Add a Local User Account on Windows Server 2025 / 2022

You have a standalone Windows Server with no Active Directory, and someone needs a login. It might be a colleague who manages the box over RDP, a backup job, or an FTP site. The fastest way to add a local user on Windows Server is one New-LocalUser command in an elevated PowerShell window, followed by Add-LocalGroupMember if the account needs admin rights. The old net user command and the Computer Management console still do the same job, and each one leaves the account in a slightly different state.

Original content from computingforgeeks.com - post 36266

Below, we add a local user account on Windows Server 2025 and 2022 all three ways and put it in the Administrators or Remote Desktop Users group. Then we prove the password works. We also cover the errors you hit with weak passwords, long names and duplicate accounts, with the exact text Windows prints. I ran through all of it on Server 2025 Datacenter and Server 2022 Standard VMs in my homelab in October 2026, and it works the same on both apart from the lockout defaults and one error message.

PowerShell, net user or Computer Management?

Use PowerShell when you script servers or add more than one account, and net user when you are already in a Command Prompt. Computer Management suits the times you want to see every checkbox before you commit. All three write to the same local account database (SAM), so an account made one way can be edited the other two ways. They do not set the same flags, though, and the table shows the one that caught us out:

Method	Create the user	Add to a group	“Password required” flag after create
PowerShell	New-LocalUser	Add-LocalGroupMember	False
Command Prompt	net user ... /add	net localgroup ... /add	True
GUI	Computer Management, Local Users and Groups	Member Of tab	True

We read the PowerShell and net user rows off both lab servers and the GUI row off Server 2025, and Step 2 shows how to fix it. Creating accounts, changing them and editing groups all need an elevated session, so open PowerShell or Command Prompt with Run as administrator.

Step 1: Check the existing accounts and the password policy

Before adding anything, list the accounts that already exist so you do not pick a name that is taken. A fresh server has only the built-in ones:

Get-LocalUser

Our Server 2025 VM came from a cloud-init template, which is why cloudbase-init shows up next to the usual Administrator, Guest and system accounts. The ftpuser account is the one we created in the GUI in Step 5:

Name               Enabled Description
----               ------- -----------
Administrator      True    Built-in account for administering the computer/domain
cloudbase-init     True
DefaultAccount     False   A user account managed by the system.
ftpuser            True    Uploads files to the FTP site
Guest              False   Built-in account for guest access to the computer/domain
WDAGUtilityAccount False   A user account managed and used by the system for Windows Defender Application Guard scenarios.

Next, read the local password and lockout policy. It decides whether the password you choose will be accepted and when the new account will start nagging for a change:

net accounts

This output is from the Server 2025 VM. The line to notice is the maximum password age of 42 days, because every account you create without “password never expires” will be forced to change its password six weeks from now.

Force user logoff how long after time expires?:       Never
Minimum password age (days):                          0
Maximum password age (days):                          42
Minimum password length:                              0
Length of password history maintained:                None
Lockout threshold:                                    10
Lockout duration (minutes):                           10
Lockout observation window (minutes):                 10
Computer role:                                        SERVER
The command completed successfully.

Our two servers did not agree on lockout. Our Server 2025 VM locks an account for 10 minutes after 10 bad passwords, while our Server 2022 VM never locked anyone out. Run net accounts on your own server rather than trusting either column, because a hardened image or Group Policy changes these, and with a threshold set you can lock yourself out of the account you just made by guessing.

net accounts line	Windows Server 2025	Windows Server 2022
Maximum password age (days)	42	42
Minimum password length	0	0
Lockout threshold	10	Never
Lockout duration (minutes)	10	30
Lockout observation window (minutes)	10	30

A minimum length of 0 looks like any password goes, but it does not. Both servers still enforce the complexity rule from local security policy, so a password such as abc123 is refused even though it is longer than zero. Use at least three of upper case, lower case, digits and symbols, and you will not see the errors at the end of this guide.

Step 2: Add a local user with New-LocalUser in PowerShell

New-LocalUser takes the password as a SecureString, not as plain text. Read it with Read-Host -AsSecureString so it never lands in your PowerShell history or on the screen:

$Password = Read-Host -AsSecureString 'Password'

Type the password at the prompt and press Enter; PowerShell shows asterisks only. In the lab we gave kibet the password LabOnly#2026pw, and reused it for the service account in Step 4; you will see it again in Step 6. Now create the account. The user name is the logon name and is limited to 20 characters, while the full name and description are just labels you see in Computer Management:

New-LocalUser -Name 'kibet' -Password $Password -FullName 'Kibet John' -Description 'Homelab admin account'

PowerShell answers with the new account, enabled straight away and ready to log in.

