Home
%3CLINGO-SUB%20id%3D%22lingo-sub-733544%22%20slang%3D%22en-US%22%3EHow%20to%20Manage%20Local%20Users%20and%20Groups%20using%20PowerShell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-733544%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EManaging%20local%20users%20and%20groups%20can%20be%20a%20bit%20of%20a%20chore%2C%20especially%20on%20a%20computer%20running%20the%20Server%20Core%20version%20of%20Windows%20Server.%20The%20LocalAccounts%20module%20of%20PowerShell%2C%20included%20in%20Windows%20Server%202016%20and%20Windows%20Server%202019%20by%20default%2C%20makes%20this%20process%20a%20lot%20simpler.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EFor%20example%2C%20to%20see%20all%20the%20local%20users%20on%20a%20specific%20computer%2C%20run%20the%20command%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EGet-LocalUser%3C%2FPRE%3E%0A%3CP%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20977px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F121832i583F02B29509C909%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Get-LocalUser.png%22%20title%3D%22Get-LocalUser.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EYou%E2%80%99ll%20notice%20there%20that%20I%E2%80%99ve%20already%20renamed%20the%20local%20Administrator%20account%20on%20this%20particular%20computer%20to%20Admin.%20I%20do%20that%20because%20it%E2%80%99s%20a%20lab%20machine%20and%20renaming%20the%20account%20from%20Administrator%20means%20that%20it%20won%E2%80%99t%20default%20to%20the%20local%20Admin%20account%20when%20I%20want%20to%20sign%20on%20as%20the%20default%20Domain%20Admin%20account%2C%20which%20is%20also%20named%20Administrator.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3ETo%20view%20the%20local%20groups%20on%20a%20computer%2C%20run%20the%20command%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EGet-LocalGroup%3C%2FPRE%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20979px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F121833i6C34CCDE0B4EF624%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Local-Groups.png%22%20title%3D%22Local-Groups.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3ETo%20view%20the%20members%20of%20a%20specific%20group%2C%20use%20the%20Get-LocalGroupMember%20cmdlet.%20For%20example%2C%20to%20figure%20out%20who%20is%20a%20member%20of%20the%20local%20Administrators%20group%2C%20run%20the%20command%20Get-LocalGroupMember%20Administrators.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20980px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F121834i4EA73C33D5B0E5B9%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Image-3.png%22%20title%3D%22Image-3.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EYou%20can%20create%20a%20new%20local%20user%20using%20the%20New-LocalUser%20cmdlet.%20When%20creating%20a%20new%20local%20user%2C%20first%20create%20a%20password%20variable%20using%20%24Password%20%3D%20Read-Host%20-AsSecureString%20and%20this%20will%20allow%20you%20to%20enter%20the%20password%20assigned%20to%20the%20user.%20For%20example%2C%20to%20create%20a%20new%20user%20named%20Optimus%2C%20enter%20the%20following%20commands%3A%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3E%24Password%20%3D%20Read-Host%20-AsSecureString%0ANew-LocalUser%20-Name%20Optimus%20-Description%20%E2%80%9CSecond%20Admin%20Account%E2%80%9D%20-Password%20%24Password%3C%2FPRE%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20978px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F121835i7061E6D43722F851%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Image-4.png%22%20title%3D%22Image-4.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EResetting%20a%20user%20password%20is%20a%20little%20more%20involved.%20To%20do%20this%20requires%20three%20steps.%20The%20first%20step%20is%20to%20write%20a%20password%20from%20the%20prompt%20to%20a%20variable%20using%20%24Password%20%3D%20Read-Host%20-AsSecureString.%20The%20second%20is%20to%20assign%20the%20properties%20of%20the%20user%20account%20whose%20password%20you%20want%20to%20change%20to%20a%20variable%20using%20%24UserAccount%20%3D%20Get-LocalUser%20-Name%20AccountName.%20Once%20you%E2%80%99ve%20done%20that%2C%20you%20can%20use%20the%20%24UserAccount%20%7C%20Set-LocalUser%20-Password%20%24Password%20command%20to%20assign%20the%20new%20password.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20979px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F121836iB87B132E3BC533C2%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image-5.png%22%20title%3D%22image-5.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EYou%20use%20the%20Add-LocalGroupMember%20cmdlet%20to%20add%20members%20to%20a%20local%20group.%20For%20example%2C%20to%20add%20the%20Optimus%20account%20that%20was%20created%20in%20the%20last%20example%20to%20the%20local%20Administrators%20group%2C%20run%20the%20command%3A%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EAdd-LocalGroupMember%20-Group%20%E2%80%9CAdministrators%E2%80%9D%20-Member%20Optimus%3C%2FPRE%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20979px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F121837iFBDFC799F89E1805%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image-6.png%22%20title%3D%22image-6.