PowerShell Manage Local Users and Groups
─□✕

PowerShell Manage Local Users and Groups

PowerShell Tips Editor 4 min read
PowerShell Manage Local Users and Groups

Provisioning a service account or setting up a test user without opening Control Panel is one of those small tasks that adds up — and when you need to do it across 50 machines, scripting is the only sane answer. PowerShell local users management uses the LocalAccounts module (built into Windows 10 and Server 2016+) with cmdlets like New-LocalUser, Add-LocalGroupMember, and Get-LocalUser. This post walks through every common operation with practical, production-ready examples.

List Local Users and Groups

Start by querying existing accounts. Get-LocalUser shows all local accounts including built-in ones. Get-LocalGroup lists all local security groups.

# List all local users
Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordExpires
Name           Enabled  LastLogon             PasswordExpires
----           -------  ---------             ---------------
Administrator  False    5/1/2026 8:14:00 AM
Guest          False
svc-backup     True     5/3/2026 3:00:00 AM

# List local groups and member counts
Get-LocalGroup | Select-Object Name, Description

Create a New Local User

Use New-LocalUser to create an account. The password must be a SecureString — never pass a plain-text string. Use Read-Host -AsSecureString for interactive prompts or ConvertTo-SecureString for scripted creation.

# Interactive password prompt
$password = Read-Host -Prompt "Enter password for new user" -AsSecureString

New-LocalUser -Name "svc-monitoring" `
    -Password $password `
    -FullName "Monitoring Service Account" `
    -Description "Used by the monitoring agent" `
    -PasswordNeverExpires:$true `
    -UserMayNotChangePassword:$true

Set Password and Expiry

Set or change an existing user’s password with Set-LocalUser. Control password and account expiry dates to enforce security policy.

# Reset a user's password
$newPwd = ConvertTo-SecureString "N3wS3cure!Pass" -AsPlainText -Force
Set-LocalUser -Name "jdoe" -Password $newPwd

# Set account expiry date
Set-LocalUser -Name "jdoe" -AccountExpires (Get-Date).AddDays(90)

# Remove expiry (account does not expire)
Set-LocalUser -Name "svc-monitoring" -AccountExpires ([datetime]::MaxValue)

Add User to Local Group

Add-LocalGroupMember adds a user to a local security group. Adding a user to the local Administrators group gives them full admin rights on the machine.

# Add user to Administrators group
Add-LocalGroupMember -Group "Administrators" -Member "jdoe"

# Add user to Remote Desktop Users
Add-LocalGroupMember -Group "Remote Desktop Users" -Member "jdoe"

# Check current members of a group
Get-LocalGroupMember -Group "Administrators" | Select-Object Name, ObjectClass, PrincipalSource

Disable and Delete a Local User

Disabling an account prevents login without losing the account history. Deleting is permanent. For service accounts being decommissioned, disable first and delete after a review period.

# Disable an account
Disable-LocalUser -Name "jdoe"

# Re-enable an account
Enable-LocalUser -Name "jdoe"

# Delete permanently — no confirmation unless -Confirm is passed
Remove-LocalUser -Name "jdoe"

Bulk User Creation from CSV

For onboarding or lab provisioning, import users from a CSV file. The CSV should have at minimum a Username column; add FullName, Description, and Group columns for more complete provisioning.

# CSV format: Username,FullName,Description,Group
# lab01,Lab User One,Test account,Remote Desktop Users

$defaultPassword = ConvertTo-SecureString "Welcome1!" -AsPlainText -Force
$users = Import-Csv -Path "C:\Logs\new-users.csv"

foreach ($user in $users) {
    try {
        New-LocalUser -Name $user.Username `
            -Password $defaultPassword `
            -FullName $user.FullName `
            -Description $user.Description `
            -PasswordNeverExpires:$false `
            -ErrorAction Stop

        if ($user.Group) {
            Add-LocalGroupMember -Group $user.Group -Member $user.Username
        }
        Write-Output "Created: $($user.Username)"
    } catch {
        Write-Warning "Failed for $($user.Username): $_"
    }
}

Common Errors and Fixes

  • LocalAccounts module not available on domain controllers: The LocalAccounts module (Microsoft.PowerShell.LocalAccounts) is not loaded by default on Active Directory domain controllers. Local user accounts are irrelevant on DCs (use AD accounts instead), and the module is intentionally absent. For workstations and member servers, the module is present and works without any installation step on Windows 10/11 and Server 2016+.
  • Password must be a SecureString: The -Password parameter requires a [SecureString] object. Passing a plain string throws a type mismatch error. Always convert: ConvertTo-SecureString "password" -AsPlainText -Force. In production scripts, avoid embedding passwords as plain text — use a secrets manager or prompt interactively with Read-Host -AsSecureString.

Related Cmdlets / See Also

Wrapping Up

The LocalAccounts module gives you complete control over local user accounts with the same consistent PowerShell syntax you use everywhere else. As a next step, combine the bulk creation script with Invoke-Command to provision local service accounts across multiple servers simultaneously — a task that would take hours manually and takes seconds with PowerShell.

#accounts#local-user#localgroup#new-localuser
Send-Item -To