Adding users from command line is much easier rather than going through UI. It saves lot of time for Windows admins to add users in bulk using CLI commands/script. Net user command is the one that Windows users can use to manage user accounts, read on to know how to add users from CMD.
To add a new user account on local computer:
net user username password /ADD
Example: To add a new user account with the loginid John and with password fadf24as
net user John fadf24as /ADD
Hide password
If you do not want the password to be visible while adding new user account, you can use ‘*’ as shown below.
C:\>net user /add John * Type a password for the user: Retype the password to confirm: The command completed successfully. C:\>
To add a new user account to the domain:
net user username password /ADD /DOMAIN
Note that the command does not include the name of the domain, it automatically adds to the domain the computer belongs to.
Example:
net user John fadf24as /ADD /DOMAIN
Rename a user account
Net use command does not have any switches to rename a user account. But we can do that using wmic commands. Please check this – Rename user accounts on Windows
Few more advanced uses of net user command.
To set user full name while creating the user account
net user username password /ADD /FULLNAME:"User_Fullname"
To allow user to change password:
net user username password /ADD /PASSWORDCHG:Yes
To restrict user not to change the password:
net user username userpasswd /ADD /PASSWORDCHG:NO
To set account expiry time we can use /EXPIRES switch. This can also be used to set that the account never expires.
To specify if the user must have a password set we can use /PASSWORDREQ switch. For more information on all net user options, read this – Net user command: syntax and examples
How to create a new administrator account?
An administrator account can’t be created directly. We first need to create a user account and then add the user to the administrators group.
Errors:
- If you don’t have privileges to add new user account to the system, you would get an error like below.
C:\>net user John /add System error 5 has occurred. Access is denied. C:\>
- While adding user to domain, make sure that your computer is connected to the domain. Otherwise it throws up below error.
C:\>net user testuser testpassword /ADD /DOMAIN The request will be processed at a domain controller for domain mydomain.com. System error 1355 has occurred. The specified domain either does not exist or could not be contacted.
Related Posts:
Remove user from group
In this tutorial, you will learn how to use the net user command to create, delete and change user accounts in the Windows command prompt (CDM).
We can perform the following tasks using the net user command:
- View user accounts.
- Add and Remove user accounts.
- Activate and Deactivate user accounts.
- Change the user password.
If you are operating in an Active Directory domain environment, always use the /domain command switch to execute the net user command on the domain controller rather than on the local computer.
Examples
List users on the local computer:
net userList users on the domain controller:
net user /domainThis command displays detailed information about the Administrator account:
net user AdministratorCreate a user named user1 with a password of strongPassword:
net user /add user1 "strongPassword"Delete the user user1 from the computer:
net user /delete user2This command enables the built-in Administrator account on Windows 10/11:
net user Administrator /active:yesThis command sets (changes) the Administrator account password:
net user Administrator "adminPassWord"Execute the following command to disable the Administrator account on Windows 10/11:
net user Administrator /active:noThis command forces the user user1 to change the password at the next logon:
net user user1 /logonpasswordchg:yesCreate a user; the user must change the password at the next logon:
net user /add user1 "strongPassword" /logonpasswordchg:yesCreate a new user; the account expires on January 31st:
net user /add user1 "strongPassword" /expires:01/31/2023Command Options
| username | The name of the user to create, delete, view, or modify. |
| password | Password for the user. |
| * | Use this option to produce a prompt for the password. |
| /add | Use this option when you want to create a new user. |
| /delete | Use this option to remove a user from the Windows system. |
| /active:{yes | no} | Activates or Deactivates a user. The default is yes when creating a new user. |
| /expires:{date | never} | Use this option to set the expiration date (mm/dd/yy) for an account. The default is never. |
| /fullname:»name» | Full name of the user. |
| /passwordchg:{yes | no} | Specifies whether users can change their own password. The default is yes. |
| /passwordreq:{yes | no} | No means the user can log in without a password. The default is YES. |
| /logonpasswordchg:{yes|no} | Specifies whether the user should change the password at the next logon. The default is NO. |
| /homedir:path | The home directory location. |
| /comment:»text» | Use this option to add a description to the user’s account. |
You can view the manual page by typing net help user at the command prompt.