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EYou%20can%20use%20the%20same%20command%20to%20add%20domain%20accounts%20to%20local%20groups.%20For%20example%2C%20to%20add%20the%20Maximus%20account%20from%20the%20Contoso%20domain%20to%20the%20local%20Administrators%20group%2C%20run%20the%20command%3A%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EAdd-LocalGroupMember%20-Group%20%E2%80%9CAdministrators%E2%80%9D%20-Member%20%E2%80%9CContoso%5CMaximus%E2%80%9D%3C%2FPRE%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20962px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F121838iD8C0526A0C4B4282%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image-7.png%22%20title%3D%22image-7.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EYou%20can%20also%20use%20the%20same%20command%20to%20add%20domain%20groups%20to%20a%20local%20group.%20For%20example%2C%20to%20add%20the%20ITOps%20group%20from%20the%20Contoso%20domain%20to%20the%20local%20Administrators%20group%2C%20run%20the%20command%3A%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EAdd-LocalGroupMember%20-Group%20%E2%80%9CAdministrators%E2%80%9D%20-Member%20%E2%80%9CContoso%5CITOps%E2%80%9D%3C%2FPRE%3E%0A%3CP%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20979px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F121839i3C59D2EDE170D8C4%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image-8.png%22%20title%3D%22image-8.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EYou%20can%20remove%20users%20or%20groups%20from%20a%20local%20group%20using%20the%20Remove-LocalGroupMember%20cmdlet.%20For%20example%2C%20to%20remove%20the%20Optimus%20account%20from%20the%20local%20Administrators%20group%2C%20run%20the%20command%3A%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3ERemove-LocalGroupMember%20-Group%20%E2%80%9CAdministrators%E2%80%9D%20-Member%20Optimus%3C%2FPRE%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20975px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F121840iD17E4FFF851794C1%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image-9.png%22%20title%3D%22image-9.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EYou%20can%20find%20out%20more%20about%20the%20cmdlets%20that%20you%20use%20to%20manage%20local%20users%20and%20groups%2C%20including%20how%20to%20add%20and%20remove%20local%20groups%20as%20well%20as%20remove%20local%20user%20accounts%20in%20the%20following%20Docs%20article%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Fmicrosoft.powershell.localaccounts%2F%3FWT.mc_id%3DITOPSTALK-blog-orthomas%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EPowerShell%20Local%20Accounts%3C%2FA%3E.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-733544%22%20slang%3D%22en-US%22%3E%3CP%3EManaging%20local%20users%20and%20groups%20is%20a%20bit%20of%20a%20chore%2C%20especially%20on%20computers%20running%20the%20Server%20Core%20version%20of%20Windows%20Server.%20In%20this%20article%20you'll%20learn%20about%20some%20commands%20that%20will%20help%20you%20simplify%20that%20process.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-733544%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EPowerShell%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-753188%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20Manage%20Local%20Users%20and%20Groups%20using%20PowerShell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-753188%22%20slang%3D%22en-US%22%3E%3CP%3EInformative.%20Would%20like%20to%20see%20more%20basic%20administration%20with%20PowerShell%20type%20content.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-822154%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20Manage%20Local%20Users%20and%20Groups%20using%20PowerShell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-822154%22%20slang%3D%22en-US%22%3EIs%20it%20possible%20to%20list%20all%20groups%20that%20a%20user%20is%20a%20member%20of%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-822167%22%20slang%3D%22en-US%22%3ERE%3A%20How%20to%20Manage%20Local%20Users%20and%20Groups%20using%20PowerShell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-822167%22%20slang%3D%22en-US%22%3EGet-LocalGroup%20%7C%20Get-LocalGroupMember%20will%20give%20you%20a%20list%20of%20all%20users%20in%20all%20local%20groups.%20You%20could%20probably%20play%20around%20with%20filtering%20the%20output%20if%20there%20was%20too%20much.%20If%20you%20are%20doing%20it%20in%20a%20domain%2C%20Get-AdPrincipalGroupMembership%20username%20%7C%20select%20name%20will%20do%20the%20job%20for%20you.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-822220%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20Manage%20Local%20Users%20and%20Groups%20using%20PowerShell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-822220%22%20slang%3D%22en-US%22%3EHad%20to%20save%20the%20group%20and%20then%20add%20it%20to%20the%20user%20object%3B%20Get-LocalGroup%20%7C%20%25%20%7B%20%24group%20%3D%20%24_%3B%20%24user%3D%20(%20%24_%20%7C%20Get-LocalGroupMember%20)%20%3B%20%24user%20%7C%20add-member%20-MemberType%20NoteProperty%20-name%20Group%20-value%20%24group%20%3B%20%24user%20%7D%20%7C%20select%20group%2Cname%20Maybe%20there's%20an%20easier%20way%3C%2FLINGO-BODY%3E
Microsoft

