Remove and Create Accounts¶
Remove unauthorized accounts¶
Any account not in the README is either abandoned, created by mistake, or created by an attacker. All three go.
Disable first if you're unsure, then delete once you're certain. A disabled account can't be used to log in, and it can be re-enabled if the README turns out to mention it somewhere you missed.
net user hacker /active:no # disable
net user hacker /delete # remove entirely
lusrmgr.msc → Users → right-click the user → Properties → tick Account is disabled. To remove: right-click → Delete.
Or Settings → Accounts → Other users → select → Remove.
Deleting an account leaves its profile folder under C:\Users\. Delete that too if the README's policy says to remove the user's files; otherwise leave it.
One person, one account¶
Three server STIG rules that are just as true on a workstation (WN22-00-000010, 000040, 000070): no shared accounts, and anyone who holds administrator or Backup Operators membership uses a separate everyday account for ordinary work. A shared account like staff or intern can't be tied to a person in the log, so if the README lists one, it still needs a real owner named in the README to survive. An administrator who browses the web with the admin account hands that token to whatever the browser runs. When the README lists someone as both a user and an administrator, that's one account with admin rights, not permission to create a second one; the rule is about how the account is used.
Inactive accounts¶
The STIG requires accounts unused for 35 days to be disabled or removed, on the reasoning that nobody is watching an account nobody uses. Find them:
Get-LocalUser | Where { $_.Enabled -and ($_.LastLogon -lt (Get-Date).AddDays(-35) -or -not $_.LastLogon) } | Select Name, LastLogon
An authorized user who simply hasn't logged in yet is fine. An account with no logon ever and a name you don't recognize is a finding twice over.
Service accounts¶
An account like svc_backup or sqlservice may be a real service account that a program logs on with. Check before deleting:
sc query state= all | findstr /i "SERVICE_NAME"
is a lot of output. Better, in services.msc, add the Log On As column (View → Add/Remove Columns) and sort by it. If no service runs as the account and the README doesn't mention it, remove it.
Enable and unlock authorized accounts¶
An authorized account that's been disabled or locked out is also a problem. The people the README names need to log in.
net user alice
Account active No
Account expires Never
...
Account locked out Yes
Fix:
net user alice /active:yes
Lockouts clear in lusrmgr.msc → Properties → untick Account is locked out. (There's no net user switch for that one.)
Create accounts the README asks for¶
net user carol Str0ngTempPassw0rd! /add
net user carol /fullname:"Carol Diaz"
New accounts go in Users by default. Add to other groups only if the README says so.
To create a group:
net localgroup Accounting /add
net localgroup Accounting carol /add
GUI: lusrmgr.msc → Users → right-click → New User. Fill in the name, a password that meets policy, and leave User must change password at next logon ticked.
Example¶
README: "Authorized users: alice (admin), bob, carol, dave." Machine has: alice, bob, hacker, svc_backup, test.
hackerandtest: not in the README. Disable, then delete.svc_backup: check services. Nothing runs as it. Delete.carol,dave: missing. Create both, standard users.alice: confirm in Administrators.bob: confirm not.
Verify¶
net user
Every name should match the README, plus the built-in accounts.
Try it¶
- Create a user with
net user, disable it, enable it, and delete it, checkingnet user nameafter each step. - Create a user with a password that doesn't meet the policy and read the error.
Build it¶
A script that creates the README's users if they don't exist and sets a temporary password that must change at first logon. Feed it the same authorized-users file as your listing script.