How to Manage Local User Accounts in Windows 11 Using PowerShell

While Windows 11 provides graphical interfaces in the Settings app and the Computer Management console (lusrmgr.msc) for creating user profiles, graphical tools are slow when configuring test workstations, deploying kiosks, or performing administrative auditing. The native Microsoft.PowerShell.LocalAccounts module built into Windows 11 provides a direct, scriptable command-line interface to manage every aspect of local user security.

In this guide, you will learn how to manage local user accounts in Windows 11 using PowerShell cmdlets, including creating accounts with secure passwords, enabling and disabling profiles, configuring password expiration rules, and delegating administrative group memberships.

---

Prerequisites: Running PowerShell as Administrator

Managing local user accounts alters system security databases (the Security Accounts Manager, or SAM). Therefore, you must execute all account commands from an elevated terminal session:

1. Press Win + X to open the Power User menu.
2. Select Terminal (Admin) or search for PowerShell in the Start menu, right-click it, and select Run as administrator.

---

Step 1: List and Inspect Existing Local Accounts

To inspect all local user accounts registered on your Windows 11 system, execute Get-LocalUser:

Get-LocalUser

PowerShell outputs a table listing account names, operational status (Enabled/Disabled), and account descriptions.

To view detailed attributes for a specific account—such as when the password was last set, whether the password expires, or bad password attempt counts—pipe the cmdlet into Select-Object:

Get-LocalUser -Name "Username" | Select-Object Name, Enabled, PasswordExpires, PasswordLastSet, LastLogon, Description | Format-List

---

Step 2: Create a New Local User Account

When creating accounts in PowerShell, passwords should never be passed as plain text strings. Use Read-Host -AsSecureString to capture credentials securely into memory before passing them to New-LocalUser:

# 1. Prompt for a secure password
$Password = Read-Host -AsSecureString "Enter a secure password for the new user"

# 2. Create the local user account
New-LocalUser -Name "Developer" -Password $Password -FullName "Jane Developer" -Description "Standard developer workstation profile"

If you wish to force the user to change their temporary password upon their initial login, append the -PasswordNeverExpires:$false switch.

---

Step 3: Modify Account Properties with Set-LocalUser

To update existing account settings without creating a new user, use Set-LocalUser:

# Update the account description
Set-LocalUser -Name "Developer" -Description "Senior Engineering Account"

# Prevent the account password from ever expiring
Set-LocalUser -Name "Developer" -PasswordNeverExpires $true

# Reset an existing account password
$NewPassword = Read-Host -AsSecureString "Enter new password"
Set-LocalUser -Name "Developer" -Password $NewPassword

---

Step 4: Enable or Disable an Account

Temporarily deactivating an account revokes sign-in privileges immediately without destroying the user’s personal files, desktop configuration, or app data:

# Disable the account
Disable-LocalUser -Name "Developer"

# Re-enable the account
Enable-LocalUser -Name "Developer"

---

Step 5: Assign Group Memberships (Administrator Privileges)

By default, newly created accounts belong only to the standard Users group. If the profile requires elevated privileges, add the account to the local Administrators group:

# Add user to local Administrators
Add-LocalGroupMember -Group "Administrators" -Member "Developer"

# Verify membership
Get-LocalGroupMember -Group "Administrators"

To revoke administrative permissions while preserving the user account, remove them from the group:

Remove-LocalGroupMember -Group "Administrators" -Member "Developer"

---

Step 6: Safely Delete a Local User Account

When a local user account is permanently decommissioned, remove it using Remove-LocalUser:

Remove-LocalUser -Name "Developer"

Note: Deleting an account removes its entry from the SAM database. To reclaim disk space, you must independently delete the user’s home folder located at C:\Users\Developer.

To master more PowerShell automation workflows in Windows 11, check out our guide on how to calculate folder and directory sizes in Windows 11 using PowerShell, or discover how to manage Windows services in Windows 11 using PowerShell Get-Service and Set-Service.

---

Frequently Asked Questions

Does New-LocalUser work on systems connected to Microsoft Accounts?

Yes. New-LocalUser creates pure offline, traditional local user profiles. These profiles bypass Microsoft cloud account login requirements, which is ideal for offline troubleshooting and air-gapped environments.

Can I rename a local account using PowerShell?

The standard LocalAccounts module lacks a direct Rename-LocalUser cmdlet. To rename an account, use the WMI/CIM interface: (Get-CimInstance Win32_UserAccount -Filter "Name='OldName'").Rename("NewName").

What happens to active sessions when an account is disabled?

Disabling an account blocks all future authentication requests immediately. However, if the user is currently logged on, their active session remains running until they log off, lock the workstation, or the administrator forcefully ends their session.