What is Local Users and Groups?
Local Users and Groups is an MMC snap-in for the accounts stored in a PC's own Security Accounts Manager (SAM) database. It controls who can sign in to that computer and, through group membership, what they can do there. It does not manage domain accounts. Those live in Active Directory and are managed with domain tools such as Active Directory Users and Computers.
Opening it
- Press Win+R and type
lusrmgr.msc. - Or open Computer Management (
compmgmt.msc) > System Tools > Local Users and Groups.
The snap-in works on Windows Pro, Enterprise and Education. Windows Home does not support it; the console opens with a message that the snap-in cannot be used with this edition. On Home, manage accounts in Settings > Accounts, with netplwiz, or with the net user and net localgroup commands.
The Users folder
Right-click a user for Set Password, Rename or Delete, or open Properties:
- General: User must change password at next logon, User cannot change password, Password never expires, Account is disabled, and Account is locked out, which you can clear but not set.
- Member Of: the user's local groups.
- Profile: profile path, logon script and home folder.
Windows includes a built-in Administrator account and a Guest account, and both are disabled by default. When someone leaves or goes on leave, disable the account rather than deleting it. Disabling stops sign-in but keeps the profile and the account's security identifier (SID), so file permissions still resolve if the account is needed again.
Resetting a password with Set Password triggers a warning: the user loses access to EFS-encrypted files, stored passwords and personal certificates. Where possible, have the user change their own password instead.
The Groups folder
| Group | Purpose |
|---|---|
| Administrators | Full control: install software and drivers, change security settings, manage other accounts |
| Users | Standard accounts that run apps and change their own settings but not system-wide ones |
| Guests | Very limited, temporary access |
| Remote Desktop Users | May sign in through Remote Desktop, without admin rights |
| Backup Operators | May back up and restore files regardless of file permissions |
| Power Users | Kept for compatibility; on current Windows it grants no more than a standard user |
Group changes take effect at the user's next sign-in, because Windows reads group memberships into the user's access token when they sign in.
Command-line equivalents
net userlists local accounts, andnet user jsmithshows one account's settings and groups.net user jsmith * /addcreates an account and prompts for its password;net user jsmith /active:nodisables it.net localgroup administratorslists that group's members, andnet localgroup "Remote Desktop Users" jsmith /addadds a member.- PowerShell offers
Get-LocalUser,New-LocalUserandAdd-LocalGroupMember.
Local Users and Groups on the CompTIA A+ exam
Local Users and Groups is one of the Windows tools in Core 2 (220-1202) objective 1.4, and it is where you carry out the account and group tasks of objective 2.2. Know the lusrmgr.msc command, that Home editions lack it, the default groups, and the least-privilege rule. Cues: a user only needs remote access, think Remote Desktop Users, not Administrators; an employee is on leave, think disable the account; you must manage local accounts on Windows Home, think Settings or net user; a standard user needs one admin task done, think UAC with an admin's credentials rather than adding them to Administrators.