splunk-security_content/lookups/builtin_groups_lookup.csv

1	builtin_group_string	builtin_group_name
2	AA	Access control assistant operators
3	AN	Anonymous logon
4	AO	Account operators
5	AP	Protected users
6	AU	Authenticated users
7	BA	Built-in administrators
8	BG	Built-in guests
9	BO	Backup operators
10	BU	Built-in users
11	CA	Certificate server administrators
12	CG	Creator group
13	CO	Creator owner
14	CY	Crypto operators
15	DA	Domain administrators
16	DC	Domain computers
17	DD	Domain controllers
18	DG	Domain guests
19	DU	Domain users
20	EA	Enterprise administrators
21	ED	Enterprise domain controllers
22	ER	Eventlog readers
23	ES	Endpoint servers
24	HA	Hyper-V administrators
25	IS	Anonymous internet users
26	IU	Interactively logged-on user
27	KA	Domain key administrators
28	LA	Local administrator
29	LG	Local guest
30	LS	Local service account
31	LU	Performance log users
32	MS	Management servers
33	MU	Performance monitor users
34	NO	Network configuration operators
35	NS	Network service account
36	NU	Network sign-in user
37	PA	Group Policy administrators
38	PO	Printer operators
39	PS	Personal self
40	PU	Power users
41	RC	Restricted code
42	RD	Terminal server users
43	RE	Replicator
44	RS	RAS servers group
45	RU	Alias to allow previous Windows 2000
46	SA	Schema administrators
47	SO	Server operators
48	SU	Service sign-in user
49	SY	Local system
50	WD	Everyone