Windows 10: Why does CompatTelRunner.exe enumerate the builtin\Administrator's group?

Braaino · Oct 18, 2018

Hi,

I'm aware that CompatTelRunner.exe is a legit Microsoft performance analysis tool, which sends telemetry data back to Microsoft so they can better their product. Apart from numerous complaints about performance impacts caused by this executable, I was surprised today to find it also enumerates the built-in Administrator's group on my Windows10 workstation...! What is the process doing enumerating this (or really any) group?? I'll paste the event below:

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 10/18/2018 3:24:52 AM
Event ID: 4799
Task Category: Security Group Management
Level: Information
Keywords: Audit Success
User: N/A
Computer: mywin10.<mydomain>.com
Description:
A security-enabled local group membership was enumerated.

Subject:
Security ID: SYSTEM
Account Name: MYWIN10$
Account Domain: <MYDOMAIN>
Logon ID: 0x3E7

Group:
Security ID: BUILTIN\Administrators
Group Name: Administrators
Group Domain: Builtin

Process Information:
Process ID: 0x1bd4
Process Name: C:\Windows\System32\CompatTelRunner.exe

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4799</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13826</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2018-10-18T10:24:52.478717900Z" />
<EventRecordID>573250</EventRecordID>
<Correlation ActivityID="{47AAF424-0322-0001-75F4-AA472203D401}" />
<Execution ProcessID="616" ThreadID="5408" />
<Channel>Security</Channel>
<Computer>mywin10.<mydomain>.com</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetUserName">Administrators</Data>
<Data Name="TargetDomainName">Builtin</Data>
<Data Name="TargetSid">S-1-5-32-544</Data>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">MYWIN10$</Data>
<Data Name="SubjectDomainName">MYDOMAIN</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="CallerProcessId">0x1bd4</Data>
<Data Name="CallerProcessName">C:\Windows\System32\CompatTelRunner.exe</Data>
</EventData>
</Event>

Why does a performance telemetry tool need to do this?

:)

tamara_sadel · Oct 18, 2018

builtin\administrators

If it is using that much space it may be your OWN profile.

Go to C:\Users, check the space each user is using if you profile is the same as 60GB, I would not recommend deleting it as its your profile.

That builtin\administrators is the administrator group.

Brink · Oct 18, 2018

What’s new in Office 365 Groups administration

Last December, we announced that Office 365 Groups are now supported by eDiscovery. Since then, we’ve delivered a number of updates to help administrators govern and manage Office 365 Groups, which provides cross-application group membership to enable teams to easily collaborate in their favorite apps.
The following capabilities are available today to all Office 365 commercial and education customers:

Ability to update privacy type—When you create an Office 365 group, users have two privacy options: public (anyone within your organization can access the group’s content) and private (only approved members can access the group’s content). This update enables group owners to change the privacy setting from public to private or vice versa by editing the group properties in Outlook on the web. Administrators can also leverage the Set-UnifiedGroup cmdlets to change the privacy type. Read “Make Office 365 groups public or private” for more information.

$Why does CompatTelRunner.exe enumerate the builtin\Administrator's group? [IMG]$

Easily edit a group’s privacy setting.

Multi-domain support—Larger organizations use separate email domains to reflect different parts of their businesses. Office 365 groups that are created by users in one domain will share that domain (as opposed to using a common domain across the tenant). Administrators now also have control to create groups in specific domains of their choosing. Read “Multi-domain support for Office 365 Groups” for more information.

Guidance to configure Office 365 Groups with on-premises Exchange mailbox users—If you’ve configured a hybrid deployment between your on-premises Exchange organization and Office 365, you can make groups created in Office 365 available to your on-premises users by following the steps outlined in “Configure Office 365 Groups with on-premises Exchange hybrid.”

Allow users to send as the Office 365 group—If you want to enable your group’s shared mailbox to “Send As,” you can now use the PowerShell cmdlets to configure this. Once you enable this setting, your Office 365 group users can use Outlook or Outlook on the web to send and reply to email as the Office 365 group. Users can go to the group, create a new email and change the “Send As” field to the group’s email address. See “Use PowerShell to manage Office 365 Groups” for more information.

In addition to the above improvements, the following capabilities are starting to roll out today and expected to be fully deployed by the end of July:

Creation policy in Azure Active Directory—We’ve implemented policy in Azure Active Directory that allows administrators to restrict group creation to certain users. This ensures that the creation of Office 365 groups through all endpoints, such as Planner and Power BI, can be given to selected users. The existing Exchange Mailbox policy only applies to creation in Exchange.

