SENNIN SECURITY Book 15 minutes
Menu

Research

Five Built-in Admin Commands on Windows: What a Commercial EDR Sensor Records

What a commercial EDR sensor recorded when five built-in Windows admin commands ran once on one lab host in the 12:45:05 PM PT run.

Sennin Security Labsv1.0.15 min read

Update

Correction 2026-10-20: the antivirus disclosure was rescoped to what was recorded (service running and set to start automatically; protection mode not recorded). The findings are unchanged.

A plain-English, vendor-neutral account of what a commercial endpoint detection and response (EDR) sensor recorded on one Windows lab host when five ordinary built-in admin commands ran once. EDR is security software that watches each computer and records what programs do. The product is not named.

The claim

"The EDR sensor's records showed each of the five commands. A check for alerts on this host, made about 38 minutes after the test (1:23 PM PT), returned none."

Disclosures

  1. The operating system's built-in antivirus was not turned off for this run. An earlier check on this host found its service running and set to start automatically; its protection mode and real-time protection setting were not recorded. It may block, log or quarantine activity independently of the EDR sensor under test, and it may affect what that sensor records or alerts on.
  2. The commands ran as the system account, delivered through the cloud platform's remote-command component, not from an interactive administrator session. That component's processes are part of the recorded activity.
  3. The host also ran the cloud platform's standard management components and virtualization drivers, and a background vulnerability scanner was installed; their other activity was not part of the test. A read-only check after the run found no cloud runtime-monitoring agent installed.
  4. The script also ran a registry query and a network-configuration command, but the host transcript was cut off by a 24 KB output limit partway through the service list, so those two commands are not claimed.
  5. The lab files were removed, and an empty lab folder created by the run was left on the host, confirmed by a read-only check at 1:32 PM PT. Nothing else was removed or changed.
  6. net user printed "The command completed with one or more errors."; it is quoted as captured, and no cause is given.

Environment

One Windows lab host with a commercial EDR sensor under test. Identifiers that could create exposure are not shown. Methods line: tested against a commercial EDR sensor; vendor not named.

Method and commands

In the 12:45:05 PM PT run, a host script checked that the host was clean, checked the EDR sensor's state read-only, started a short-lived lab marker process as a visibility control, then ran the commands below once. The command window was 19:45:05–19:45:08Z (12:45:05–12:45:08 PM PT), inside a host run that ended at 19:45:09Z. The EDR sensor was never stopped, disabled or reconfigured.

# Five built-in admin commands, run once as the system account (claimed)
whoami
hostname
net user
tasklist
sc.exe query
# Two further commands were in the script but their output was cut off
# by a 24 KB capture limit; they are not claimed:
#   reg query (a standard Windows version key)
#   ipconfig /all

What the sensor recorded (the 12:45:05 PM PT run)

"The EDR sensor's records showed each of the five commands. A check for alerts on this host, made about 38 minutes after the test (1:23 PM PT), returned none." The operating system's built-in antivirus was not turned off for this run. An earlier check on this host found its service running and set to start automatically; its protection mode and real-time protection setting were not recorded. It may block, log or quarantine activity independently of the EDR sensor under test, and it may affect what that sensor records or alerts on.

Host evidence: rendered terminal output (redacted)

These frames are rendered from the host transcripts, not live screenshots. Only labelled masks differ from the captured text. The first frame supports the baseline, the second the five commands, and the third the restore.

Baseline

Rendered terminal output (redacted): baseline. Precheck shows the host clean, and the EDR sensor's service and kernel driver were running before the test.
Rendered terminal output (redacted): baseline. Precheck shows the host clean, and the EDR sensor's service and kernel driver were running before the test.

The five commands

Rendered terminal output (redacted): the five admin commands (whoami, hostname, net user, tasklist, sc.exe query), shown as captured; the capture stops partway through the service list at the 24 KB limit.
Rendered terminal output (redacted): the five admin commands (whoami, hostname, net user, tasklist, sc.exe query), shown as captured; the capture stops partway through the service list at the 24 KB limit.

Restore

Rendered terminal output (redacted): restore. Lab files removed, and the EDR sensor and built-in antivirus still running in a later read-only check.
Rendered terminal output (redacted): restore. Lab files removed, and the EDR sensor and built-in antivirus still running in a later read-only check.

Key to the masks

  • [EDR-SENSOR-SERVICE], [EDR-SENSOR-KERNEL-DRIVER], [EDR-SENSOR-CONTAINER]: the EDR sensor's service, kernel driver and container processes
  • [OS-ANTIVIRUS-SERVICE], [OS-ANTIVIRUS-CORE-SVC], [OS-ANTIVIRUS-CORE], [OS-ANTIVIRUS-ENGINE], [OS-ANTIVIRUS-NIS], [OS-SECURITY-HEALTH]: the built-in antivirus and security-health services and processes
  • [built-in OS antivirus core service], [built-in OS firewall]: service display names of the built-in antivirus and firewall
  • [CLOUD-MGMT-AGENT], [CLOUD-MGMT-AGENT-WORKER], [CLOUD-MGMT-DOC-WORKER], [CLOUD-MGMT-USER]: the cloud platform's management (remote-command) service, its worker processes and its local account
  • [REDACTED-HOSTNAME]: the lab host name
  • [REDACTED-LAB-ID]: the lab identifier

Limitations

  • This is one Windows lab host and one run; it is not a statement about any other host, operating system or customer environment.
  • The operating system's built-in antivirus was not turned off for this run. An earlier check on this host found its service running and set to start automatically; its protection mode and real-time protection setting were not recorded. It may block, log or quarantine activity independently of the EDR sensor under test, and it may affect what that sensor records or alerts on.
  • The script also ran a registry query and a network-configuration command, but the host transcript was cut off by a 24 KB output limit partway through the service list, so those two commands are not claimed.
  • The commands ran as the system account, delivered through the cloud platform's remote-command component, not from an interactive administrator session.
  • The alert check was a single check about 38 minutes after the test; it says nothing about alerting at other times or for other activity.
  • Restore was confirmed for the lab files and the sensor state by two separate checks, at 12:45:16 and 12:52:35 PM PT. The in-script restore output was lost, and other host state was not compared.
  • The lab files were removed, and an empty lab folder created by the run was left on the host, confirmed by a read-only check at 1:32 PM PT. Nothing else was removed or changed.
  • This page makes no customer, product-comparison or scoring claim.

References

  1. SSS-RC-2026-043 Part 01 Validation memo (VAL-01)
  2. SSS-RC-2026-043 Part 01 evidence report, public-safe summary (2026-10-20)
  3. SSS-RC-2026-043 case record

Want to know if your endpoint defenses still work?

We test them in your environment and give you a plain written answer.

Book 15 minutes info@senninsecurity.com