PowerShell: Creating and Managing Users

User management is essential for system administration and penetration testing. PowerShell provides cmdlets for managing local users, Active Directory users, and groups. This lesson covers user creation, modification, deletion, and practical scenarios for both local systems and domain environments.

What You'll Learn

Creating local users
Managing local groups
Active Directory user management
Password management
User properties and permissions
Bulk user operations
Security best practices
Practical pentesting scenarios

Local User Management

Get Local Users

# List all local users
Get-LocalUser

# Get specific user
Get-LocalUser -Name "Administrator"

# Filter enabled users
Get-LocalUser | Where-Object {$_.Enabled -eq $true}

# Filter disabled users
Get-LocalUser | Where-Object {$_.Enabled -eq $false}

Create Local User

# Basic user creation
New-LocalUser -Name "TestUser" -NoPassword

# User with password
$password = Read-Host "Enter password" -AsSecureString
New-LocalUser -Name "Alice" -Password $password -FullName "Alice Smith"

# User with description
New-LocalUser -Name "Bob" -Password $password -Description "Test Account"

# User that can't change password
New-LocalUser -Name "Service" -Password $password -UserMayNotChangePassword

# User with password never expires
New-LocalUser -Name "Admin2" -Password $password -PasswordNeverExpires

# Disabled user
New-LocalUser -Name "Disabled" -Password $password -Disabled

Modify Local User

# Enable user
Enable-LocalUser -Name "TestUser"

# Disable user
Disable-LocalUser -Name "TestUser"

# Change description
Set-LocalUser -Name "TestUser" -Description "Modified description"

# Change full name
Set-LocalUser -Name "TestUser" -FullName "Test User Account"

# Change password
$newPassword = Read-Host "New password" -AsSecureString
Set-LocalUser -Name "TestUser" -Password $newPassword

# Set password never expires
Set-LocalUser -Name "TestUser" -PasswordNeverExpires $true

# Force password change at next logon
Set-LocalUser -Name "TestUser" -PasswordChangeableDate (Get-Date)

Remove Local User

# Delete user
Remove-LocalUser -Name "TestUser"

# With confirmation
Remove-LocalUser -Name "TestUser" -Confirm

# Without confirmation
Remove-LocalUser -Name "TestUser" -Confirm:$false

Local Group Management

Get Local Groups

# List all local groups
Get-LocalGroup

# Get specific group
Get-LocalGroup -Name "Administrators"

# Get group members
Get-LocalGroupMember -Group "Administrators"

# Check if user is in group
Get-LocalGroupMember -Group "Administrators" | Where-Object {$_.Name -like "*Alice"}

Create Local Group

# Create new group
New-LocalGroup -Name "Developers" -Description "Development Team"

# Create group with members
New-LocalGroup -Name "TestGroup" -Description "Test"
Add-LocalGroupMember -Group "TestGroup" -Member "Alice", "Bob"

