Domain group membership searches

Every Windows domain has groups used for implementing the principle of least privilege. This includes default groups such as “Domain Administrator” and may include custom groups created by your organization. Each time a logon event occurs on an endpoint, Logon Tracker enriches the user account information with the local and domain groups that the account belongs to. This data enables group membership searching in the UI.

This feature is extremely powerful in the context of lateral movement investigations, and even more so if you understand the privileges of the groups in your domain. For example, if the “IT Admins” group has Domain Administrator privileges, it might be useful to review all logon activity observed for accounts belonging to this group.