> For the complete documentation index, see [llms.txt](https://www.shellspells.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.shellspells.net/windows/system-ops/users-and-groups/modify.md). # Modify ## User Accounts

Command	Description
`net user [UserName] [password] /add`	Add new user (use * for password for secure prompt)
`New-LocalUser "UserName"`	Add new user
`net user [UserName] /delete`	Delete user
`Remove-LocalUser "UserName"`	Delete user
`net user [UserName] [Password]`	Change password
`Set-LocalUser "User" -Password "Password"`	Change password
`net user UserName /active:yes`	Activate user account
`Enable-LocalUser "UserName"`	Activate user account
`net user [UserName[ /active:no`	Disable user account
`Disable-LocalUser "UserName"`	Disable user account
`net user user /comment:"comment" moe`	Add comment
`net user [UserName] /times:[Day],[TIME]`	Set logon time for Users. Day=M,T,W,Th,F,Sa,Su Time=3PM-11PM or 15-23
`net user UserName /expires:never`	Set account to never expire.
`net user UserName /expires:date`	Set account expiration date.
`net accounts /maxpwage:days`	Set max password age.
`net accounts /minpwage:days`	Set min password age.
`net accounts /minpwlen:length`	Set min password length.
`net accounts /uniquepw:number`	Set password history length.
`dsadd user "UserDN"`	Add new AD user
`New-ADUser -Name "UserName"`	Add new AD user
`dsrm "UserDN"`	Delete AD user
`Remove-ADUser -Identity "UserName"`	Delete AD user
`dsmod user "UserDN" -mustchpwd yes`	Force password change at next logon.
`dsmod user "UserDN" -pwd NewPassword`	Change AD user password.
`dsmod user "UserDN" -disabled no`	Enable AD user account.
`Enable-ADAccount -Identity "UserName"`	Enable AD user account.
`dsmod user "UserDN" -disabled yes`	Disable AD user account.
`Disable-ADAccount -Identity "UserName"`	Disable AD user account.

Set AD user password: ```powershell Set-ADUser "UserName" -AccountPassword (ConvertTo-SecureString "NewPassword" -AsPlainText -Force) ``` ## Groups

Command	Description
`net localgroup GroupName /add`	Create local group.
`New-LocalGroup -Name "GroupName"`	Create local group.
`net localgroup GroupName /delete`	Delete local group.
`Remove-LocalGroup -Name "GroupName"`	Delete local group.
`net localgroup "Power Users" /add moe`	Add user to local group.
`Add-LocalGroupMember -Group "GroupName" -Member "UserName"`	Add user to local group.
`net localgroup "Users" /delete larry`	Remove user from local group.
`Remove-LocalGroupMember -Group "GroupName" -Member "UserName"`	Remove user from local group.
`net group GroupName /add`	Create AD group (on domain controllers).
`New-ADGroup -Name "GroupName"`	Create AD group (requires Active Directory module).
`dsadd group "GroupDN"`	Create AD group.
`net group GroupName /delete`	Delete AD group (on domain controllers).
`Remove-ADGroup -Identity "GroupName"`	Delete AD group.
`dsrm "GroupDN"`	Delete AD group.
`net group GroupName UserName /add`	Add user to AD group (on domain controllers).
`Add-ADGroupMember -Identity "GroupName" -Members "UserName"`	Add user to AD group.
`dsmod group "GroupDN" -addmbr "UserDN"`	Add user to AD group.
`Set-ADGroup -Identity "GroupName" -Add @{member="CN=UserName"}`	Add user to AD group.
`net group GroupName UserName /delete`	Remove user from AD group (on domain controllers).
`Remove-ADGroupMember -Identity "GroupName" -Members "UserName"`	Remove user from AD group.
`dsmod group "GroupDN" -rmmbr "UserDN"`	Remove user from AD group.
`Set-ADGroup -Identity "GroupName" -Remove @{member="CN=UserName"}`	Remove user from AD group.

## Default Groups

Group Name	Description
Administrators	Full system access and administrative privileges.
Users	Standard user access with limited privileges.
Guests	Limited access for guest users.
Power Users	Legacy group with limited administrative privileges.
Backup Operators	Rights to backup and restore files, regardless of permissions.
Replicator	Supports file replication in a domain environment.
Remote Desktop Users	Permission to access the system via Remote Desktop.
Network Configuration Operators	Authority to configure network settings.
Performance Monitor Users	Can monitor system performance.
Performance Log Users	Can manage performance logs and counters.
IIS_IUSRS	Permissions for IIS web server processes.
Cryptographic Operators	Can perform cryptographic operations.
Event Log Readers	Can read event logs.
Certificate Service DCOM Access	Provides DCOM access for Certificate Services.
Distributed COM Users	Members can launch and configure DCOM applications.
Enterprise Read-only Domain Controllers	Contains RODCs from the entire forest.
Domain Admins	Administrators for the domain.
Domain Users	Regular user accounts in the domain.
Domain Guests	Guests in the domain.
Domain Computers	Contains all computer accounts in the domain.
Domain Controllers	All domain controller accounts in the domain.
Read-only Domain Controllers	Contains RODCs for the domain.
Enterprise Admins	Highest level of administrative privileges across all domains in the forest.
Schema Admins	Can modify the schema within the Active Directory forest.
Group Policy Creator Owners	Can create and modify group policy objects.
RAS and IAS Servers	Servers running RAS and IAS services.
Server Operators	Limited administrative privileges on servers.
Account Operators	Can manage user and group accounts, but not administrative accounts.
Print Operators	Can manage printers and print queues.
Incoming Forest Trust Builders	Can create incoming, one-way trusts to this forest.