57

I need to create a new local user account, and then add them to the local Administrators group. Can this be done in PowerShell?

EDIT:

# Create new local Admin user for script purposes
$Computer = [ADSI]"WinNT://$Env:COMPUTERNAME,Computer"

$LocalAdmin = $Computer.Create("User", "LocalAdmin")
$LocalAdmin.SetPassword("Password01")
$LocalAdmin.SetInfo()
$LocalAdmin.FullName = "Local Admin by Powershell"
$LocalAdmin.SetInfo()
$LocalAdmin.UserFlags = 64 + 65536 # ADS_UF_PASSWD_CANT_CHANGE + ADS_UF_DONT_EXPIRE_PASSWD
$LocalAdmin.SetInfo()

I have this, but was wondering if there is anything more PowerShell-esque.

4
  • 8
    What isn't Powershell-esque about that? Not everything is a cmdlet - but that doesn't mean you can't wrap the code above in a function of your own to make it feel like one.
    – alroc
    Mar 2, 2013 at 19:58
  • 2
    Powershell-esque is cmdlets & pipelines; this is C++
    – bwerks
    Jan 25, 2017 at 16:51
  • 3
    @bwerks - if cmdlets and pipelines are what PowerShell means to you then you're entirely missing out on the "power" part of PowerShell -- .NET, COM Interfaces, Reflection, Platform Invocation, etc. etc. etc.
    – thepip3r
    Jul 20, 2017 at 22:13
  • I had to use your ADSI method as New-LocalUser was throwing errors about not meeting password complexity requirements.
    – woter324
    Nov 9, 2021 at 12:37

6 Answers 6

75

Another alternative is the old school NET USER commands:

NET USER username "password" /ADD

OK - you can't set all the options but it's a lot less convoluted for simple user creation & easy to script up in Powershell.

NET LOCALGROUP "group" "user" /add to set group membership.

3
  • 3
    Calling out to net.exe strikes me as being less "PowerShell-esque" than the original ADSI code; there is nothing indicative of PowerShell in those commands, and you could drop them in, say, a batch file and they'd work just the same. To me, this eschews the Power of an object-oriented Shell and reverts back to having to deal with application-specific command syntaxes, exit codes, and error messages. To be fair, though, there's really two different questions that have been asked here: "How can I do this in PowerShell?" and "I can do this in PowerShell. How can I do it better?" Sep 12, 2016 at 16:54
  • 2
    FWIW I ran into an issue with a PowerShell function I wrote to wrap "NET USER /ADD" call. Specifically, if the password was longer than 14 characters, the NET USER commandline would prompt for input from the user to confirm Y/N. There is no commandline option in NET USER to provide that confirmation so that will "freeze" PS scripts that are run non-interactively.
    – Jaans
    Sep 15, 2016 at 4:05
  • 1
    @Jaans, you can override that prompt by issuing /Y at the end: net user $name $password /add /fullname:$full /passwordchg:no /Y
    – Desktop
    Dec 27, 2018 at 8:56
45

As of PowerShell 5.1 there cmdlet New-LocalUser which could create local user account.

Example of usage:

Create a user account

New-LocalUser -Name "User02" -Description "Description of this account." -NoPassword

or Create a user account that has a password

$Password = Read-Host -AsSecureString
New-LocalUser "User03" -Password $Password -FullName "Third User" -Description "Description of this account."

or Create a user account that is connected to a Microsoft account

New-LocalUser -Name "MicrosoftAccount\usr [email protected]" -Description "Description of this account." 
4
  • It should be mentioned that there is still only a preview release of PowerShell 5.1.
    – kls
    Sep 16, 2016 at 14:14
  • 1
    PowerShell 5.1 is included in Windows Server 2016. :-) Oct 31, 2016 at 11:38
  • 1
    Verified that this worked on Windows 10 Enterprise, Powershell Version 5.1 Build 14393 Jan 8, 2017 at 2:50
  • Works on Windows 7 after nstalling WMF5.1 as well
    – stijn
    Jun 29, 2017 at 7:43
12

Try using Carbon's Install-User and Add-GroupMember functions:

Install-User -Username "User" -Description "LocalAdmin" -FullName "Local Admin by Powershell" -Password "Password01"
Add-GroupMember -Name 'Administrators' -Member 'User'

Disclaimer: I am the creator/maintainer of the Carbon project.

3
  • Hi, your get carbon was exactly what I was looking for, does it script out the mod-security for asp web sites too on 2k12r2. It would nice tosee some recommendations on security modules etc for IIS and defending the Server.
    – aggie
    Dec 8, 2015 at 15:33
  • @aggie See the Carbon docs for the full list of its capabilities. Dec 8, 2015 at 15:44
  • me likey, looks well maintained. won't be long before i carbonize our base module for deployment scripts. i might have some contribs down the line. thanks @aaronjensen et al!
    – sonjz
    May 20, 2016 at 16:23
8

As of 2014, here is a statement from a Microsoft representative (the Scripting Guy):

As much as we might hate to admit it, there are still no Windows PowerShell cmdlets from Microsoft that permit creating local user accounts or local user groups. We finally have a Desired State Configuration (DSC ) provider that can do this—but to date, no cmdlets.

1
Import-Csv C:\test.csv |
Foreach-Object {
  NET USER    $ _.username   $ _.password /ADD
  NET LOCALGROUP "group" $_.username  /ADD
}

edit csv as username,password and change "group" for your groupname

:) worked on 2012 R2

0
$sec_pass = ConvertTo-SecureString -String "SomePasword" -AsPlainText -Force
New-LocalUser -Name username -FullName username -PasswordNeverExpires -Password $sec_pass
Add-LocalGroupMember -Group Administrators -Member username

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.