The following variables are available when defining the account names of a user rights assignment value.

NOTE: All variables must be surrounded in square brackets and are case-insensitive.


[ACCOUNT_OPERATORS]

The localized account name of the built-in account operators group. This only applies to domain controllers.


[ADMINISTRATORS]

The localized account name of the built-in administrators group.


[AUTHENTICATED_USERS]

The localized account name of the authenticated users group.


[BACKUP_OPERATORS]

The localized account name of the built-in backup operators group.


[DEVICE_OWNERS]

The localized account name of the built-in device owners group. This only applies to Windows 10, Windows Server 2019 and above.


[GUESTS]

The localized account name of the built-in guests group.


[IIS_USRS]

The localized account name of the built-in IIS_USRS group.


[LOCAL_SERVICE]

The localized account name of the local service account.


[MACHINENAME]

The NetBIOS name of the computer.


[NETWORK_SERVICE]

The localized account name of the network service account.


[PERFORMANCE_LOG_USERS]

The localized account name of the built-in performance log users group.


[PRINT_OPERATORS]

The localized account name of the built-in print operators group. This only applies to servers.


[REMOTE_DESKTOP_USERS]

The localized account name of the built-in remote desktop users group.


[SERVER_OPERATORS]

The localized account name of the built-in print operators group. This only applies to domain controllers.


[SERVICE]

The localized group name of accounts authorized to log on as a service.


[SYSTEM]

The localized account name of the local system account.


[S-1-5-32-547]

The localized account name of any valid security identifier including all well known security identifiers.


[USERS]

The localized account name of the built-in users group.