Name  Enabled Description
----  ------- -----------
kibet True    Homelab admin account

We repeated the same sequence in a PowerShell console on Server 2025, this time for a second account called nasadmin, so you can see what the password prompt looks like when you type it.

At this point the account works, but look at its details before you move on. We almost missed this one, and it is the reason for the last column in the comparison table:

Get-LocalUser -Name 'kibet' | Select-Object Name, FullName, Enabled, PasswordRequired, PasswordLastSet, PasswordExpires, UserMayChangePassword

PasswordRequired came back False on both Server 2025 and Server 2022, even though we gave the account a password. The expiry date is 42 days after creation, which matches the policy from Step 1:

Name                  : kibet
FullName              : Kibet John
Enabled               : True
PasswordRequired      : False
PasswordLastSet       : 10/29/2026 10:55:16 PM
PasswordExpires       : 12/10/2026 10:55:16 PM
UserMayChangePassword : True

That flag means the account record says a password is optional. Nothing broke in the lab because of it, but it is not what you want on an admin account, and it is exactly the kind of setting a security audit asks about. Set-LocalUser has no switch for it, so we fix it with net user, which writes the same account record:

net user kibet /passwordreq:yes

Run the Get-LocalUser check again and the flag reads PasswordRequired : True. Accounts made with net user or in the GUI already have it set to True, so we only had to do this for the PowerShell ones. If you script user creation, put this line straight after New-LocalUser in the same script, because it is easy to forget once the account already works.

Step 3: Add the user to the Administrators or Remote Desktop Users group

A new local account lands in the Users group only. That is enough to sign in at the console, but not over RDP and not to install anything. So does the account need admin rights, or only a remote login? Pick the group by what the person or service actually needs to do, since every extra group is extra access you will have to audit later.

• Administrators: full control of the server
• Remote Desktop Users: RDP logon without admin rights
• Backup Operators: back up and restore any file, whatever its permissions

Our kibet account manages the box, so it goes into Administrators and Remote Desktop Users:

Add-LocalGroupMember -Group 'Administrators' -Member 'kibet'
Add-LocalGroupMember -Group 'Remote Desktop Users' -Member 'kibet'

Both commands are silent when they work, so list the members of the Administrators group to confirm the change.

Get-LocalGroupMember -Group 'Administrators'

Our new account sits next to the built-in Administrator, with Local as its source, which tells you it lives in this server’s own account database and not in a domain:

ObjectClass Name                     PrincipalSource
----------- ----                     ---------------
User        WS2025-01\Administrator  Local
User        WS2025-01\cloudbase-init Local
User        WS2025-01\kibet          Local

Group membership is read when the user logs on. If kibet already has a session open, it keeps its old rights until it signs out and back in. Remote Desktop Users also only matters when RDP is switched on and port 3389 is reachable. Our lab template already had RDP enabled, but a fresh install does not, so follow Microsoft’s allow access to your PC steps first, and check the Windows Server firewall rules if the login still fails from another machine.

Step 4: Add a user with the net user command

The net user command works in Command Prompt and PowerShell alike, on Server 2025 and 2022 the same way, which makes it handy in batch files and old scripts. We used it for a service account that runs a nightly backup. The /passwordchg:no switch stops the account from changing its own password, so a script that stores it does not break:

net user svc-backup LabOnly#2026pw /add /fullname:"Backup Service" /comment:"Runs the nightly backup job" /passwordchg:no

Replace LabOnly#2026pw with your own password. Typing it on the command line leaves it in your shell history; put * in its place and net user prompts for it without echoing, as described in Microsoft’s net user reference. Windows confirms the account with one line:

The command completed successfully.

