# cygdrop --help
cygdrop is part of cygutils version 1.4.16
cygdrop was originally authored by Christian Franke
Execute COMMAND with a restricted access token
Usage: cygdrop [OPTIONS] COMMAND [ARG ...]
Group options
-l Disable local administrator group [default]
(same as '-g S-1-5-32-544').
-d Disable domain administrator group [default]
(same as '-g S-1-5-21-.\*-512').
-g GROUP Disable group(s) GROUP.
-G GROUP Disable all groups except group(s) GROUP.
-r GROUP Add group(s) GROUP to restricted SIDs.
Privilege options
-m Delete most privileges [default]
(same as '-P SeChangeNotifyPrivilege').
-p PRIV Delete privilege PRIV.
-P PRIV Delete all privileges except privilege PRIV.
General options
--help,-h Print this help.
--usage Display brief usage information.
--version Display version information.
--license Display licensing information.
-v Verbose output, lists groups and privileges changed.
Repeat to list all groups and privileges.
If no group or privilege option is specified, '-l -d -m' is the default.
Options with GROUP and PRIV parameter may be specified more than once.
GROUP may be specified as a SID, a regular expression matching SIDs
(must start with 'S-'), a numeric group id, or a group name.
PRIV name match is not case sensitive, prefix 'Se' and suffix 'Privilege'
may be omitted.