Overview
The LocalUsers command enumerates all local user accounts on the system, including their enabled/disabled status, password age, and last logon information. This provides insight into account management, potential stale accounts, and password policies.Syntax
Remote Execution
Output
Returns local user account information:- Username
- Enabled/Disabled status
- Password last set date
- Last logon
- Account description
- User comment
- Password expiration settings
Use Cases
- Red Team
- Blue Team
- Identify enabled accounts for credential access
- Find accounts with old passwords
- Discover service accounts
- Identify potential password spray targets
- Locate disabled admin accounts that might be re-enabled
Example Output
Remote Execution
This command supports remote execution using the
-computername parameter.Detection Considerations
- API Calls: Uses NetUserEnum and related APIs
- WMI Queries: Remote execution via WMI
- Event ID 4798: User account enumeration
- Network Traffic: SMB/RPC connections for remote queries
Related Commands
- LocalGroups - Local group membership
- LogonSessions - Active logon sessions
- LAPS - LAPS configuration
- TokenPrivileges - Current token privileges