win-user-scan (Windows User Scanner v1.0.2)

A lightweight Windows executable program with a clean graphical user interface designed to audit all user profiles on a local machine. This tool natively uses Windows APIs to map out usernames against their Security Identifiers (SID), Relative Identifiers (RID), and assigned local groups in a clear, copy-pasteable format.

What is it used for?

This tool is highly effective for identifying hidden privilege escalation or unauthorized accounts. It helps you quickly spot unexpected user profiles pretending as normal users but holding elevated privileges (e.g., an unassuming "Guest" account secretly holding a built-in Administrator RID of 500 or assigned to the Administrators group).

---

Features and Core Mechanics

Interface Components

• Run User Audit: Calls the system APIs to search local databases and inserts the text workspace with structured, columnar account information.
• Save Audit Logs: Writes the current console workspace text into a structured .log format inside a dynamically created /Logs folder in the program's working directory.
• Exit Program: Initiates a graceful exit workflow with an alert window, prompting you to save or discard any unsaved active audit data.

System Auditing Controls

• Local User Discovery: Scans the operating system user database to completely enumerate active and inactive local profiles.
• getRID() Logic: Extracts and isolates the proper Relative Identifier (RID) to quickly identify system privilege tiers (such as the default Administrator account at RID 500).
• getSID() Mapping: Acquires and processes the full Security Identifier (SID) string for precision identity context mapping.
• getGroups() Inventory: Cycles through account databases to get primary and nested local group memberships tied to every profile.

---

Code Structure

The application separates frontend user interface from information collection to remain clean, modular, and easy to optimize:

├── GUIscanner.py          # Application frontend (CustomTkinter GUI layout)
└── accountscanner.py      # Auditing engine (Win32 API backend & file utility)

• GUI Foundations (GUIscanner.py): A modern, responsive user window with direct data presentation and state monitoring.
• Modular Backend (accountscanner.py): Isolates native system library execution entirely from the interface loop for reliable execution.
• Efficient User Footprint: Self-contained architecture that groups complex account criteria into a single workspace built for quick copying or file archiving.

---

Installation and Local Execution

System Requirements

• OS: Windows 10 / Windows 11
• Python Environment: Python 3.11+ (preferably latest)

Quick Start

1. Clone or download this project directory to your computer.
2. Open your terminal of choice (Git Bash, Command Prompt, etc.) inside the project folder.
3. Install the native dependencies:

   pip install customtkinter pywin32 pyinstaller

4. Boot the script directly:

   python GUIscanner.py

---

Using the Standalone Executable (.exe)

There is as well a standalone executable program that can be downloaded and booted directly off the releases tab.

---

Security and Operational Permissions

Because this program explicitly targets core local system accounts via protected Windows system interfaces (win32net.NetUserEnum and win32net.NetUserGetLocalGroups), security restrictions apply. Depending on local User Account Control (UAC) layouts or administrative group configurations, you may need to Right-Click > Run as Administrator on the finalized binary to successfully read nested token memberships of system-protected accounts.

Repository Notes

• Clean Footprint: Includes a pre-configured .gitignore blueprint to keep your repository free of locally generated runtime files, build objects, or compiled caches.
• Open Source Licensing: This repository is completely open-source, free to use, and distributed under the MIT License.