PowerShell to manager Local Users and Groups

Here let’s see how to manage Windows local group using PowerShell.

Required module is “Microsoft.PowerShell.LocalAccounts” look below for available cmdlets.

Find available cmdlets

Get-Command | Where-Object {$_.source -eq "Microsoft.PowerShell.LocalAccounts"}

Get-Command | Where-Object {$_.source -eq "Microsoft.PowerShell.LocalAccounts"}

Lets use this cmdlets we can manager local users and groups.

Local Users

List Local Users

Get-LocalUser

This help to display all available local users

Get-LocalUser -Name ad*

It will list all user names starts with “AD”

Disable and Enable Local Users

Disable-LocalUser -Name "testuser"

Here it will disable “testuser”.

Get-LocalUser test* | Disable-LocalUser

To disable multiple users starts with “Test”, above command help to list all the users starts with “test” and disable them. For example if local computer has users like “Test1,Test2,Test3,Test4,Test5”, with above command you can disable all users at once.

Warning: Before running this cmdlet make sure you are disabling the requires users, becasue this will disable all accounts starts with “test”

Enable-LocalUser -Name "testuser"

Here it will Enable “testuser”.

Get-LocalUser test* | Enable-LocalUser

To Enable multiple users starts with “Test”, above command help to list all the users starts with “test” and Enable them. For example if local computer has users like “Test1,Test2,Test3,Test4,Test5”, with above command you can Enable all users at once.

Create and Delete Local Users

$Password = Read-Host -AsSecureString
New-LocalUser "testuser" -Password $Password -FullName "Test User" -Description "This is a Test User"

Here we are creating a testuser with name,description and providing password as a variable($password). this account does has not expire. when we does not specify the AccountExpires parameter.the account does not expire. Check below screenshot for AccountExpires parameter help.

New-LocalUser -Name "testuser" -Description "This is a Test User" -NoPassword

This will create a “testuser” account without password and AccountExpire date. Please can be set at later stage lets see how that works.

$Password = Read-Host -AsSecureString
Set-LocalUser -Name "testuser" -Password $Password

Set-LocalUser help to modify local user accounts.

Get-Help Set-LocalUser -Parameter *

Try this command to explore all parameters using Get-Help

Remove-LocalUser -Name "testuser"

This delets testuser account.

Local Groups

List Local Groups

Get-LocalGroup

This help to display all available local Groups

Get-LocalGroup -Name re*

It will display all group names starts with “re”

Create and Delete Local Groups

New-LocalGroup -Name "testusers"

This command creates “testusers” local group.

Remove-LocalGroup -Name "testusers"

This command removes “testusers” local group.

Manage Local Groups

Set-LocalGroup -Name "testusers" -Description "This is for test users."

Here we are changing description for “testusers” group.