Manage Group Membership

# Add user to group
Add-LocalGroupMember -Group "Administrators" -Member "Alice"

# Add multiple users
Add-LocalGroupMember -Group "Developers" -Member "Alice", "Bob", "Charlie"

# Remove user from group
Remove-LocalGroupMember -Group "Administrators" -Member "Alice"

# Remove multiple users
Remove-LocalGroupMember -Group "Developers" -Member "Bob", "Charlie"

Remove Local Group

# Delete group
Remove-LocalGroup -Name "TestGroup"

Active Directory User Management

Prerequisites

# Import Active Directory module
Import-Module ActiveDirectory

# Check if module is available
Get-Module -ListAvailable -Name ActiveDirectory

Get AD Users

# Get all users
Get-ADUser -Filter *

# Get specific user
Get-ADUser -Identity "alice"

# Get user with all properties
Get-ADUser -Identity "alice" -Properties *

# Filter enabled users
Get-ADUser -Filter {Enabled -eq $true}

# Filter by department
Get-ADUser -Filter {Department -eq "IT"}

# Search by name
Get-ADUser -Filter {Name -like "Alice*"}

# Get users in specific OU
Get-ADUser -Filter * -SearchBase "OU=Users,DC=domain,DC=com"

Create AD User

# Basic AD user
New-ADUser -Name "Alice Smith" -SamAccountName "alice" -UserPrincipalName "[email protected]"

# Complete user creation
$password = ConvertTo-SecureString "P@ssw0rd123!" -AsPlainText -Force

New-ADUser `
    -Name "Bob Jones" `
    -GivenName "Bob" `
    -Surname "Jones" `
    -SamAccountName "bjones" `
    -UserPrincipalName "[email protected]" `
    -DisplayName "Bob Jones" `
    -EmailAddress "[email protected]" `
    -Title "Developer" `
    -Department "IT" `
    -Company "ACME Corp" `
    -Office "Building A" `
    -OfficePhone "555-1234" `
    -MobilePhone "555-5678" `
    -StreetAddress "123 Main St" `
    -City "New York" `
    -State "NY" `
    -PostalCode "10001" `
    -Country "US" `
    -AccountPassword $password `
    -Enabled $true `
    -PasswordNeverExpires $false `
    -ChangePasswordAtLogon $true `
    -Path "OU=Users,DC=domain,DC=com"

Modify AD User

# Change properties
Set-ADUser -Identity "alice" -Title "Senior Developer"
Set-ADUser -Identity "alice" -Department "IT"
Set-ADUser -Identity "alice" -EmailAddress "[email protected]"

# Enable user
Enable-ADAccount -Identity "alice"

# Disable user
Disable-ADAccount -Identity "alice"

# Change password
$password = ConvertTo-SecureString "NewP@ss123" -AsPlainText -Force
Set-ADAccountPassword -Identity "alice" -NewPassword $password -Reset

# Force password change at next logon
Set-ADUser -Identity "alice" -ChangePasswordAtLogon $true

# Unlock account
Unlock-ADAccount -Identity "alice"

# Set account expiration
Set-ADAccountExpiration -Identity "alice" -DateTime "12/31/2025"

Remove AD User

# Delete user
Remove-ADUser -Identity "alice"

# With confirmation
Remove-ADUser -Identity "alice" -Confirm

# Without confirmation
Remove-ADUser -Identity "alice" -Confirm:$false

Active Directory Group Management

Get AD Groups

# List all groups
Get-ADGroup -Filter *

# Get specific group
Get-ADGroup -Identity "Domain Admins"

# Get group members
Get-ADGroupMember -Identity "Domain Admins"

# Get user's groups
Get-ADPrincipalGroupMembership -Identity "alice"

Manage AD Group Membership

# Add user to group
Add-ADGroupMember -Identity "Domain Admins" -Members "alice"

# Add multiple users
Add-ADGroupMember -Identity "Developers" -Members "alice", "bob", "charlie"

# Remove user from group
Remove-ADGroupMember -Identity "Domain Admins" -Members "alice"

# Remove multiple users
Remove-ADGroupMember -Identity "Developers" -Members "bob", "charlie"

Bulk User Operations

Create Multiple Users from CSV

# CSV file format:
# Name,Username,Department,Title
# Alice Smith,alice,IT,Developer
# Bob Jones,bjones,IT,Manager

$users = Import-Csv "users.csv"
$defaultPassword = ConvertTo-SecureString "P@ssw0rd123!" -AsPlainText -Force

foreach ($user in $users) {
    New-ADUser `
        -Name $user.Name `
        -SamAccountName $user.Username `
        -UserPrincipalName "$($user.Username)@domain.com" `
        -Department $user.Department `
        -Title $user.Title `
        -AccountPassword $defaultPassword `
        -Enabled $true `
        -ChangePasswordAtLogon $true
    
