# Users and Groups on This PC Every Windows PC has its own list of accounts and groups: Get-LocalUser and Get-LocalGroup read them, Get-LocalGroupMember shows who is in a group such as Administrators, and a quick check tells you whether this window runs as administrator; adding an account takes an administrator window, so rehearse it with -WhatIf. Journeyman · PowerShell · Operating System · Updated November 10, 2026 ## After this lesson you can - List this PC's local accounts and groups with Get-LocalUser and Get-LocalGroup, and read their Enabled and Description - Find who is an administrator with Get-LocalGroupMember, and check whether this window runs as administrator ## Key takeaways - A PC has its own local accounts and groups. A group, such as Administrators or Users, gives every member the same rights. - `Get-LocalUser` lists accounts with `Enabled` and `Description`; Windows' built-in Administrator, Guest and DefaultAccount are there, and turned off. - `Get-LocalGroupMember -Group Administrators` answers who can change anything on this PC. - Being in Administrators isn't the same as running as administrator: a normal window has standard rights until you open one with Run as administrator. - `New-LocalUser` and `Add-LocalGroupMember` change the PC and need an administrator window; rehearse them with `-WhatIf`. The family laptop is shared by four people, and someone keeps installing games that slow it down. Or you've started at a help desk, and a ticket says "check who has admin rights on this PC before we hand it to the new hire". With the mouse, that's **Settings**, **Accounts**, **Other users**, and then the old *Computer Management* window for the groups. PowerShell answers both questions in a line each, and the same lines work on the next PC, and the one after. ## Accounts and groups: the keys and the key rings A building gives each person a key, and a manager's key ring opens more doors than a visitor's. A PC works the same way. Each person who signs in has an **account**, and a **group** is a key ring: every account in it gets the group's rights. The accounts and groups kept on the PC itself are called **local**, to tell them from the ones a school or company network keeps. `Get-LocalUser` lists the local accounts. Windows comes with a few built in, and asking for them by name shows the columns: ```powershell Get-LocalUser -Name Administrator, Guest, DefaultAccount ``` ```text Name Enabled Description ---- ------- ----------- Administrator False Built-in account for administering the computer/domain Guest False Built-in account for guest access to the computer/domain DefaultAccount False A user account managed by the system. ``` All three are turned off, which is how Windows ships them. `Enabled` `False` means no one can sign in with that account. Run `Get-LocalUser` with no `-Name` on your PC and your own account is there too, with whoever else uses it. This lesson shows only the built-in accounts, because a list of real people's accounts is theirs to keep private. ## The groups that matter `Get-LocalGroup` lists the groups. Three decide most of what an account may do: ```powershell Get-LocalGroup -Name Administrators, Users, Guests | Format-List Name, Description ``` ```text Name : Administrators Description : Administrators have complete and unrestricted access to the computer/domain Name : Users Description : Users are prevented from making accidental or intentional system-wide changes and can run most applications Name : Guests Description : Guests have the same access as members of the Users group by default, except for the Guest account which is further restricted ``` An **administrator** can change anything: install programs for everyone, change `HKLM:`, add accounts. A member of **Users** can run programs and change their own settings. That's why the safest family laptop gives one grown-up an administrator account and everyone else a standard one. ## Who is an administrator? `Get-LocalGroupMember` lists who is in a group: ```powershell Get-LocalGroupMember -Group Guests ``` ```text ObjectClass Name PrincipalSource ----------- ---- --------------- User LAPTOP\Guest Local ``` `Name` is the computer's name, a backslash, then the account: here the computer is called `LAPTOP`, and yours shows its own name. `PrincipalSource` says where the account comes from: `Local` for one kept on this PC, `MicrosoftAccount` for one you sign in to with an email address, and `ActiveDirectory` or `AzureAD` for one a school or company manages. Run `Get-LocalGroupMember -Group Administrators` and you get the answer to the help-desk ticket: every account that can change anything, with your own among them if you set the PC up. Here it's filtered to Windows' built-in account, the one name that's the same on every PC: ```powershell Get-LocalGroupMember -Group Administrators | Where-Object Name -like '*\Administrator' ``` ```text ObjectClass Name PrincipalSource ----------- ---- --------------- User LAPTOP\Administrator Local ``` Your list may hold a name you don't recognize. Ask before you remove it: on a work PC, the company's support team often has an account there on purpose. ## In the group, but not running as administrator Here's a surprise. Even when your account is in Administrators, a normal PowerShell window doesn't use those rights. Windows' **User Account Control** gives each program standard rights until you choose **Run as administrator** and click **Yes**, so a program can't quietly use your admin rights behind your back. This line asks whether *this window* is running as administrator: ```powershell $me = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent() $me.IsInRole('Administrators') ``` ```text False ``` In a window opened with **Terminal (Admin)**, as in *Setup: Windows Terminal and PowerShell 7*, the same lines say `True`. A script that needs admin rights can check this first and stop with a clear message. Adding an account changes the PC, so it needs that administrator window. Rehearse it first: ```powershell New-LocalUser -Name 'Jordan' -NoPassword -Description 'Homework account' -WhatIf ``` ```text What if: Performing the operation "Create new local user" on target "Jordan". ``` The real thing, in an administrator window, makes a standard account for Jordan with a password typed in privately, and puts it in Users: ```powershell $password = Read-Host -AsSecureString -Prompt 'Password for Jordan' New-LocalUser -Name 'Jordan' -Password $password -Description 'Homework account' Add-LocalGroupMember -Group Users -Member 'Jordan' ``` `Disable-LocalUser -Name Jordan` turns it off without deleting anything, the gentle first step when an account is no longer needed. These commands work the same in Windows PowerShell 5.1. A work PC that signs in to a company network keeps most accounts on the network, so its local list is short. ## Check yourself 2 questions to try on the lesson page. ## So what Who can change this PC is a fact you can look up: the local accounts, the groups they're in, and whether the window you're in is using admin rights right now. ## Key terms - [Local Account](https://www.ask-codey.com/glossary/local-account) - [Local Group](https://www.ask-codey.com/glossary/local-group) - [Administrator](https://www.ask-codey.com/glossary/administrator) - [Get-LocalUser](https://www.ask-codey.com/glossary/get-localuser) - [Get-LocalGroupMember](https://www.ask-codey.com/glossary/get-localgroupmember) - [User Account Control](https://www.ask-codey.com/glossary/user-account-control) ## Cheat sheets - [Users and Groups on This PC](https://www.ask-codey.com/cheat-sheets/powershell-local-users-cheat-sheet) ## Related - [Setup: Windows Terminal and PowerShell 7](https://www.ask-codey.com/lessons/powershell-setup-windows) - [The Registry as a Drive](https://www.ask-codey.com/lessons/powershell-registry) - [Your Computer's Facts: \`Get-CimInstance\`](https://www.ask-codey.com/lessons/powershell-cim) Source: https://www.ask-codey.com/lessons/powershell-local-users