View a User
When you execute the net user command without any options, it displays a list of user accounts on the computer.
net userYou will see an output similar to the following:
Add the /domain command switch if you want to list users on the Active Directory Domain controller.
net user /domainTo see detailed information about a particular user, execute the command net user Username, where the Username is the name of the user you want to view. For example, you can view the Administrator account by running the following command:
net user AdministratorCreate and Delete User Accounts
To create a user account, use the following syntax:
net user /add UserName PasswordFor example, the following command creates a user named user1 with a password of strongPassword:
net user /add user1 "strongPassword"Use an asterisk (*) in place of the password to produce a prompt, as shown in the following example:
net user /add user1 *
Alternatively, you can also use the /random option to generate a strong random password, as shown in the following example:
net user /add user1 /randomThe randomly generated password will be displayed on the command prompt after you execute the command.
To delete a user, use the following syntax:
net user /delete UserNameThe following command deletes the user user1 from the computer:
net user /delete user2Change Passwords
To change passwords, use the following syntax:
net user UserName New-PasswordUse an asterisk (*) or /random in place of the password to produce a prompt or generate a random password:
net user UserName *
net user user1 /randomNotes
The net user command is most of the time used in Windows Server to manage Active Directory users.
Windows 10/11 uses a new Settings pane to manage users, but the net user command is still useful for some tasks. For example, if you want to activate the built-in Administrator account, it is easy to do that using this command.
While working at the command prompt, run the net help user command to see all available command options.
In the next tutorial, we are going to learn how to manage Windows groups using the net localgroup CMD command.
theDXT
The net user and group commands are very powerful tools for managing local and domain users and groups.
In this post, I will show you how to use the net user command locally and on a domain to create a user account, reset a user account password, and view general info about a user account. I will also show you how to use the net group and net localgroup commands to manage local groups and domain groups, and how to view group members.
Net User
Create User Account
- Open CMD as admin or as an account that can create a domain user account.
New Local User
- Enter the following command to create a new local user account and replace USERNAME_HERE and PASSWORD_HERE with the username and password you would like to use
net user USERNAME_HERE PASSWORD_HERE /add
For example, if I want to make a new local account named NewUser with a password of NewP@ssword1, the command will be net user NewUser NewP@ssword1 /add
New Domain User
- Enter the following command to create a new domain user account and replace USERNAME_HERE and PASSWORD_HERE with the username and password you would like to use
net user USERNAME_HERE PASSWORD_HERE /add /domain
For example, if I want to make a new domain user account named NewUser1 with a password of NewP@ssword1, the command will be net user NewUser1 NewP@ssword1 /add /domain
Change User Password
- Open CMD as admin or as an account that can change a domain user password.
Change Local User Password
- Enter the following command to change a local user account’s password and replace USERNAME_HERE and PASSWORD_HERE with the username and password you would like to use
net user USERNAME_HERE PASSWORD_HERE
For example, if I want to change the password of the local account named NewUser to the password of NewP@ssword2, the command will be net user NewUser NewP@ssword2
Change Domain User Password
- Enter the following command to change a domain user account’s password and replace USERNAME_HERE and PASSWORD_HERE with the username and password you would like to use
net user USERNAME_HERE PASSWORD_HERE /domain
For example, if I want to change the password of a domain account named NewUser1 to the password of NewP@ssword2, the command will be net user NewUser1 NewP@ssword2 /domain
View User Details
- Open CMD as admin or as an account that can view domain user info.
View Local User Details
- Enter the following command to view information about a local user account and replace USERNAME_HERE with the local user account you want to view the info of
net user USERNAME_HERE
For example, if I want to view info about the local user account named NewUser, the command will be net user NewUser
View Domain User Details
- Enter the following command to view information about a domain user and replace USERNAME_HERE with the domain user account you want to view the info of
net user USERNAME_HERE /domain
For example, if I want to view info about the domain user account named test, the command will be net user test /domain
Net Group
Add User to a Group
- Open CMD as admin or as an account that can modify domain groups.
