PowerShell Local User Management

Local user and group management in PowerShell is handled through the Microsoft.PowerShell.LocalAccounts module. This module provides cmdlets to query, create, modify, and delete local user accounts and manage local security group memberships directly as strongly typed objects, replacing legacy tools like net.exe user, net.exe localgroup, and the Local Users and Groups (lusrmgr.msc) GUI console.

Querying Local Users with Get-LocalUser

The Get-LocalUser cmdlet enumerates local user accounts residing in the Windows Security Account Manager (SAM) database.

Get-LocalUser

Name          Enabled  Description
----          -------  -----------
Administrator False    Built-in account for administering the computer
Guest         False    Built-in account for guest access
jsmith        True     Standard local user account

Getting a Specific User

Get-LocalUser -Name "jsmith"

where -Name is the username to look up; supports wildcards (e.g., "js*").

Name    Enabled Description
----    ------- -----------
jsmith  True    Standard local user account

Creating a User with New-LocalUser

The New-LocalUser cmdlet provisions a new local user account in the SAM database.

$password = Read-Host -AsSecureString -Prompt "Enter password"
New-LocalUser -Name "kwhite" -Password $password -FullName "Karen White" -Description "Marketing team"

where:

• -Name: the username for the new account.
• -Password: a SecureString with the account's password.
• -FullName: the user's display name.
• -Description: an optional description for the account.

Name    Enabled Description
----    ------- -----------
kwhite  True    Marketing team

Creating a User Without Password Expiration

New-LocalUser -Name "svc-backup" -Password $password -PasswordNeverExpires -AccountNeverExpires

where:

• -PasswordNeverExpires prevents the account's password from expiring under domain/local policy.
• -AccountNeverExpires prevents the account itself from having an expiration date.

Complete Creation Example

$password = ConvertTo-SecureString "P@ssw0rd2026!" -AsPlainText -Force

New-LocalUser -Name "svc_backup" `
    -Password $password `
    -Description "Dedicated service account for file backups" `
    -PasswordNeverExpires `
    -UserMayNotChangePassword

Get-LocalUser -Name "svc_backup" | 
    Select-Object -Property Name, Enabled, PasswordNeverExpires, Description

where:

• ConvertTo-SecureString converts plaintext into an encrypted string stored in memory, as required by credential cmdlets.
• New-LocalUser provisions a new account in the local SAM database.
• -UserMayNotChangePassword prevents the user from altering their assigned password.
• Get-LocalUser retrieves the user object and its properties from the local security database.

./create-local-user.ps1

Name       Enabled PasswordNeverExpires Description
----       ------- -------------------- -----------
svc_backup    True                 True Dedicated service account for file backups

Modifying a User with Set-LocalUser

The Set-LocalUser cmdlet updates properties of an existing local user account (such as descriptions, enabled state, or password expiration).

Set-LocalUser -Name "jsmith" -Description "Updated: Sales department" -FullName "John Smith"

where:

• -Name is the username to modify.
• -Description / -FullName are properties being updated on the account.

Disabling and Enabling Accounts

Disable-LocalUser -Name "jsmith"
Enable-LocalUser -Name "jsmith"

Resetting a Password

$newPassword = Read-Host -AsSecureString -Prompt "Enter new password"
Set-LocalUser -Name "jsmith" -Password $newPassword

Combined Modification Example

Set-LocalUser -Name "svc_backup" -Enabled $false -Description "Decommissioned backup account"

Get-LocalUser -Name "svc_backup" | Select-Object -Property Name, Enabled, Description

where:

• Set-LocalUser modifies the configuration of an existing local account.
• -Enabled $false disables the user account, blocking interactive and network authentication.
• -Description modifies the administrative description associated with the user.

./manage-local-user.ps1

Name       Enabled Description
----       ------- -----------
svc_backup   False Decommissioned backup account

Removing a User with Remove-LocalUser

The Remove-LocalUser cmdlet permanently deletes a local user account from the SAM database.

Remove-LocalUser -Name "kwhite"

where -Name is the username of the account to remove.

Managing Local Groups

Local groups (like Administrators, Users, Remote Desktop Users) manage permissions for resources and define user capabilities. These include Remote Desktop access, administrative privileges, and backup operator roles. The Microsoft.PowerShell.LocalAccounts module provides cmdlets to inspect and modify group memberships: Get-LocalGroup, Get-LocalGroupMember, Add-LocalGroupMember, and Remove-LocalGroupMember.

