>

List members of a local group on Windows

Enumerate local Administrators, Remote Desktop Users or any local group membership with Get-LocalGroupMember, including domain-sourced accounts.

WindowsaccountspowershellauditLow risk
Run Get-LocalGroup -Name Administrators | Get-LocalGroupMember to list every member and where each account comes from.

01Command

Command
$ Get-LocalGroup -Name Administrators | Get-LocalGroupMember

02What it does

This is the audit command 'net user' can't do: net user only lists accounts, not group membership. Get-LocalGroupMember reveals PrincipalSource, which flags domain or Entra ID accounts nested into local groups — exactly what privileged-access reviews look for. Members that resolve to 'Unresolved' SIDs are orphaned deleted accounts worth cleaning up.

03Risk

RiskLow risk
RequirementsRun PowerShell as Administrator for privileged groups

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • Get-LocalGroupMember | Microsoft Learn
    Microsoft · vendor-doc · 2026-09-17
    Evidence: Microsoft documents Get-LocalGroupMember as getting the members of a local group, showing PrincipalSource (Local, Domain, Azure AD) for each.
  • Get-LocalGroup | Microsoft Learn
    Microsoft · vendor-doc · 2026-09-17
    Evidence: Microsoft documents Get-LocalGroup as retrieving local security groups, which can be piped to member-related cmdlets.

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Grep on Windows: Select-String
Windowssearchtextpowershell

Search inside text files and logs with regex, returning file, line number and match.

Low risk ✓ 2026-09-17
Zip Files with Compress-Archive
WindowsZip & Archivesarchivepowershell

Create or update a .zip from any files or folder contents straight from PowerShell.

Low risk ✓ 2026-09-17
Test a TCP port connection on Windows with Test-NetConnection
Windowsnetworktroubleshootingpowershell

A built-in PowerShell one-liner that answers 'is port 5432/3389/443 actually open through this network?' — no telnet client needed.

Low risk ✓ 2026-09-17