Add User to Local Group
- Enter the following command to add a user to a local group and replace LOCAL_GROUP_HERE and USERNAME_HERE with the username and local group name
net localgroup LOCAL_GROUP_HERE USERNAME_HERE /add
For example, if I want to add the account named NewUser to the local Administrators group, the command will be net localgroup Administrators NewUser /add
Another example is if I want to add the account named NewUser to the local Remote Desktop Users group, the command will be net localgroup "Remote Desktop Users" NewUser /add
Remove User from Local Group
- Enter the following command to remove a user from a local group and replace LOCAL_GROUP_HERE and USERNAME_HERE with the username and local group name
net localgroup LOCAL_GROUP_HERE USERNAME_HERE /delete
For example, if I want to remove the account named NewUser from the local Administrators group, the command will be net localgroup Administrators NewUser /delete
Another example is if I want to remove the account named NewUser from the local Remote Desktop Users group, the command will be net localgroup "Remote Desktop Users" NewUser /delete
Add User to Domain Group
- Enter the following command to add a user to a domain group and replace DOMAIN_GROUP_HERE and USERNAME_HERE with the username and domain group name
net group DOMAIN_GROUP_HERE USERNAME_HERE /add /domain
For example, if I want to add the domain user account named NewUser1 to the domain group named Domain Admins, I will run the following command net group "Domain Admins" NewUser1 /add /domain
Remove User from Domain Group
- Enter the following command to remove a user from a domain group and replace DOMAIN_GROUP_HERE and USERNAME_HERE with the username and domain group name
net group DOMAIN_GROUP_HERE USERNAME_HERE /delete /domain
For example, if I want to remove the domain user account named NewUser1 from the domain group named Domain Admins, I will run the following command net group "Domain Admins" NewUser1 /delete /domain
View Group Details
- Open CMD as admin or as an account that can view domain group info.
View Local Group Members
- Enter the following command to view the members of a local group and replace LOCAL_GROUP_HERE with the local group name
net localgroup LOCAL_GROUP_HERE USERNAME_HERE
For example, if I want to view the members of the local Administrators group, the command will be net localgroup Administrators
Another example is if I want to view the members of the local Remote Desktop Users group, the command will be net localgroup "Remote Desktop Users"
View Domain Group Members
- Enter the following command to view the members of a domain group and replace DOMAIN_GROUP_HERE with the domain group name
net group DOMAIN_GROUP_HERE /domain
For example, if I want to view the members of the domain group named Domain Admins, I will run the following command net group "Domain Admins" /domain
Another example is if I want to view the members of the domain group named Domain Controllers, I will run the following command net group "Domain Controllers" /domain
Summary
That covers how to manage users and groups using the net command. I find myself using the commands pretty often when troubleshooting or completing setups.
If you want to read more about the Net command, here is the Microsoft documentation.
The command Net User allows you to manage your local and even your domain users from the command line. It’s mainly used to quickly add, delete or disable user accounts from the command line. But it can do more than just that. The tool can be used in both command prompt and PowerShell.
For managing domain users, I recommend using the PowerShell ActiveDirectory module. It comes with more options and allows you to filter, copy and search users and set or change all properties. But as mentioned, you can also perform basic tasks with the Net User command for domain users.
In this article
In this article, we are going to take a closer look at the Net User command. I will explain how you can add, and remove accounts, change passwords, and more.
The Net User command is a command-line utility that you can run in any terminal on Windows. But to use it you will need to have Administrator permissions on the computer. Without it, you won’t be able to create new user accounts for example. Also, make sure that you open Windows PowerShell or Windows Terminal in Admin mode.
Note
If you get the error “System error 5 has occurred. Access is denied” Then you haven’t start the command prompt or PowerShell with administrator privileges.
The most important parameters of the Net User command are:
| Parameter | Description |
|---|---|
| <username> | Specify the username to the account you want to perform the action on |
| <password> | Set or change the password for the specified user account. Use * to get a prompt for the password. |
| /domain | Used for managing domain accounts |
| /add | Create a new user account |
| /delete | Delete a user account |
| /active | Enable or disable the user account. Options are yes or no. |
| /expire | Set the date when the account expires |
| /time | Specifies the times that a user is allowed to log in |
| /homedir | Set the home directory path of the user account. |
List all users
When you enter the command Net User without any parameters, then it will list all user accounts on the computer. If you run the command on the Domain Controller, then it will list all domain accounts.
