Skip to content

Remove and Create Accounts

Remove unauthorized accounts

Any account not in the README is either abandoned, created by mistake, or created by an attacker. All three go.

Disable first if you're unsure, then delete once you're certain. A disabled account can't be used to log in, and it can be re-enabled if the README turns out to mention it somewhere you missed.

net user hacker /active:no       # disable
net user hacker /delete          # remove entirely

lusrmgr.msc → Users → right-click the user → Properties → tick Account is disabled. To remove: right-click → Delete.

Or Settings → Accounts → Other users → select → Remove.

Deleting an account leaves its profile folder under C:\Users\. Delete that too if the README's policy says to remove the user's files; otherwise leave it.

Inactive accounts

The STIG requires accounts unused for 35 days to be disabled or removed, on the reasoning that nobody is watching an account nobody uses. Find them:

Get-LocalUser | Where { $_.Enabled -and ($_.LastLogon -lt (Get-Date).AddDays(-35) -or -not $_.LastLogon) } | Select Name, LastLogon

An authorized user who simply hasn't logged in yet is fine. An account with no logon ever and a name you don't recognize is a finding twice over.

Service accounts

An account like svc_backup or sqlservice may be a real service account that a program logs on with. Check before deleting:

sc query state= all | findstr /i "SERVICE_NAME"

is a lot of output. Better, in services.msc, add the Log On As column (View → Add/Remove Columns) and sort by it. If no service runs as the account and the README doesn't mention it, remove it.

Enable and unlock authorized accounts

An authorized account that's been disabled or locked out is also a problem. The people the README names need to log in.

net user alice

Account active               No
Account expires              Never
...
Account locked out           Yes

Fix:

net user alice /active:yes

Lockouts clear in lusrmgr.msc → Properties → untick Account is locked out. (There's no net user switch for that one.)

Create accounts the README asks for

net user carol Str0ngTempPassw0rd! /add
net user carol /fullname:"Carol Diaz"

New accounts go in Users by default. Add to other groups only if the README says so.

To create a group:

net localgroup Accounting /add
net localgroup Accounting carol /add

GUI: lusrmgr.msc → Users → right-click → New User. Fill in the name, a password that meets policy, and leave User must change password at next logon ticked.

Example

README: "Authorized users: alice (admin), bob, carol, dave." Machine has: alice, bob, hacker, svc_backup, test.

  1. hacker and test: not in the README. Disable, then delete.
  2. svc_backup: check services. Nothing runs as it. Delete.
  3. carol, dave: missing. Create both, standard users.
  4. alice: confirm in Administrators. bob: confirm not.

Verify

net user

Every name should match the README, plus the built-in accounts.

Next

Built-in Administrator and Guest