Most workstation breaches do not start with an exploit. They start with an account: a shared admin login, a guest account nobody disabled, a contractor account still active a year after the contract ended, or an unlocked screen in a lobby. Account management is the set of Windows controls that closes those doors: restricting permissions, restricting when accounts may sign in, disabling the guest account, locking accounts after failed attempts, locking idle sessions, and expiring accounts on a date. This article covers each control as the exam tests it: what it does, when you would use it, and the exact Windows tool that sets it.
Two housekeeping facts apply throughout. First, Local Users and Groups (lusrmgr.msc), Local Security Policy (secpol.msc), and the Local Group Policy Editor (gpedit.msc) exist on Windows Pro, Enterprise, and Education but not on Windows Home. On Home you use the Settings app and the net user and net accounts commands from an elevated prompt. Second, in a domain the same settings come from Group Policy on the domain controller and Active Directory Users and Computers, and a domain policy overrides whatever is set locally.
Restrict user permissions
Windows has three practical account levels. An Administrator can install software, change system settings, and manage other accounts. A Standard user can run applications and change their own files and personal settings but is prompted for administrator credentials by User Account Control when anything system-wide is attempted. The built-in Guest account is a passwordless, low-privilege account with its own profile; it can create files in that profile, but it cannot install software or change the system.
The rule is least privilege: give every person a Standard account for daily work, and give administrator rights only to a separate account that is used for administrative tasks and nothing else. A help-desk technician troubleshoots from a Standard account and elevates when a task needs it. Malware that runs under a Standard account cannot silently install drivers, disable Windows Security, or add accounts; the same malware under an Administrator account can.
How: On any edition, Settings > Accounts > Other users, select the account, Change account type, choose Standard User. The older netplwiz dialog does the same from the Group Membership tab. On Pro, lusrmgr.msc lets you manage group membership directly: a user in the Users group is a Standard user, a user in Administrators is an administrator. From a command prompt, net localgroup Administrators username /delete demotes an account and net localgroup Users username /add makes sure it remains a Standard user.
Restrict log-in times
Logon hours define the days and times an account is allowed to sign in. A part-time receptionist who works Monday to Friday, 8 a.m. to 5 p.m., has no reason to authenticate at 2 a.m. on a Sunday. If that account does, it is either compromised or being misused, and the restriction stops the sign-in outright instead of relying on someone noticing it in a log later.
How: On Pro, open lusrmgr.msc, double-click the user, and on the Account tab click Logon Hours; drag across the grid to mark the permitted hours and set the rest to Logon Denied. From the command line on any edition: net user username /times:M-F,8am-5pm. Days and ranges can be combined, for example /times:M-F,8am-5pm;Sa,9am-1pm, and /times:all removes the restriction. Verify with net user username, which prints a Logon hours allowed line. On a domain, the same grid is on the Account tab in Active Directory Users and Computers.
Exam wording to recognise: "prevent sign-in outside business hours", "the account should only be usable during the employee's shift". The answer is logon hours, not account expiration (that is a one-time end date) and not lockout (that reacts to bad passwords).
Disable the guest account
The Guest account lets anyone sign in with no password. On a workstation it gives a walk-up attacker a foothold to browse shares, plant files, and probe the network from a legitimate session. Windows 10 and 11 ship with Guest disabled, but audits still find it enabled on machines that were imaged from old templates or turned on "temporarily" for a visitor. Disable it and leave it disabled; if visitors need access, give them a named, expiring Standard account.
How: On Pro, lusrmgr.msc > Users > Guest > Properties, tick Account is disabled.