Net User # Or you can also type Net Users
In the first screenshot above you will see the results on a local computer, the second one are all the users from the local domain.
When you specify the username you will see all the details from the user account
# Get the user details for Zoe Tucker net user ztucker
Net User Add Account
The Net User command can be used to create new user accounts on your computer and in your domain. To create a user account you will need to add the /add parameter and specify the username. A password is by default not required on a local computer. For domain accounts, however, you will need to specify the password as well.
# Create a new local user account with the login name lazyadmin Net User /Add lazyadmin
For entering the password you have two options, you can type it in plain text in the command line or use the * which will show you a prompt to enter the password.
# Create a new domain user with username testusr and passswd123 Net User /add /domain testusr passwd123 # Prompt for the password Net User /add /domain testusr *
The new domain user is placed in the built-in OU “Users”.
When creating a user we can also specify login details, home directory path, etc of the user. I will explain each command later in the article. But to give you an idea of the possible options, we are going to create a user with the following details:
- Username: testusr
- Password: prompt
- Full name: Test User
- Password required: yes
- Allowed to login between: Monday to Friday between 08:00 and 17:00
- Home folder directory: \\lazyadmin.local\home\testusr
- Script path: \\lazyadmin.local\netlogon\welcome.bat
Net User /add /domain testusr * /fullname:"Test User" /passwordreq:yes /time:M-F,08:00-17:00 /homedir:"\\lazyadmin.local\home\testusr" /scriptpath:"\\lazyadmin.local\netlogon\welcome.bat"
Net User Delete User Account
We can also use the command line tool to delete user accounts, both local and from the domain. For this, you will need to use the parameter /delete and enter the username. Important to note is that the command tool won’t ask for confirmation. So be careful when using the delete option.
# Delete the local user Lazyadmin Net User /delete lazyadmin # Delete a domain user Net User /delete /domain testusr
Net User Change or Set Password
One of the common tasks for an IT Helpdesk is to reset a user’s password. Of course, you can reset the password in the Active Directory. But it’s also possible with the command Net User. Resetting passwords is not limited to domain accounts, you can also use this method for local computer accounts.
To reset a password you will need to specify the username and then either type in the password or type * after which you can securely type the password:
# Set the password for LazyAdmin to passwd123 Net User LazyAdmin passwd123 # Pormpt for the new password Net User LazyAdmin *
When it’s a domain user, then just add the /domain parameter. Make sure that the password meets the complexity requirements of the domain
# Reset the password for the domain user tesusr Net User /domain testusr *
Enable or Disable User accounts
We can also use the command-line tool to enable and disable accounts. This is particularly useful when a user is locked out or when you quickly need to disable an account. To do this we are going to use the parameter /Active:yes|no
The command can be used for local computer accounts as for domain accounts:
# Disable local account Net User lazyadmin /active:no # Disable domain user account Net User tesusr /Domain /Active:no
To enable an account, simply replace /Active:no with /Active:yes
Set Expire date for User Account
If you know the data that an employee leaves the organization then it’s a good idea to set the expired date for the account. This way the account is automatically locked after the specified data. The date format depends on your region settings, but the options are:
- MM/DD/YYYY
- DD/MM/YYYY
- mmm,dd,YYYY
Account expiration settings are not limited to a domain account, you can also set the expired date on a local Windows 10 or 11 user account.
# Set expire date for local user Net User lazyadmin /expires:21/09/2022 # Set expire data for domain user Net User testusr /domain /expires:09/20/2022
Set login times for User Account
Some accounts are only allowed to be used between specific hours, office hours for example. We can specify these hours with the /time parameter. To specify the time we will need to enter the days and hours between the account is allowed to log in.
You can use different notions for the days and hours (12-hour or 24-hour notation), and we can specify multiple time blocks by separating them with the semi-column ;.
# Allow login during office hours only Net User lazyadmin /time:M-F,08:00-17:00 # Or in 12-hour notation Net User lazyadmin /time:M-F,8am-5pm # Specify multiple blocks Net User lazyadmin /time:M,08:00-17:00;W,08:00-13:00;F,08:00-17:00
Net User Password settings
When you create a new account you can set a password for the account as well. But when it comes to passwords we have two other interesting parameters, passwordchg and passwordreg. The first determines if the user can change the password. This setting is really useful for kiosk accounts. The user can’t change the password when this is set to no.
