Users and Groups on This PC

Every Windows PC has its own list of accounts and groups: Get-LocalUser and Get-LocalGroup read them, Get-LocalGroupMember shows who is in a group such as Administrators, and a quick check tells you whether this window runs as administrator; adding an account takes an administrator window, so rehearse it with -WhatIf.

Journeyman · PowerShell · Operating System · Updated

After this lesson you can

  • List this PC's local accounts and groups with Get-LocalUser and Get-LocalGroup, and read their Enabled and Description
  • Find who is an administrator with Get-LocalGroupMember, and check whether this window runs as administrator

Key takeaways

  • A PC has its own local accounts and groups. A group, such as Administrators or Users, gives every member the same rights.
  • Get-LocalUser lists accounts with Enabled and Description; Windows' built-in Administrator, Guest and DefaultAccount are there, and turned off.
  • Get-LocalGroupMember -Group Administrators answers who can change anything on this PC.
  • Being in Administrators isn't the same as running as administrator: a normal window has standard rights until you open one with Run as administrator.
  • New-LocalUser and Add-LocalGroupMember change the PC and need an administrator window; rehearse them with -WhatIf.

The family laptop is shared by four people, and someone keeps installing games that slow it down. Or you've started at a help desk, and a ticket says "check who has admin rights on this PC before we hand it to the new hire". With the mouse, that's Settings, Accounts, Other users, and then the old Computer Management window for the groups. PowerShell answers both questions in a line each, and the same lines work on the next PC, and the one after.

Accounts and groups: the keys and the key rings

A building gives each person a key, and a manager's key ring opens more doors than a visitor's. A PC works the same way. Each person who signs in has an account, and a group is a key ring: every account in it gets the group's rights. The accounts and groups kept on the PC itself are called local, to tell them from the ones a school or company network keeps.

Get-LocalUser lists the local accounts. Windows comes with a few built in, and asking for them by name shows the columns:

Get-LocalUser -Name Administrator, Guest, DefaultAccount

Name           Enabled Description
----           ------- -----------
Administrator  False   Built-in account for administering the computer/domain
Guest          False   Built-in account for guest access to the computer/domain
DefaultAccount False   A user account managed by the system.

All three are turned off, which is how Windows ships them. Enabled False means no one can sign in with that account. Run Get-LocalUser with no -Name on your PC and your own account is there too, with whoever else uses it. This lesson shows only the built-in accounts, because a list of real people's accounts is theirs to keep private.

The groups that matter

Get-LocalGroup lists the groups. Three decide most of what an account may do:

Get-LocalGroup -Name Administrators, Users, Guests | Format-List Name, Description

Name        : Administrators
Description : Administrators have complete and unrestricted access to the computer/domain

Name        : Users
Description : Users are prevented from making accidental or intentional system-wide changes and can
              run most applications

Name        : Guests
Description : Guests have the same access as members of the Users group by default, except for the
              Guest account which is further restricted

An administrator can change anything: install programs for everyone, change HKLM:, add accounts. A member of Users can run programs and change their own settings. That's why the safest family laptop gives one grown-up an administrator account and everyone else a standard one.

Who is an administrator?

Get-LocalGroupMember lists who is in a group:

Get-LocalGroupMember -Group Guests

ObjectClass Name         PrincipalSource
----------- ----         ---------------
User        LAPTOP\Guest Local

Name is the computer's name, a backslash, then the account: here the computer is called LAPTOP, and yours shows its own name. PrincipalSource says where the account comes from: Local for one kept on this PC, MicrosoftAccount for one you sign in to with an email address, and ActiveDirectory or AzureAD for one a school or company manages.

Run Get-LocalGroupMember -Group Administrators and you get the answer to the help-desk ticket: every account that can change anything, with your own among them if you set the PC up. Here it's filtered to Windows' built-in account, the one name that's the same on every PC:

Get-LocalGroupMember -Group Administrators | Where-Object Name -like '*\Administrator'

ObjectClass Name                 PrincipalSource
----------- ----                 ---------------
User        LAPTOP\Administrator Local

Your list may hold a name you don't recognize. Ask before you remove it: on a work PC, the company's support team often has an account there on purpose.

In the group, but not running as administrator

Here's a surprise. Even when your account is in Administrators, a normal PowerShell window doesn't use those rights. Windows' User Account Control gives each program standard rights until you choose Run as administrator and click Yes, so a program can't quietly use your admin rights behind your back. This line asks whether this window is running as administrator:

$me = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
$me.IsInRole('Administrators')

False

In a window opened with Terminal (Admin), as in Setup: Windows Terminal and PowerShell 7, the same lines say True. A script that needs admin rights can check this first and stop with a clear message.

Adding an account changes the PC, so it needs that administrator window. Rehearse it first:

New-LocalUser -Name 'Jordan' -NoPassword -Description 'Homework account' -WhatIf

What if: Performing the operation "Create new local user" on target "Jordan".

The real thing, in an administrator window, makes a standard account for Jordan with a password typed in privately, and puts it in Users:

$password = Read-Host -AsSecureString -Prompt 'Password for Jordan'
New-LocalUser -Name 'Jordan' -Password $password -Description 'Homework account'
Add-LocalGroupMember -Group Users -Member 'Jordan'

Disable-LocalUser -Name Jordan turns it off without deleting anything, the gentle first step when an account is no longer needed. These commands work the same in Windows PowerShell 5.1. A work PC that signs in to a company network keeps most accounts on the network, so its local list is short.

Check yourself

2 questions to try on the lesson page.

So what

Who can change this PC is a fact you can look up: the local accounts, the groups they're in, and whether the window you're in is using admin rights right now.

Key terms

Cheat sheets

Related