>

List and audit local users with Get-LocalUser

The PowerShell way to enumerate local accounts and their state — objects you can filter, sort, and export for a security review.

WindowsaccountssecuritypowershellLow risk
Run `Get-LocalUser | Select-Object Name, Enabled, PasswordLastSet` to see account status, or `Get-LocalUser | ? Enabled` for active accounts only.

01Command

Command
$ Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordLastSet

02What it does

Get-LocalUser returns rich objects: Enabled, PasswordExpires, PasswordLastSet, LastLogon, and Description. That makes audit one-liners trivial — list enabled accounts, find accounts whose password hasn't changed in a year, or count dormant logins. Companions Set-LocalUser, Disable-LocalUser, and New-LocalUser handle changes without the legacy net user syntax, and results pipe straight into Export-Csv for reports.

03Risk

RiskLow risk

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • Get-LocalUser | Microsoft Learn
    Microsoft · vendor-doc · 2026-09-17
    Evidence: Microsoft documents Get-LocalUser returning LocalUser objects with Enabled, LastLogon, and PasswordLastSet properties.
  • Get-LocalUser - PowerShell
    SS64 · technical · 2026-09-17
    Evidence: SS64 shows Get-LocalUser usage and filtering, e.g. listing only enabled accounts with Where-Object.

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Verify Code Signatures with Get-AuthenticodeSignature
Windowssignaturesecuritypowershell

Read the Authenticode signature status and signer of any executable or script in PowerShell.

Low risk ✓ 2026-09-17
Fix 'scripts is disabled on this system' with Set-ExecutionPolicy
WindowsTerminaldevelopersecurity

Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.

Medium risk ✓ 2026-09-17
Grep on Windows: Select-String
Windowssearchtextpowershell

Search inside text files and logs with regex, returning file, line number and match.

Low risk ✓ 2026-09-17