How to Manage Local Groups and Membership in Windows 11 Using PowerShell

In Windows 11, local security groups serve as the foundational security boundary for managing access controls, system rights, and privilege delegation on individual workstations. While administrators often configure groups using the legacy Computer Management graphical console (lusrmgr.msc), automating administrative tasks or provisioning new machines requires command-line scripting.

The native Microsoft.PowerShell.LocalAccounts module provides a comprehensive suite of dedicated cmdlets to query, create, modify, and audit local security groups and their memberships. Whether you need to audit who belongs to the high-privilege Administrators group or provision custom developer groups, PowerShell handles the process quickly and reliably. Here is how to manage local groups and membership in Windows 11 using PowerShell.

Prerequisites: Launching an Elevated PowerShell Console

Managing security principals, assigning administrative rights, and creating local groups require administrative privileges:

1. Right-click the Start button on your Windows 11 taskbar (or press Windows Key + X).
2. Select Terminal (Admin) or PowerShell (Admin) from the Power User menu.
3. When prompted by the User Account Control (UAC) dialogue, click Yes to elevate the session.

How to List and Inspect Existing Local Groups

To inspect all local security groups present on your Windows 11 machine, use the Get-LocalGroup cmdlet:

Get-LocalGroup

This command outputs a formatted table containing the name, Security Identifier (SID), and description for built-in system groups (such as Administrators, Remote Desktop Users, Hyper-V Administrators, and Users).

To query a specific group by name and display all its properties, pass the -Name parameter:

Get-LocalGroup -Name "Administrators" | Select-Object *

How to Create a New Local Security Group

To establish a custom local group for role-based delegation (such as isolating access to a local test database or folder share), use New-LocalGroup:

New-LocalGroup -Name "DevTeam" -Description "Engineering personnel with local staging access"

The cmdlet instantiates the group immediately and outputs the newly assigned security identifier (SID).

How to View Members of a Local Group

To audit group membership and identify exactly which local users, Microsoft accounts, or domain accounts belong to a specific group, use Get-LocalGroupMember:

Get-LocalGroupMember -Group "Administrators"

The console lists each member’s ObjectClass (User or Group), Name, and unique SID. This command is invaluable for verifying that unauthorised users have not been granted elevated administrative privileges.

If you need to query members across all built-in security groups simultaneously, run this one-line pipeline:

Get-LocalGroup | ForEach-Object {
    [PSCustomObject]@{
        Group = $_.Name
        Members = (Get-LocalGroupMember -Group $_.Name -ErrorAction SilentlyContinue).Name -join ", "
    }
} | Format-Table -AutoSize

How to Add Members to a Local Group

To add a local user to an existing group, execute Add-LocalGroupMember by specifying the target group name and the member’s account name:

Add-LocalGroupMember -Group "Remote Desktop Users" -Member "SarahJenkins"

You can also add multiple users simultaneously by passing an array of names:

Add-LocalGroupMember -Group "DevTeam" -Member "SarahJenkins", "MarkDavies"

To add Active Directory domain accounts or Microsoft Entra ID (Azure AD) principals on corporate machines, specify the domain prefix or AzureAD identifier:

Add-LocalGroupMember -Group "Administrators" -Member "CORPDOMAIN\sysadmin01"

How to Remove Members from a Local Group

When an employee changes roles or no longer requires elevated permissions, remove them from the group using Remove-LocalGroupMember:

Remove-LocalGroupMember -Group "Administrators" -Member "SarahJenkins"

By default, PowerShell removes the member without a prompt. To review confirmation before committing the change, append the -Confirm switch:

Remove-LocalGroupMember -Group "Administrators" -Member "SarahJenkins" -Confirm

How to Modify Group Descriptions and Rename Groups

To update the descriptive text of an existing group without re-creating it, use Set-LocalGroup:

Set-LocalGroup -Name "DevTeam" -Description "Software development team with staging access"

To change the name of a custom group, use the Rename-LocalGroup cmdlet:

Rename-LocalGroup -Name "DevTeam" -NewName "DevOpsEngineers"

Note: Built-in system groups such as Administrators or Guests should not be renamed via PowerShell unless conforming to strict enterprise CIS hardening benchmarks.

How to Delete a Local Group

To permanently remove a custom local group that is no longer needed, execute Remove-LocalGroup:

Remove-LocalGroup -Name "DevOpsEngineers"

Deleting a group deletes the group object and its SID. It does not delete the user accounts that were members of that group.

Summary of Essential Cmdlets

Cmdlet	Primary Function
Get-LocalGroup	Lists all local security groups and their descriptions.
New-LocalGroup	Creates a new local security group.
Get-LocalGroupMember	Displays users and principals belonging to a specific group.
Add-LocalGroupMember	Assigns users or security accounts to a group.
Remove-LocalGroupMember	Revokes user membership from a group.
Set-LocalGroup	Modifies group metadata such as descriptions.
Rename-LocalGroup	Renames a security group.
Remove-LocalGroup	Permanently deletes a local group.