What is the purpose of the "Authenticated Users" group in Windows? Under Linux it doesn't exist and I'm starting to think this is another idiosyncrasy or over-engineering of the Windows operating system.

Here is why:

Assume I want to know what rights has the user Mike on disk C:\, I will type:

net user mike

and will be returned:

User name                    mike
Full Name                    
User's comment               
Country code                 000 (System Default)
Account active               Yes
Account expires              Never

Password last set            7/13/2013 7:55:45 AM
Password expires             Never
Password changeable          7/13/2013 7:55:45 AM
Password required            Yes
User may change password     Yes

Workstations allowed         All
Logon script                 
User profile                 
Home directory               
Last logon                   7/13/2013 7:53:58 AM

Logon hours allowed          All

Local Group Memberships      *Users            
Global Group memberships     *None

I therefore assume the user mike belongs to group Users only, so I will check the security tab with a right click on the disk C and will see that users belonging to the "Users" group cannot modify the disk c but only read it.

Surprise surprise however, user mike will be able to write to C:\ !!! Why? because the command net cannot know it but mike also belongs to the Authenticated Users group which has right to write on C:!!

Can someone confirm the above story, comment whether it makes any sense or as I doubt it is a case of over-engineering and elaborate on the reasons behind this?


Notice the net command correctly shows groups if I create a new group and add user mike to it.

 net localgroup testgroup /add
 net localgroup testgroup mike 
 net user mike


Local Group Memberships      *Users     *testgroup       
Global Group memberships     *None
  • Excuse my ignorance, but why can't the command net know that mike also belongs to another group? The plural in "Local Group Memberships" makes me think it should be able to see all groups to which mike belong.
    – Lex
    Commented Jul 12, 2013 at 12:16
  • 2
    That's exactly my point, it should list all groups but it doesn't! My "the command net cannot know it but mike also belongs to the Authenticated Users group" is a stating of the facts under Windows 7.
    – dendini
    Commented Jul 12, 2013 at 12:28
  • what if you create a new group, such as caesar for instance, and add mike to that group, would it show as output of the net command then?
    – Lex
    Commented Jul 12, 2013 at 12:35
  • see my edit, anyway it correctly shows groups caesar under mike's groups.
    – dendini
    Commented Jul 12, 2013 at 13:09
  • so you have a very good question here. Definitely a +1.
    – Lex
    Commented Jul 12, 2013 at 13:23

3 Answers 3


There are a number of special groups in Windows. Included among these are Authenticated Users, Interactive Users, Everyone, etc. These days, Everyone and Authenticated Users are effectively equivalent for most purposes, but if you had a pre-2003 domain level domain that would not be true.

In any event, there is no way to observe the membership of these groups. In a sense the membership is calculated when a SACL or DACL is processed.

That said, it seems strange to me that you would be assigning permissions in the file system to authenticated users, especially C:\. A more appropriate setting would be Interactive Users or, if you're locking down workstations, read only.

The technical definitions of these two, according to Microsoft, are:

Authenticated Users:

Any user accessing the system through a logon process has the Authenticated Users identity. This identity allows access to shared resources within the domain, such as files in a shared folder that should be accessible to all the workers in the organization.


All interactive, network, dial-up, and authenticated users are members of the Everyone group. This special identity group gives wide access to a system resource.

You can find these for yourself, along with all others, here: http://technet.microsoft.com/en-us/magazine/dd637754.aspx

  • 3
    "Authenticated Users specifically does not contain the built-in Guest account, but will contain other users created and added to Domain Guests." SOURCE
    – Pressacco
    Commented Jan 19, 2015 at 2:49
  • 1
    The craziest thing happens when you realise Allow Local Logon by default contains Users, which itself contains Authenticated Users & Interactive. Let's break this down, shall we? -/- A hypothetical user is not a member of Users. Thus, they're not allowed to log in. Yet, by trying to log in & achieving the feat of remembering their password, they get added to a hidden group. Which is part of Users & hence is allowed to log in. -/- So, you're not allowed to log in. Unless you manage to log in, in which case you're allowed to log in. So, you can't log in--unless you can. Microsoft Commented Oct 12, 2015 at 10:50
  • 1
    underscore_d, these integrated groups/principals are not assigned to users, but to individual sessions. So even if somebody logged on, his "other" not logged on session would not get this. Or another more realistic example: If I'm logged on interactively and at the same time access a shared folder from another machine, my interactive session will have INTERACTIVE principal but my remote one will not, although both are logged with the same user.
    – mihi
    Commented Jan 24, 2016 at 12:53
  • 2
    and you can use whoami /ALL to see all your principals for the current session, also integrated ones.
    – mihi
    Commented Jan 24, 2016 at 12:55

Authenticated users means exactly that - any and all users which have authenticated to the system. That would be any user that is a member of any group on your local system.

Since Mike is a member of users he is inherently an authenticated user.

In a domain environment this would be any user that is a member of any group on the domain.

  • 1
    Why then net command doesn't show "Authenticated Users" in the users of mike? what is Authenticated Users? a group or something else? I get your point but your answer makes the whole thing look even more arcane.
    – dendini
    Commented Jul 12, 2013 at 14:27
  • For the reason stated in the accepted answer. :) Commented Feb 6, 2014 at 1:11

So if the file system is NTFS and Mike is denied write privilege's in one group then he should be denied write privilege's in all groups because a deny overrides an allow. So it won't matter what access Mike is given from the pseudo group Authenticated Users if the Deny box is checked in the Users group for write or whatever else. I get your point of why doesn't it show all groups and can't answer that more than other have, but at least you known someone won't have a certain permission by using deny.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .