lusrmgr.msc: How Local Users and Groups Works in Windows

QUICK ANSWER

lusrmgr.msc opens the Local Users and Groups Microsoft Management Console snap-in. It lets authorized administrators create, disable, rename, and delete local accounts; reset passwords; and manage membership in local security groups.

The snap-in manages accounts stored on an individual Windows computer—not Microsoft accounts, Microsoft Entra ID identities, or Active Directory domain accounts. It is normally available on professional and business Windows editions, but not Windows Home. Home users can use Settings, net user, net localgroup, or supported PowerShell commands instead.

 

What Is lusrmgr.msc?

lusrmgr.msc is the filename and Run command for the Windows Local Users and Groups management console. It is an MMC snap-in that provides a graphical interface for administering accounts and security groups stored locally on a computer.

To open it:

1. Press Windows key + R.
2. Enter:

lusrmgr.msc

3. Press Enter.
4. Approve the User Account Control prompt if Windows displays one.

You can also open Computer Management by running compmgmt.msc, then select System Tools > Local Users and Groups.

Changes that affect other accounts or protected groups normally require administrator privileges.

How Local Accounts and Groups Work

Windows stores local security accounts in its local Security Accounts Manager database. Each account and group receives a security identifier, or SID, that Windows uses when evaluating permissions.

A local account is recognized only by the computer where it exists. For example:

COMPUTERNAME\UserName

A local group collects accounts and grants them a common set of permissions or rights. Instead of assigning access separately to every person, administrators can add users to an appropriate group and assign access to that group.

Local accounts are distinct from:

• Microsoft accounts used with Microsoft online services
• Microsoft Entra ID work or school identities
• Active Directory domain accounts
• Accounts stored on another computer

On a domain-joined workstation, lusrmgr.msc still manages that workstation’s local accounts. Use Active Directory Users and Computers or another approved directory-management tool for domain accounts.

Understanding the lusrmgr.msc Interface

The console contains two main folders.

Users

The Users folder shows local user accounts, including built-in accounts and accounts created by administrators or applications.

Available operations can include:

• Creating a local user
• Renaming an account
• Setting or resetting its password
• Enabling or disabling it
• Requiring a password change at the next sign-in
• Preventing the user from changing the password
• Configuring password-expiration behavior
• Deleting an account
• Viewing or editing group membership

A downward-arrow icon normally indicates that an account is disabled.

Groups

The Groups folder shows local security groups. Group membership determines what members can do on that computer.

Common groups include:

Available groups vary by Windows edition, installed roles, and enabled features. Group membership does not necessarily override firewall rules, service configuration, user-right assignments, or organizational policies.

Supported Windows Editions and Important Limitations

The Local Users and Groups snap-in is commonly available in:

• Windows 10 and Windows 11 Pro
• Windows Enterprise
• Windows Education
• Supported Windows Server installations with the relevant graphical tools

Windows Home does not provide the Local Users and Groups MMC snap-in. Running lusrmgr.msc on Home may display a message stating that the snap-in cannot be used with that edition.

Additional limitations include:

• It manages local accounts, not domain accounts.
• Domain controllers do not have the same standalone local-account database as member computers. Use Active Directory management tools for domain identities.
• A Group Policy, mobile device management policy, provisioning process, or security product may reverse local changes.
• Some built-in system-managed accounts cannot be deleted.
• The 32-bit Microsoft.PowerShell.LocalAccounts module is unavailable in 32-bit PowerShell on a 64-bit Windows system. Use 64-bit Windows PowerShell when necessary. learn.microsoft.com

How to Create a Local User Safely

1. Open lusrmgr.msc as an administrator.
2. Select Users.
3. Right-click an empty area and select New User.
4. Enter a unique username, full name, and optional description.
5. Set a strong password that complies with applicable password policy.
6. Select the appropriate password options.
7. Select Create, then Close.

The new account normally belongs to the standard Users group. Leave it as a standard account unless administrative access is genuinely required.

After creating the account, verify it by opening its properties and selecting Member Of. You can also run:

net user "UserName"

Avoid placing a plaintext password directly in a command because it may be exposed through command history, scripts, logs, or process-monitoring tools.

How to Add a User to a Local Group

1. Open lusrmgr.msc.
2. Select Groups.
3. Double-click the required group.
4. Select Add.
5. Enter the account name.
6. Select Check Names.
7. Select OK, then OK again.

Alternatively, open the user’s properties, select Member Of, and add the required group.

To add a local account to the Administrators group from an elevated command prompt:

net localgroup Administrators "UserName" /add

To verify membership:

net localgroup Administrators

Built-in group names can be localized on non-English Windows installations. PowerShell can also manage group membership using account names or SIDs. Microsoft documents Add-LocalGroupMember as the supported PowerShell cmdlet for adding principals to local security groups. learn.microsoft.com

Security Warning

Membership in Administrators, Backup Operators, Remote Desktop Users, or another privileged group can create substantial security exposure. Apply least privilege: give each user only the access required for their work.

Where possible, use separate standard and administrative accounts instead of using an administrator account for everyday browsing, email, and document work.

Account Properties Explained

User must change password at next logon

Forces the user to select a new password during the next password-based sign-in. This is useful when an administrator creates a temporary initial password.

This option may not be appropriate for service accounts, scheduled tasks, unattended systems, or accounts that cannot complete an interactive sign-in.

User cannot change password

Prevents the user from changing the password through normal account-management methods. Use this cautiously because it can conflict with security policy and operational requirements.

Password never expires

Exempts the account from password-expiration rules. Avoid enabling this casually. For managed local administrator accounts, Windows LAPS is generally safer than using the same non-expiring password across devices.

Account is disabled

Prevents new sign-ins using the account without deleting its SID or account record. Disabling is usually safer than immediate deletion when investigating an account or retiring an employee or service.

A user who is already signed in may retain an existing session until sign-out, restart, or another administrative action terminates it.

Account is locked out

Indicates that the account has been locked by the applicable account lockout policy. An administrator may be able to clear the lockout, or it may expire automatically according to policy.

Resetting a Local Password: Important Risk

An administrator can right-click an account and select Set Password, but this is a password reset—not the same as the user changing a known password.

Resetting another user’s password can cause loss of access to:

• Encrypting File System–encrypted data
• Certain personal certificates and associated private keys
• Some stored credentials or saved passwords

Use the user’s normal password-change process whenever the existing password is known. Before an administrative reset, check for EFS-encrypted files and certificate-recovery requirements, especially on standalone computers without an EFS recovery agent.

For a forgotten local password, Windows also supports password reset from the sign-in screen when security questions were configured for that account. support.microsoft.com

Renaming, Disabling, and Deleting Accounts

Renaming an account

Renaming changes the visible account name but does not change its SID. Permissions assigned to the SID normally continue to work.

The user-profile folder under C:\Users usually does not automatically change to match the new account name. Do not rename profile folders manually without following a tested, supported migration procedure.

Disabling an account

Disabling blocks future authentication while preserving the account, group memberships, and SID. It is generally the preferred first step when an account might be needed later.

Deleting an account

Deleting permanently removes its account record and SID. Creating another account with the same name does not recreate the same identity because it receives a different SID.

Before deletion:

1. Confirm that another working administrator account exists.
2. Back up required user data.
3. Check file, folder, share, service, task, and application dependencies.
4. Disable and monitor the account first when practical.
5. Document its group memberships and permissions.

Deleting an account through lusrmgr.msc is not a complete user-profile cleanup procedure. Profile data and SID-based permission entries may remain. Microsoft provides a separate supported procedure for removing Windows user profiles. Windows Server

Never delete or disable your only usable administrator account.

PowerShell Alternatives

PowerShell is useful for repeatable administration, inventory, and automation. Run commands in an elevated 64-bit PowerShell session when making protected changes.

