Manage local users and groups on Windows Server

Every person who uses your server should have their own account. That way you can see who did what, remove one person without changing everyone's password, and give each person only the rights they need. This guide covers the two tools for local accounts, lusrmgr.msc and PowerShell, and the groups that matter most on a remote server.

Before you start

• Administrator access over Remote Desktop to 203.0.113.10:3389.
• A list of the people who need access and what they need to do.
• This guide covers local accounts on a standalone server, which is how Windows VPS and Admin RDP servers come. Domain accounts are managed in Active Directory instead.

The two tools

• Local Users and Groups (lusrmgr.msc): a graphical console. Press Win + R, type lusrmgr.msc and press Enter. It has a Users folder and a Groups folder. It is also inside Computer Management under System Tools.
• PowerShell: the LocalAccounts cmdlets, such as Get-LocalUser and Add-LocalGroupMember. They are faster for repeat jobs and easy to script. Run PowerShell as Administrator to make changes.

List users and groups

Get-LocalUser | Format-Table Name, Enabled, LastLogon
Get-LocalGroup | Format-Table Name, Description

To see who is in a group:

Get-LocalGroupMember -Group "Administrators"
Get-LocalGroupMember -Group "Remote Desktop Users"

Create a user

PowerShell asks for the password securely, so it does not show on screen or in your history:

$pw = Read-Host -AsSecureString "Password for the new user"
New-LocalUser -Name "deploy" -Password $pw -FullName "Deploy User" -Description "App deployments"

In the console: right-click Users, choose New User, fill in the name and password, and click Create. Untick User must change password at next logon if the person will sign in over Remote Desktop for the first time and you are not sure their client handles the change prompt.

A new user is in the Users group only. They cannot sign in over Remote Desktop until you add them to a group that allows it.

Remote Desktop Users vs Administrators

These two groups decide most of what a user can do on a remote server:

• Remote Desktop Users: members can sign in over Remote Desktop, but cannot install software for everyone, change system settings or see other users' files. Use this for most people.
• Administrators: full control of the server, including Remote Desktop access. Only give this to people who must manage the server itself.

Add a user to Remote Desktop Users:

Add-LocalGroupMember -Group "Remote Desktop Users" -Member "deploy"

Add a user to Administrators only when needed:

Add-LocalGroupMember -Group "Administrators" -Member "deploy"

Remove someone from a group:

Remove-LocalGroupMember -Group "Administrators" -Member "deploy"

In the console, double-click a group, then use Add or Remove. You can also open a user and use the Member Of tab.

Change a password or account setting

$pw = Read-Host -AsSecureString "New password"
Set-LocalUser -Name "deploy" -Password $pw

Other useful settings:

Set-LocalUser -Name "deploy" -PasswordNeverExpires $false
Set-LocalUser -Name "deploy" -Description "Left project, review in March"

Disable vs delete an account

When someone no longer needs access, you have two choices.

Disable keeps the account, its profile and its files, but nobody can sign in with it:

Disable-LocalUser -Name "deploy"

Use this first. It is reversible with Enable-LocalUser, and it keeps files and scheduled tasks you may still need.

Delete removes the account for good:

Remove-LocalUser -Name "deploy"

A sensible routine: disable straight away, check nothing breaks for a few weeks, then delete and remove the old profile folder.

Check it works

1. List the group members again and confirm the changes.
2. From your own computer, open a Remote Desktop connection to 203.0.113.10:3389 and sign in as the new user.
3. For a disabled user, a sign-in attempt should fail with a message that the account is disabled.

Troubleshooting

• "The connection was denied because the user account is not authorized for remote login": the user is not in Remote Desktop Users or Administrators, or a deny right blocks them. See Allow log on through Remote Desktop.
• New-LocalUser fails with a password error: the password does not meet the server's password policy. Use a longer one with mixed character types.
• lusrmgr.msc says the snap-in cannot be used: Windows Home editions do not include it. Use the PowerShell commands instead.
• Get-LocalUser is not recognised: you are in 32-bit PowerShell or a very old version. Open the normal 64-bit Windows PowerShell.

Next steps

• Step-by-step RDP access for a new person: Create a Windows user with RDP access.
• Protect yourself from lockouts: Create a backup administrator account.