Viewing Group Membership with Get-LocalGroupMember

Get-LocalGroupMember -Group "Administrators"

ObjectClass  Name                    PrincipalSource
-----------  ----                    ---------------
User         DESKTOP-01\Administrator Local
User         DESKTOP-01\jsmith        Local

where:

• -Group is the name of the local group to inspect.
• PrincipalSourceis identifies where the account originated (Local, ActiveDirectory, or AzureActiveDirectory).

Adding a User to a Group with Add-LocalGroupMember

Add-LocalGroupMember -Group "Administrators" -Member "jsmith"

where:

• -Group is the target local group.
• -Member is the username (or array of usernames) to add to the group.

Complete Group Membership Example

$pass = ConvertTo-SecureString "TempAccess2026!" -AsPlainText -Force
New-LocalUser -Name "contractor_john" -Password $pass -AccountNeverExpires | Out-Null

Add-LocalGroupMember -Group "Remote Desktop Users" -Member "contractor_john"

Get-LocalGroupMember -Group "Remote Desktop Users" | 
    Select-Object -Property Name, PrincipalSource, ObjectClass

where:

• Add-LocalGroupMember assigns one or more local or domain users/groups to a local group.
• -Group is the target local security group name (e.g., Administrators, Remote Desktop Users).
• -Member is the user account, group, or SID string being added.
• Get-LocalGroupMember lists all members currently assigned to the specified local group.

./manage-group-membership.ps1

Name                      PrincipalSource ObjectClass
----                      --------------- -----------
SRV-01\contractor_john    Local           User
CORP\RemoteSupportGroup   ActiveDirectory Group

Removing a User from a Group with Remove-LocalGroupMember

Remove-LocalGroupMember -Group "Administrators" -Member "jsmith"

where:

• -Group is the target local group.
• -Member is the username to remove from the group.

Practical Usage

Provisioning a New Local User with Group Access

A common onboarding task is creating a new local account, setting its properties, and granting the appropriate group membership in one script.

param(
    [Parameter(Mandatory)]
    [string]$Username,
    [Parameter(Mandatory)]
    [string]$FullName,
    [string]$Group = "Users"
)

$password = Read-Host -AsSecureString -Prompt "Enter password for $Username"

New-LocalUser -Name $Username `
              -Password $password `
              -FullName $FullName `
              -PasswordNeverExpires:$false

Add-LocalGroupMember -Group $Group -Member $Username

Write-Output "$Username created and added to '$Group' group."

where:

• -Mandatory ensures $Username and $FullName must be supplied when calling the script.
• -Group defaults to "Users" if not specified, granting standard (non-admin) access.

./provision-local-user.ps1 -Username "mjones" -FullName "Mike Jones"

mjones created and added to 'Users' group.

Local Administrator Access Audit

A common security task involves auditing the local Administrators group to ensure unauthorized local accounts or rogue domain users do not maintain elevation rights.

$adminMembers = Get-LocalGroupMember -Group "Administrators"

$auditReport = foreach ($member in $adminMembers) {
    $isEnabled = "N/A (External/Group)"
    if ($member.PrincipalSource -eq "Local" -and $member.ObjectClass -eq "User") {
        $localAccount = Get-LocalUser -SID $member.SID -ErrorAction SilentlyContinue
        $isEnabled = $localAccount.Enabled
    }

    [PSCustomObject]@{
        AccountName     = $member.Name
        AccountType     = $member.ObjectClass
        Source          = $member.PrincipalSource
        ActiveStatus    = $isEnabled
        SID             = $member.SID.Value
    }
}

$auditReport | Format-Table -AutoSize

where:

• Get-LocalGroupMember -Group "Administrators" retrieves all security principals with local administrator rights.
• $member.PrincipalSource differentiates between local machine accounts and domain accounts.
• Get-LocalUser -SID looks up account status using the unique SID property.
• Format-Table -AutoSize dynamically adjusts column widths to display account properties cleanly.

./audit-local-admins.ps1

AccountName         AccountType Source          ActiveStatus SID
-----------         ----------- ------          ------------ ---
SRV-01\Administrator User        Local           True         S-1-5-21-4029...-500
CORP\Domain Admins  Group       ActiveDirectory N/A (External/Group) S-1-5-21-1892...-512
SRV-01\temp_admin   User        Local           False        S-1-5-21-4029...-1002