List local users:

Get-LocalUser

List local groups:

Get-LocalGroup

Show members of the local Administrators group:

Get-LocalGroupMember -Group "Administrators"

Create a user without exposing the password in the command:

$Password = Read-Host "Enter the new password" -AsSecureString
New-LocalUser -Name "SupportUser" -Password $Password -FullName "Support User" -Description "Local support account"

Add the account to a group:

Add-LocalGroupMember -Group "Remote Desktop Users" -Member "SupportUser"

Disable and re-enable the account:

Disable-LocalUser -Name "SupportUser"
Enable-LocalUser -Name "SupportUser"

Remove the account:

Remove-LocalUser -Name "SupportUser"

Get-LocalUser returns built-in accounts, locally created accounts, and local accounts connected to Microsoft accounts. learn.microsoft.com Get-LocalGroup reads local security groups from the Security Accounts Manager. learn.microsoft.com

Test automation on a non-production computer before deploying it widely.

Command Prompt Alternatives

The built-in net commands are available on current Windows client and server versions.

List local users:

net user

Display one account:

net user "UserName"

Create an account and prompt securely for its password:

net user "UserName" * /add

Disable an account:

net user "UserName" /active:no

Enable an account:

net user "UserName" /active:yes

Delete an account:

net user "UserName" /delete

List local groups:

net localgroup

Add a member to a group:

net localgroup "Remote Desktop Users" "UserName" /add

Remove a member:

net localgroup "Remote Desktop Users" "UserName" /delete

Microsoft documents net user as a supported command for displaying, creating, modifying, and deleting local or domain user accounts. learn.microsoft.com

Benefits of lusrmgr.msc

The principal benefits are:

• A centralized graphical view of local users and groups
• Faster account enablement, disablement, and membership changes
• Clear visibility into account status and group membership
• No requirement to memorize command syntax
• Useful descriptions for documenting account purposes
• Easier implementation of role-based access through groups
• Support for local troubleshooting when directory services are unavailable
• Reduced mistakes when managing a small number of accounts

For large or centrally managed environments, PowerShell, Group Policy, mobile device management, Microsoft Intune, Windows LAPS, or identity-management systems are generally more scalable and auditable.

Security Best Practices

• Use standard accounts for everyday activity.
• Grant administrator membership only when necessary.
• Maintain at least one tested administrative recovery path.
• Use unique, strong passwords for local administrative accounts.
• Prefer Windows LAPS for managing local administrator passwords across organizational devices.
• Disable unused accounts before deleting them.
• Do not enable the built-in Guest account without a documented requirement.
• Review privileged group membership regularly.
• Avoid shared accounts when individual accountability is required.
• Do not reuse the same local administrator password across many computers.
• Document accounts used by services, scheduled tasks, or applications.
• Back up EFS certificates and recovery keys before password or account changes.
• Verify whether Group Policy or device-management policy controls the setting before making local changes.
• Do not install unofficial replacements merely to reproduce lusrmgr.msc on Windows Home.

Troubleshooting lusrmgr.msc

“This snap-in may not be used with this edition of Windows”

The computer is probably running Windows Home. Confirm the edition under Settings > System > About > Windows specifications or run:

winver

Use Settings > Accounts > Other users, net user, net localgroup, or supported PowerShell commands. Upgrade Windows only if other Pro features justify it.

Windows cannot find lusrmgr.msc

Possible causes include:

• The Windows edition does not include the snap-in.
• The command was mistyped.
• Windows components are damaged.
• Organizational policy restricts administrative tools.

Check the Windows edition first. Do not download an .msc file from an unofficial website.

Access is denied

Reopen the console with administrator credentials. In a managed environment, confirm that policy permits the requested change.

An administrator token does not guarantee that policy-controlled memberships can be changed permanently; central management may restore the approved configuration.

An account does not appear

Confirm that you are viewing the correct computer. A domain or Microsoft Entra account is not necessarily a local user record.

Run:

whoami

Then list local users:

net user

In PowerShell, use:

Get-LocalUser

A group change does not take effect immediately

The user may need to sign out and sign in again so Windows can create a new access token containing the updated group memberships. Some services or applications may require a restart.