Group membership from Command Prompt goes through net localgroup. A backup account belongs in Backup Operators rather than Administrators, because it only needs to read and restore files. Treat it as privileged all the same: Microsoft counts Backup Operators among the service administrator groups, since restoring files means it can overwrite system files too.

net localgroup "Backup Operators" svc-backup /add

There is one thing net user cannot do: stop the password from expiring. A service account whose password expires after 42 days simply stops working, usually at 2 a.m. Set it with the PowerShell cmdlet instead:

Set-LocalUser -Name 'svc-backup' -PasswordNeverExpires $true

Now show the account. net user with a name prints everything about it on one screen, which is quicker to read than the PowerShell properties.

net user svc-backup

Check four lines here: Password expires Never, Password required Yes, User may change password No, and the two groups under Local Group Memberships:

User name                    svc-backup
Full Name                    Backup Service
Comment                      Runs the nightly backup job
User's comment
Country/region code          000 (System Default)
Account active               Yes
Account expires              Never

Password last set            10/29/2026 10:55:19 PM
Password expires             Never
Password changeable          10/29/2026 10:55:19 PM
Password required            Yes
User may change password     No

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   Never

Logon hours allowed          All

Local Group Memberships      *Backup Operators     *Users
Global Group memberships     *None
The command completed successfully.

Running net user on its own lists every local account. By now the server has the PowerShell account, the service account and the GUI account from the next step:

User accounts for \\WS2025-01

-------------------------------------------------------------------------------
Administrator            cloudbase-init           DefaultAccount
ftpuser                  Guest                    kibet
svc-backup               WDAGUtilityAccount
The command completed successfully.

For the Administrators group from Command Prompt, the same pattern applies: net localgroup Administrators kibet /add adds the account and net localgroup Administrators lists the members.

Step 5: Add a local user in Computer Management

Our original version of this guide covered only the GUI path, and it still looks almost the same on Server 2025. Open Server Manager, which starts at logon, and use its Tools menu. Running compmgmt.msc from the Run box gets you to the same console:

1. 1Tools
2. 2Computer Management

1. Click Tools in the top-right corner of Server Manager.
2. Pick Computer Management.

In Computer Management, expand System Tools, then Local Users and Groups. Right-click the Users folder to get the menu that creates accounts:

1. 1Users
2. 2New User

1. Right-click Users.
2. Choose New User.

We created an account for an FTP site here, the kind of login the IIS FTP server expects. Fill in the form, and pay attention to the first checkbox. “User must change password at next logon” is ticked by default, and while it is ticked the “User cannot change password” and “Password never expires” boxes stay greyed out. An FTP client or a service cannot answer a change-password prompt, so clear it for those accounts:

1. 1User name
2. 2Password
3. 3User must change password at next logon
4. 4Create

1. Type the logon name in User name (we used ftpuser).
2. Enter the Password twice.
3. Clear User must change password at next logon for service and FTP accounts; leave it ticked for a person. Tick Password never expires as well for a service account. We left it clear on ftpuser, and Get-LocalUser later showed its password expiring 42 days out.
4. Click Create, then Close.

After Create, the dialog clears itself so you can add the next account, which is why it does not close on its own. Back in the Users list, double-click the new account to open its properties and switch to the group tab:

1. 1Member Of
2. 2Add

1. Open the Member Of tab. A new account shows only Users.
2. Click Add.

In the Select Groups box, type the group name. Type Administrators for an admin account; our FTP user only needs to sign in remotely, so we typed Remote Desktop Users:

1. 1Remote Desktop Users
2. 2Check Names
3. 3OK

1. Type Remote Desktop Users in the names box.
2. Click Check Names. A valid group turns into WS2025-01\Remote Desktop Users, underlined.
3. Click OK.

The group now appears on the Member Of tab. The note next to the Add button says the same thing we saw in PowerShell: the change takes effect the next time the user logs on.

1. 1Remote Desktop Users
2. 2OK

1. Check that Remote Desktop Users is listed.
2. Click OK to save.

Back in PowerShell, Get-LocalGroupMember -Group 'Remote Desktop Users' listed WS2025-01\ftpuser, so the GUI and the cmdlets see the same change.

Step 6: Confirm the new account can log in

Logging out of your admin session to test a password is slow. You can ask Windows to check the credentials directly from the admin session instead. A wrong password here is still a failed logon, so on a server with a lockout threshold, like our 2025 VM, it counts toward the lockout just like a bad RDP attempt. Replace LabOnly#2026pw with the password you gave kibet in Step 2:

Add-Type -AssemblyName System.DirectoryServices.AccountManagement
$ctx = New-Object System.DirectoryServices.AccountManagement.PrincipalContext('Machine')
$ctx.ValidateCredentials('kibet', 'LabOnly#2026pw')
$ctx.ValidateCredentials('kibet', 'wrong-password')

A correct password returns True and a wrong one returns False, which is all you need before handing the login over. The password is typed in clear on that line, unlike the Read-Host prompt in Step 2, so run this check on a console nobody else is watching.

