What is a local account?
A local account exists only on the computer where it was created. Windows keeps its name, group memberships and password hash in the Security Account Manager (SAM) database, a registry hive stored in C:\Windows\System32\config\SAM and loaded under HKEY_LOCAL_MACHINE\SAM. Nothing about the account is stored online, so it signs in the same way with or without internet access. Other computers do not know it exists; to use the same name on another PC, a matching account must be created there. Domain-joined PCs have local accounts too, including the built-in Administrator and Guest accounts.
Local vs Microsoft vs domain accounts
- Local account: one PC, signs in with a user name. To make a local sign-in explicit on a domain PC, type
.\usernameorCOMPUTERNAME\username. - Microsoft account: a cloud identity that signs in with an email address and syncs settings and OneDrive.
- Domain account: stored in Active Directory on a domain controller, written
DOMAIN\username, works on any domain-joined PC and is managed with Group Policy.
In a workgroup every account is local, so a person who uses three PCs needs three separate accounts, and a password change on one does not reach the others.
Creating and managing local accounts
- Settings (Windows 11): Settings > Accounts > Other users > Add account, then choose I don't have this person's sign-in information and Add a user without a Microsoft account.
- Local Users and Groups:
lusrmgr.msc(Pro, Enterprise and Education) to create users, reset passwords, disable accounts and edit group membership. - Elevated Command Prompt:
net user jsmith * /addcreates jsmith and prompts for a password,net user jsmith /active:nodisables it, andnet localgroup administrators jsmith /addmakes it an admin. - PowerShell:
Get-LocalUser,New-LocalUserandAdd-LocalGroupMember. - User Accounts dialog:
netplwizlists accounts and their groups. - Converting: an account signed in with a Microsoft account can switch through Settings > Accounts > Your info > Sign in with a local account instead.
Password recovery
Because no online service knows the password, recovery options are limited. Local accounts on Windows 10 and 11 can have security questions that are answered at the sign-in screen, and a password reset disk created ahead of time on a USB drive also works. Otherwise another administrator on the PC must set a new password in Settings, lusrmgr.msc or with net user username *. Windows warns that an admin reset makes the user lose access to EFS-encrypted files, personal certificates and saved credentials, because those are protected by the old password.
When to choose a local account
- Shared, kiosk or lab PCs, and devices that must stay offline.
- Break-glass admin and service accounts that must work when the network or cloud is down.
- Users who do not want their Windows sign-in tied to a cloud identity.
The trade-offs are no settings sync, no automatic OneDrive sign-in, no automatic online backup of a device encryption recovery key, and more work when the same person uses several PCs.
Local account on the CompTIA A+ exam
Local accounts belong to Core 2 (220-1202) objective 2.2, which covers Windows users, groups and sign-in options. Know where local accounts are stored (the SAM), how they differ from Microsoft and domain accounts, how to create them in Settings, lusrmgr.msc and net user, and that Home editions lack the Local Users and Groups console. A scenario about a PC that must work with no internet, or a user who refuses a cloud sign-in, points to a local account. A scenario about one sign-in across many office PCs points to a domain account.