    Write-Host "Created user: $($user.Username)"
}

Bulk Modify Users

# Change department for all IT users
Get-ADUser -Filter {Department -eq "IT"} | Set-ADUser -Title "IT Specialist"

# Disable all users in specific OU
Get-ADUser -Filter * -SearchBase "OU=Disabled,DC=domain,DC=com" | Disable-ADAccount

# Set password expiration for all users
Get-ADUser -Filter * | Set-ADUser -PasswordNeverExpires $false

Export Users to CSV

# Export all users
Get-ADUser -Filter * -Properties * | 
    Select-Object Name, SamAccountName, EmailAddress, Department, Title, Enabled |
    Export-Csv "users_export.csv" -NoTypeInformation

# Export specific department
Get-ADUser -Filter {Department -eq "IT"} -Properties * |
    Select-Object Name, SamAccountName, Title |
    Export-Csv "it_users.csv" -NoTypeInformation

Password Management

Generate Random Password

# Simple random password
function New-RandomPassword {
    param([int]$Length = 12)
    
    $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()"
    $password = -join ((1..$Length) | ForEach-Object { $chars[(Get-Random -Maximum $chars.Length)] })
    
    return $password
}

# Usage
$password = New-RandomPassword -Length 16
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force

Reset User Password

# Local user
$password = Read-Host "New password" -AsSecureString
Set-LocalUser -Name "alice" -Password $password

# AD user
$password = ConvertTo-SecureString "NewP@ss123" -AsPlainText -Force
Set-ADAccountPassword -Identity "alice" -NewPassword $password -Reset
Set-ADUser -Identity "alice" -ChangePasswordAtLogon $true

Practical Examples

Example 1: Create User with Home Directory

$username = "alice"
$password = ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force

# Create user
New-LocalUser -Name $username -Password $password

# Create home directory
$homeDir = "C:\Users\$username"
New-Item -Path $homeDir -ItemType Directory -Force

# Set permissions
$acl = Get-Acl $homeDir
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($username, "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
$acl.AddAccessRule($rule)
Set-Acl $homeDir $acl

Example 2: User Audit Report

$report = Get-LocalUser | ForEach-Object {
    [PSCustomObject]@{
        Username = $_.Name
        FullName = $_.FullName
        Enabled = $_.Enabled
        LastLogon = $_.LastLogon
        PasswordExpires = $_.PasswordExpires
        Description = $_.Description
    }
}

$report | Export-Csv "user_audit.csv" -NoTypeInformation
$report | Format-Table

Example 3: Find Inactive Users

# Find users not logged in for 90 days
$cutoffDate = (Get-Date).AddDays(-90)

Get-ADUser -Filter * -Properties LastLogonDate |
    Where-Object {$_.LastLogonDate -lt $cutoffDate -or $null -eq $_.LastLogonDate} |
    Select-Object Name, SamAccountName, LastLogonDate, Enabled |
    Export-Csv "inactive_users.csv" -NoTypeInformation

Practical Pentesting Scenarios

Scenario 1: Enumerate Local Users

Write-Host "`n[*] Local Users:" -ForegroundColor Yellow
Get-LocalUser | ForEach-Object {
    $admin = (Get-LocalGroupMember -Group "Administrators" -Member $_.Name -ErrorAction SilentlyContinue) -ne $null
    
    [PSCustomObject]@{
        Username = $_.Name
        Enabled = $_.Enabled
        IsAdmin = $admin
        PasswordExpires = $_.PasswordExpires
        LastLogon = $_.LastLogon
    }
} | Format-Table

Scenario 2: Find Admin Users

Write-Host "[*] Administrator Group Members:" -ForegroundColor Yellow
Get-LocalGroupMember -Group "Administrators" | ForEach-Object {
    [PSCustomObject]@{
        Name = $_.Name
        Type = $_.ObjectClass
        SID = $_.SID
    }
} | Format-Table

