Ok, question: Is there any way to determine the admins on a (windows) system remotely WITHOUT code execution on the system

@nyanbinary

I think using gpresult maybe? I am not sure, but I figured I'd mention it just in case

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult

Edit: to clarify, this is for domain joined machines. If not domain joined I honestly would not know.

gpresult

Reference article for the gpresult command, which displays the Resultant Set of Policy (RSoP) information for a remote user and computer.