How to Use PowerShell to Manage Windows Server Local Users and Groups

While the graphical “Computer Management” console (compmgmt.msc) is fine for adding a single user to a Windows Server, it is entirely inadequate for bulk operations or automated provisioning scripts. For systems administrators deploying standalone servers, Nano Server, or configuring servers in a workgroup environment, PowerShell provides a fast and scriptable method for managing local users and groups using the Microsoft.PowerShell.LocalAccounts module.

Step 1: Creating a New Local User

Creating a user requires providing a name and a secure password. In PowerShell, passwords cannot be passed as plain text strings for security reasons; they must be converted to a SecureString object.

1. Open an elevated PowerShell prompt.
2. Create the SecureString password:

$Password = Read-Host -AsSecureString "Enter password for new user"

Alternatively, in a fully automated script (which is less secure but sometimes necessary), you can convert a plain text string directly:

$Password = ConvertTo-SecureString "TempP@ssw0rd123!" -AsPlainText -Force

3. Create the user account:

New-LocalUser -Name "DevUser1" -Password $Password -FullName "Development User 1" -Description "Contractor Account"

Step 2: Forcing a Password Reset on First Login

Security best practices dictate that administrators should not know a user’s final password. You can force the user to change the temporary password you just set the first time they log in via RDP.

Set-LocalUser -Name "DevUser1" -PasswordChangeable $true -PasswordNeverExpires $false

Note: If you want to prevent a user from changing their password (e.g., a shared service account), you would set -PasswordChangeable $false.

Step 3: Creating and Managing Local Groups

Grouping users allows you to apply file share permissions or specific rights efficiently.

To create a new local group called “WebDevelopers”:

New-LocalGroup -Name "WebDevelopers" -Description "Users with access to IIS directories"

Step 4: Adding Users to Groups

Once the user and the group exist, you can link them together. The most common administrative task is granting a standard user local administrative privileges.

To add our new user to the built-in Administrators group:

Add-LocalGroupMember -Group "Administrators" -Member "DevUser1"

To add them to the custom group we just created:

Add-LocalGroupMember -Group "WebDevelopers" -Member "DevUser1"

Step 5: Auditing Users and Groups

PowerShell makes it incredibly easy to audit server access.

To view a list of all local users and whether their accounts are currently enabled:

Get-LocalUser | Select-Object Name, Enabled, LastLogon

To see exactly who has administrative privileges on the server:

Get-LocalGroupMember -Group "Administrators"

Step 6: Disabling or Removing Users

When an employee leaves or a contractor’s project ends, you should immediately disable their access rather than deleting the account (which destroys their unique Security Identifier and orphans their files).

Disable-LocalUser -Name "DevUser1"

If you truly need to permanently delete the account and the associated profile data:

Remove-LocalUser -Name "DevUser1"

By leveraging these PowerShell cmdlets, you can replace tedious GUI clicks with rapid, repeatable scripts for all local identity management tasks on Windows Server.