Also verify that required user rights, firewall rules, service settings, and application permissions are configured. For example, adding someone to Remote Desktop Users alone does not enable Remote Desktop or open the required firewall rules.

A PowerShell local-account command is not recognized

Use 64-bit Windows PowerShell on a 64-bit computer and verify that the module is available:

Get-Module -ListAvailable Microsoft.PowerShell.LocalAccounts

The LocalAccounts module is not available in 32-bit PowerShell on a 64-bit system. learn.microsoft.com

FAQ

Frequently Asked Questions

Is lusrmgr.msc available in Windows 11 Home?

No. Windows Home does not include the Local Users and Groups MMC snap-in. Use Settings, net user, net localgroup, or available LocalAccounts PowerShell commands instead.

Does lusrmgr.msc manage Microsoft accounts?

It manages the local security representation of accounts on the computer. It does not administer the person’s Microsoft online account, cloud password, subscriptions, or online security settings.

Can lusrmgr.msc manage domain users?

It cannot create or delete Active Directory domain accounts. It can add a domain principal to a local group on a domain-joined computer when the required connectivity and permissions are available.

Do I need administrator rights?

Viewing some information may work without elevation, but creating, deleting, enabling, disabling, resetting, or changing protected accounts and groups generally requires appropriate administrator privileges.

Is adding a user to Administrators safe?

It gives the user extensive control and increases the impact of mistakes, malware, or credential theft. Use a standard account unless administrative access is specifically required.

What is the difference between disabling and deleting an account?

Disabling blocks new sign-ins while retaining the account and SID. Deleting removes the account identity permanently. A later account with the same name receives a new SID.

Does deleting a user in lusrmgr.msc remove the user’s files?

Do not assume that it does. Profile folders and data may remain, and deleting the account can make SID-protected resources harder to identify or access. Back up data and use the supported user-profile removal process separately.

Why does the profile folder retain the old name after renaming a user?

The account name and profile-folder path are separate. Renaming the account does not automatically rename its existing profile directory.

Can lusrmgr.msc show a user’s password?

No. Windows does not display an existing password through this console. An authorized administrator can reset a local password, but the reset can affect EFS-encrypted files, certificates, and stored credentials.

When should PowerShell be used instead?

Use PowerShell when managing multiple computers, applying a repeatable configuration, generating inventories, or recording administration in scripts. Use lusrmgr.msc for convenient interactive management of a small number of accounts.

FINAL RECOMMENDATION / CONCLUSION

Use lusrmgr.msc for direct, graphical administration of local users and groups on supported Windows editions. Keep ordinary users in standard groups, use separate administrative identities, verify every privileged membership, and disable accounts before deleting them when practical.

For organizational environments, combine local account management with centralized policy, auditing, and Windows LAPS. Use Active Directory or Microsoft Entra management tools for directory identities, and use supported command-line alternatives when the MMC snap-in is unavailable.

 

#lusrmgr #LocalUsersAndGroups #Windows11 #Windows10 #WindowsServer #UserAccounts #LocalAccounts #WindowsSecurity #SystemAdministration #ITSupport #PowerShell #CommandPrompt #NetUser #LocalGroups #AdministratorAccount #WindowsHome #ComputerManagement #WindowsLAPS #AccessControl #Troubleshooting

SOURCES

• Microsoft Learn — Local accounts. learn.microsoft.com
• Microsoft Learn — net user command reference. learn.microsoft.com
• Microsoft Learn — Get-LocalUser. learn.microsoft.com
• Microsoft Learn — Get-LocalGroup. learn.microsoft.com
• Microsoft Learn — Get-LocalGroupMember. learn.microsoft.com
• Microsoft Learn — Add-LocalGroupMember. learn.microsoft.com
• Microsoft Support — Change or reset your local account password in Windows. support.microsoft.com
• Microsoft Learn — Delete a user profile in Windows. Windows Server
• Microsoft Learn — Securing local Administrator accounts and groups. learn.microsoft.com