https://locodigital.com.br/en/tags/local-accounts/Recent content in Local Accounts on LocodigitalHugoen-USWed, 26 Aug 2026 08:00:00 -0300https://locodigital.com.br/en/technology/get-localuser-audit-local-windows-accounts-powershell/Wed, 26 Aug 2026 08:00:00 -0300https://locodigital.com.br/en/technology/get-localuser-audit-local-windows-accounts-powershell/<p>Do you know exactly how many user accounts exist on your Windows machine right now? Most people don't — and that's exactly the gap an attacker with initial access will exploit: create a hidden account with a generic name, enable it with a password, and keep quiet persistence. <code>Get-LocalUser</code> is the cmdlet that exposes all of it in a single line.</p> <h2>What Get-LocalUser is</h2> <p><code>Get-LocalUser</code> is part of the <code>Microsoft.PowerShell.LocalAccounts</code> module, available natively since PowerShell 5.1 (Windows 10 / Server 2016 onward). It returns every local user on the machine — manually created accounts, built-in system accounts (<code>Administrator</code>, <code>Guest</code>, <code>DefaultAccount</code>, <code>WDAGUtilityAccount</code>) and accounts linked to a Microsoft account.</p>