Scenario 3: Check Password Policy

# Local policy
net accounts

# AD policy (requires AD module)
Get-ADDefaultDomainPasswordPolicy

Scenario 4: Enumerate AD Privileged Users

$privilegedGroups = @(
    "Domain Admins",
    "Enterprise Admins",
    "Schema Admins",
    "Administrators"
)

foreach ($group in $privilegedGroups) {
    Write-Host "`n[*] $group Members:" -ForegroundColor Yellow
    try {
        Get-ADGroupMember -Identity $group -Recursive |
            Select-Object Name, SamAccountName, objectClass |
            Format-Table
    } catch {
        Write-Host "  [!] Cannot access group" -ForegroundColor Red
    }
}

Scenario 5: Find Users with Never-Expiring Passwords

# Local users
Get-LocalUser | Where-Object {$_.PasswordExpires -eq $null} |
    Select-Object Name, Enabled, PasswordLastSet

# AD users
Get-ADUser -Filter {PasswordNeverExpires -eq $true} -Properties PasswordNeverExpires |
    Select-Object Name, SamAccountName, Enabled

Scenario 6: Create Backdoor User

# Create hidden user (pentesting/red team only - with authorization!)
$username = "svc_backup$"  # $ makes it hidden
$password = ConvertTo-SecureString "Backdoor123!" -AsPlainText -Force

# Create user
New-LocalUser -Name $username -Password $password -Description "System Service Account"

# Add to administrators
Add-LocalGroupMember -Group "Administrators" -Member $username

Write-Host "[+] Backdoor user created: $username" -ForegroundColor Green

Security Best Practices

1. Strong Passwords

# Enforce complexity
# Minimum 12 characters
# Mix of upper, lower, numbers, symbols

function Test-PasswordStrength {
    param([string]$Password)
    
    $score = 0
    if ($Password.Length -ge 12) { $score++ }
    if ($Password -match "[a-z]") { $score++ }
    if ($Password -match "[A-Z]") { $score++ }
    if ($Password -match "[0-9]") { $score++ }
    if ($Password -match "[^a-zA-Z0-9]") { $score++ }
    
    return $score
}

2. Least Privilege

# Only add users to admin groups when necessary
# Remove admin rights when no longer needed
Remove-LocalGroupMember -Group "Administrators" -Member "alice"

3. Regular Audits

# Monthly audit of privileged users
Get-LocalGroupMember -Group "Administrators" |
    Export-Csv "admin_audit_$(Get-Date -Format 'yyyyMMdd').csv"

Quick Reference

Local Users:
Get-LocalUser
New-LocalUser -Name "user" -Password $pass
Set-LocalUser -Name "user" -Description "desc"
Enable-LocalUser -Name "user"
Disable-LocalUser -Name "user"
Remove-LocalUser -Name "user"

Local Groups:
Get-LocalGroup
Get-LocalGroupMember -Group "Administrators"
Add-LocalGroupMember -Group "group" -Member "user"
Remove-LocalGroupMember -Group "group" -Member "user"

AD Users:
Import-Module ActiveDirectory
Get-ADUser -Filter *
New-ADUser -Name "user" -SamAccountName "user"
Set-ADUser -Identity "user" -Title "title"
Enable-ADAccount -Identity "user"
Disable-ADAccount -Identity "user"
Remove-ADUser -Identity "user"

AD Groups:
Get-ADGroup -Filter *
Get-ADGroupMember -Identity "group"
Add-ADGroupMember -Identity "group" -Members "user"
Remove-ADGroupMember -Identity "group" -Members "user"

Password:
$pass = ConvertTo-SecureString "P@ss" -AsPlainText -Force
Set-LocalUser -Name "user" -Password $pass
Set-ADAccountPassword -Identity "user" -NewPassword $pass -Reset

Resources

Help

Get-Help New-LocalUser -Examples
Get-Help New-ADUser -Full
Get-Help about_ActiveDirectory

Next Steps

Practice user management on test systems
Learn AD PowerShell module thoroughly
Automate user provisioning with scripts
Implement security audits regularly
Study privilege escalation techniques (for defense!)

User management is critical for both system administration and security testing. Master these skills to manage identities effectively!

"New-LocalUser: Because clicking through GUI is inefficient."