Usage guidelines—You’ll be able to define usage guidelines for Office 365 Groups—to educate your users about best practices that help keep their groups effective and educate them on internal content policies.

Data classification and extensible policy—You’ll be able to create a customizable data classification system for Office 365 Groups that allows separation of groups by policy type (e.g., “unclassified,” “corporate confidential” or “top secret”). In this manner, your groups can exhibit the policies of other content in your organization. Extensible policy allows your organization to configure an endpoint that is called whenever a group is created or changed—and you can then implement your own policies for group creation or change.

Mobile application management—To protect users’ data on the go, we’re working on exposing the Outlook Groups mobile apps in Microsoft Intune as policy-managed apps.

We are continually investing in Office 365 Groups to improve the administration experience. See the key items below that are on our roadmap:

Exchange Admin Center (EAC) UI for migrating Distribution Lists (DLs) to groups—Building on the scripts we released (mentioned above) for DL migration, you will soon be able to migrate a DL to a group directly from the Exchange Admin Center with one click!

Naming policy in Azure Active Directory—Administrators will be able to configure a policy for appending text to the beginning or end of a group’s name and email address no matter where the group is created (e.g., Outlook, Planner, Power BI, etc.). Administrators can also configure a list of specific blocked words that can’t be used in group names and also rely on the native list of thousands of blocked words to keep their directories clean.

Ability to search for private Groups files—By integrating Groups files (stored in a SharePoint document library and surfaced in OneDrive for Business) and Office Delve, users will be able to search content from both public and private groups as long as they’re a member.

In addition to the governance and administration innovations mentioned above, we plan to deliver the following key features in the second half of this year to continue helping you work across teams and organizations: the ability to add external members to a group, a SharePoint team site for every group and integration of Yammer groups with the Office 365 Groups service.

For more information about upcoming improvements to Office 365 Groups, please visit fasttrack.microsoft.com/roadmap. We also look forward to seeing you at Ignite, September 26–30 in Atlanta, where we’ll be sharing details on these recent Office 365 Groups innovations and more.

—Christophe Fiessinger, @cfiessinger, senior product manager for the Office 365 marketing team
Click to expand...

Source: What's new in Office 365 Groups administration—June 2016 update - Office Blogs

Deepika Gowda · Oct 18, 2018

Windows 10 error: "Windows couldn't connect to the Group Policy Client service. Please consult your system administrator"

Hi Rico,

Thank you for posting in Microsoft Community, we appreciate your interest in Windows 10.

I understand the inconvenience you are facing with accessing the operating system.

Do let us know the following to assist you better:

Which edition of Windows Operating System are you using?

What all the troubleshooting steps have you performed?

Have you installed all the pending updates on your Operating System?

Have you installed any third-party anti-virus software on your system?

I suggest you to try few of the below troubleshooting steps and check if it helps.

I suggest you to Stop the Group Policy service, restart and set it to Automatic.

Group Policy Client service, this service is responsible for applying settings configured by administrators for the computers and users through the Group Policy component. If the service
is disabled the settings will be applied and applications and components will not be manageable through Group Policy.

Step 1: Stop the Group Policy Client service.

Press Windows Key + R on the keyboard and type
services.msc, Services window gets opened.

Search for Group Policy Client service, right click on it and click on
Stop.

Restart the computer.

Step 2: Start the service and set it to automatic:

Press Windows Key + R on the keyboard and type
services.msc, Services window gets opened.

Search for Group Policy Client service, right click on it and click on
Properties.

Start the service, set
Startup type to Automatic.

Hope it helps. Reply to the post with an updated status of this issue for further assistance.

Windows 10: Why does CompatTelRunner.exe enumerate the builtin\Administrator's group?

Why does CompatTelRunner.exe enumerate the builtin\Administrator's group?

Why does CompatTelRunner.exe enumerate the builtin\Administrator's group?

Why does CompatTelRunner.exe enumerate the builtin\Administrator's group?

Why does CompatTelRunner.exe enumerate the builtin\Administrator's group? - Similar Threads - Why does CompatTelRunner

many "A user's local group membership was enumerated" events

many "A user's local group membership was enumerated" events

Device is not enumerating while issuing powercycle through devcon64.exe command

why does an exe stop working on some machines?

CompatTelRunner issues

CompatTelRunner issues

CompatTelRunner issues

System User Group - Devcon exe

Compattelrunner- make it stop!

Users found this page by searching for:

how tyo edit administrators group in compattelrunner.exe

teams camera not working

compattelrunner.exe task reenables