# User lazyadmin can't change it's password net user lazyadmin /passwordchg:no
The parameter passwordreg is used to specify it a user account must have a password. If this is set to no, then the user can remove their password, making the device vulnerable.
net user lazyadmin /passwordreg:yes
Home Directory Path
The last parameter that I want to mention is the home directory path. If you want to store the home directory of the user on a network share then you can set the path to the folder with the parameter /homedir. But make sure that the full path, including the user’s folder, exists.
# Set the home directory for testusr net user testusr homedir:"\\lazyadmin.local\home\testusr"
Wrapping Up
The Net User command is great when wanting to quickly enable or disable a user account or reset a password. Also, it’s great to manage local computer accounts on small networks. When working with domain accounts I prefer to use the Active Directory module in PowerShell.
I hope you found this article useful, if you have any questions, just drop a comment below.
NET USER creates and modifies user accounts on computers. When used without switches, it lists the user accounts for the computer. The user account information is stored in the user accounts database.
Syntax
[username [password | *] [options]] [/DOMAIN]
username {password | *} /ADD [options] [/DOMAIN]
username [/DELETE] [/DOMAIN]
username [/TIMES:{times | ALL}]
Parameter Description
| Item | Description |
|---|---|
| username | Is the name of the user account to add / delete / modify or view. The name of the user account can have as many as 20 characters. |
| password | Assigns or changes a password for the user’s account. A password must satisfy the minimum length set with the /MINPWLEN option of the NET ACCOUNTS command. It can have as many as 14 characters. |
| * | Produces a prompt for the password. The password is not displayed when you type it at a password prompt. |
| /DOMAIN | Performs the operation on a domain controller of the current domain. |
| /ADD | Adds a user account to the user accounts database. |
| /DELETE | Removes a user account from the user accounts database. |
Command Line Option Syntax
| Options | Description |
|---|---|
| /ACTIVE:{YES | NO} | Activates or deactivates the account. If the account is not active – the user cannot access the server. The default is YES. |
| /COMMENT:»text» | Provides a descriptive comment about the user’s account. Enclose the text in quotation marks. |
| /COUNTRYCODE:nnn | Uses the operating system country code to implement the specified language files for a user’s help and error messages. A value of 0 signifies the default country code. |
| /EXPIRES:{date | NEVER} | Causes the account to expire if date is set. NEVER sets no time limit on the account. An expiration date is in the form mm/dd/yy(yy). Months can be a number / spelled out or abbreviated with three letters. Year can be two or four numbers. Use slashes(/) (no spaces) to separate parts of the date. |
| /FULLNAME:»name» | Is a user’s full name (rather than a username). Enclose the name in quotation marks. |
| /HOMEDIR:pathname | Sets the path for the user’s home directory. The path must exist. |
| /PASSWORDCHG:{YES | NO} | Specifies whether users can change their own password. The default is YES. |
| /PASSWORDREQ:{YES | NO} | Specifies whether a user account must have a password. The default is YES. |
| /LOGONPASSWORDCHG:{YES|NO} | Specifies whether user should change their own password at the next logon.The default is NO. |
| /PROFILEPATH[:path] | Sets a path for the user’s logon profile. |
| /SCRIPTPATH:pathname | Is the location of the user’s logon script. |
| /TIMES:{times | ALL} | Is the logon hours. TIMES is expressed as day[-day][day[-day]] time[-time][time[-time]] limited to 1-hour increments. Days can be spelled out or abbreviated. Hours can be 12- or 24-hour notation. For 12-hour notation use am / pm / a.m. or p.m. ALL means a user can always log on and a blank value means a user can never log on. Separate day and time entries with a comma and separate multiple day and time entries with a semicolon. |
| /USERCOMMENT:»text» | Lets an administrator add or change the User Comment for the account. |
| /WORKSTATIONS:{computername[…] | *} | Lists as many as eight computers from which a user can log on to the network. If /WORKSTATIONS has no list or if the list is * – the user can log on from any computer. |
net user