True
False

For a real end-to-end test, sign in as the new user over RDP from another machine, or over SSH if you have OpenSSH Server on Windows Server running. Local accounts log in as WS2025-01\kibet or .\kibet, the computer name standing in for a domain. Hand over the full form with the password, because a bare kibet leaves the person guessing which machine the account belongs to.

Step 7: Disable or remove a local account

Disable an account first when someone leaves or a service is retired. It keeps the profile and the security identifier, so files it owns still show a name and you can turn it back on if something breaks. We tested both commands on a throwaway account called tempuser:

Disable-LocalUser -Name 'tempuser'
Get-LocalUser -Name 'tempuser'

The Enabled column flips to False, and the account can no longer log in:

Name     Enabled Description
----     ------- -----------
tempuser False

Once you are sure nothing needs it, delete it. Remove-LocalUser asks no questions, so check the name twice.

Remove-LocalUser -Name 'tempuser'

From Command Prompt, net user svc-backup /active:no disables an account and /active:yes turns it back on. If you end up with dozens of these accounts across several servers, that is the point where Active Directory Domain Services starts to pay for itself.

What tripped us up in the lab

None of these stopped the account from being created, which is exactly why they are easy to miss. They are the things we would check on any server where someone else added the local users:

• PasswordRequired is False after New-LocalUser
• The 42-day password age applies to service accounts too
• New group membership waits for the next logon
• Our Server 2025 VM locks an account after 10 bad passwords

The first one surprised us most. Both servers showed it, the GUI on 2025 and net user on both did not, and nothing in the cmdlet output warns you. On a box that a compliance scanner checks, run net user kibet /passwordreq:yes (with your account name) after every New-LocalUser, or create the account with net user and set the rest in PowerShell. The expiry is the one that bites months later: the account works perfectly in testing and then the backup job fails six weeks on, so set -PasswordNeverExpires on service accounts the day you create them. New-LocalUser accepts the same switch, so a PowerShell-created service account can get it in the create command itself.

Error messages we hit and how to fix them

Every error below was captured on the lab servers. The PowerShell and net versions of the same mistake read differently, so both are listed where we saw them.

“The value provided for the new password does not meet the length, complexity, or history requirements”

Server 2022 prints this when New-LocalUser gets a weak password. Server 2025 is less helpful and only prints the exception name, so you need to recognise it:

New-LocalUser : Exception of type 'Microsoft.PowerShell.Commands.InvalidPasswordException' was thrown.
    + CategoryInfo          : InvalidArgument: (:) [New-LocalUser], InvalidPasswordException
    + FullyQualifiedErrorId : InvalidPassword,Microsoft.PowerShell.Commands.NewLocalUserCommand

From net user, both releases print “The password does not meet the password policy requirements” and point you at NET HELPMSG 2245. The fix is the same in every case: a longer password that mixes character types. No account is created when this fails, so you can rerun the command as it is.

“The character length of the 24 argument is too long”

Local user names stop at 20 characters, and New-LocalUser checks this before it touches anything. We tried backup-service-account01, which is 24:

New-LocalUser : Cannot validate argument on parameter 'Name'. The character length of the 24 argument is too long. Shorten the character length of the argument so it is fewer than or equal to "20"
characters, and then try the command again.

net user is worse here: on our Server 2025 VM the same name just printed its syntax help, with no hint that the name is the problem. Shorten it (we settled on svc-backup) and put the long form in the full name or description.

“User kibet already exists”

PowerShell raises UserExistsException and net user prints “The account already exists” with NET HELPMSG 2224. Either pick another name or, if you meant to change the existing account, use Set-LocalUser or net user kibet without /add.

“System error 1378 has occurred”

net localgroup prints it when the account is already in the group, followed by “The specified account name is already a member of the group.” Add-LocalGroupMember says it in plain words: WS2025-01\kibet is already a member of group Administrators. Nothing is wrong; the membership you wanted is already there. In a script, check with Get-LocalGroupMember first, or add -ErrorAction SilentlyContinue so a rerun does not stop on it.

If you are still setting the server up, our Windows Server 2025 installation guide covers the steps before this one, and the Windows Server administration books we recommend go much deeper into local and domain account policy.