 

Managing local users and groups can be a bit of a chore, especially on a computer running the Server Core version of Windows Server. The LocalAccounts module of PowerShell, included in Windows Server 2016 and Windows Server 2019 by default, makes this process a lot simpler.

For example, to see all the local users on a specific computer, run the command

 

Get-LocalUser

Get-LocalUser.png

 

You’ll notice there that I’ve already renamed the local Administrator account on this particular computer to Admin. I do that because it’s a lab machine and renaming the account from Administrator means that it won’t default to the local Admin account when I want to sign on as the default Domain Admin account, which is also named Administrator.

 

To view the local groups on a computer, run the command

 

Get-LocalGroup

Local-Groups.png

 

To view the members of a specific group, use the Get-LocalGroupMember cmdlet. For example, to figure out who is a member of the local Administrators group, run the command Get-LocalGroupMember Administrators.

 

Image-3.png

 

You can create a new local user using the New-LocalUser cmdlet. When creating a new local user, first create a password variable using $Password = Read-Host -AsSecureString and this will allow you to enter the password assigned to the user. For example, to create a new user named Optimus, enter the following commands:

 

$Password = Read-Host -AsSecureString
New-LocalUser -Name Optimus -Description “Second Admin Account” -Password $Password

Image-4.png

 

Resetting a user password is a little more involved. To do this requires three steps. The first step is to write a password from the prompt to a variable using $Password = Read-Host -AsSecureString. The second is to assign the properties of the user account whose password you want to change to a variable using $UserAccount = Get-LocalUser -Name AccountName. Once you’ve done that, you can use the $UserAccount | Set-LocalUser -Password $Password command to assign the new password.

 

image-5.png

 

You use the Add-LocalGroupMember cmdlet to add members to a local group. For example, to add the Optimus account that was created in the last example to the local Administrators group, run the command:

 

Add-LocalGroupMember -Group “Administrators” -Member Optimus

image-6.png

 

You can use the same command to add domain accounts to local groups. For example, to add the Maximus account from the Contoso domain to the local Administrators group, run the command:

 

Add-LocalGroupMember -Group “Administrators” -Member “Contoso\Maximus”

image-7.png

You can also use the same command to add domain groups to a local group. For example, to add the ITOps group from the Contoso domain to the local Administrators group, run the command:

 

Add-LocalGroupMember -Group “Administrators” -Member “Contoso\ITOps”

image-8.png

 

You can remove users or groups from a local group using the Remove-LocalGroupMember cmdlet. For example, to remove the Optimus account from the local Administrators group, run the command:

 

Remove-LocalGroupMember -Group “Administrators” -Member Optimus

image-9.png

You can find out more about the cmdlets that you use to manage local users and groups, including how to add and remove local groups as well as remove local user accounts in the following Docs article: PowerShell Local Accounts.

4 Comments
Occasional Visitor

Informative. Would like to see more basic administration with PowerShell type content.

New Contributor
Is it possible to list all groups that a user is a member of?
Microsoft
Get-LocalGroup | Get-LocalGroupMember will give you a list of all users in all local groups. You could probably play around with filtering the output if there was too much. If you are doing it in a domain, Get-AdPrincipalGroupMembership username | select name will do the job for you.
New Contributor
Had to save the group and then add it to the user object; Get-LocalGroup | % { $group = $_; $user= ( $_ | Get-LocalGroupMember ) ; $user | add-member -MemberType NoteProperty -name Group -value $group ; $user } | select group,name Maybe there's an easier way