACTIVE