List of user groups command line

On Windows OS we can find the list of local user groups created on a system from Contorl Panel -> User Accounts. This information can be obtained from command line also using net command. Syntax is shown below.

Example: Running this command shows the following local groups on my system.

How to list the users in a local group?

Use the below command to know the list of members of a group from command line.

For example to get the list of all remote desktop users on a system we can run the below command.

How to find the list of all groups a user is member of?
You can run the below command to list the groups a user is member of. This command prints the details of the given user account. You can find the group membership information in the last two line of this command output.

Useful references, however “net use username” should be changed to “net user username”

Thank you Kennedy. Corrected the command.

Please get me a command which will display all local users as: LOGIN, FULL NAME, DESCRIPTION, GROUP etc..

I’d just like to express my frustration with this API. As you can see in these examples, thet net API localgroups functionality will happily list all members of a group. However the net user code completely ignores system accounts, as does most of the rest of what Windows makes available. Internally they are organized as a subclass of Win32_Account but not Win32_UserAccount. So it’s possible to retrieve a bunch of useless information from the Windows API. This happens with LookupAccountSid as well. If you give it an SID like S-1-5-20, it will give you an answer. But the answer it gives you can’t be used as input for anything else, which is obnoxious.

You can query if users exist by doing

SET /P query_user=What user do i look for?
::Take out /domain if you want to look on the local computer
Net User %query_user% /domain
if NOT %errorlevel% == 0 goto s_error_1
if %errorlevel% == 0 goto s_success_1

“net user /domain username” lists only the groups to which the username is a direct member. It can’t show nested groups. I was doing a quick check to see if a username was a member of a group:

net user /domain username | find “Group Name”

That fails since the user is not directly a member of “Group Name”. In reality, they are a member, as they’re a member of a nested group.

Any idea of a command line that will expand groups to look for a particular member? I’ve used the “dsquery” and “dsget” commands, but they are only present if the AD tools are installed.

Very useful thanks, didn’t worked for me the first time.

The command is not case sensitive.

For example “NET USER /DOMAIN MYDOMAIN/MyUser” Didn’t worked.

But “NET USER /DOMAIN MyUser” works fine!
So not necessary to put explicitly the domain.

By the way it means also you can’t query another domain than the main one you are logged on to ?

Is there any option where we can get the multiple user’s output in excel for local computer and remote computer
net user userName

5 Ways to Open Local Users and Groups in Windows 10

The article illustrates how to use the following five methods to open Local Users and Groups on Windows 10 computer.

Video guide on how to open Local Users and Groups in Windows 10:

5 ways to open Local Users and Groups in Windows 10:

Way 1: Open it by searching.

Type management in the search box on taskbar, and choose Computer Management from the result.

Way 2: Turn on Local Users and Groups via Run.

Press Windows+R to open Run, enter lusrmgr.msc in the blank box and tap OK.

Way 3: Open it in Computer Management.

Step 2: Click Local Users and Groups on the left.

Way 4: Turn it on in Command Prompt.

Step 2: Type lusrmgr and press Enter.

Way 5: Open Local Users and Groups in Windows PowerShell.

Step 1: Open Windows PowerShell from Start Menu.

Step 2: Type lusrmgr and hit Enter.

List all user accounts in a Windows Domain group via Command Line?

I would like to find\create a command to list all user accounts with all details on a Windows Domain Controller (Server 2012 R2) from a specified group.

Using «net users» would be perfect, but I have no idea how to do output of this command for all users in one action (i.e. I need to write this command for each user separately if I want to get to know details).

If there is no way to use «Net users» then

would be nice too. But I also need to get information from the specified group (Enterprise Admins, Domain Admins etc.).
I know that I can use PowerShell, but I’m trying to find a solution for CMD .

2 Answers 2

You can just use PowerShell within a batch script to run the needed logic in cmd to get the best of both worlds. I placed a simple example below that you just change the GroupName variable value to be the group which you need to query and it will provide you a list of the members of that group in cmd just as you expect.

Since you said you are running this on a domain controller, just use Get-ADGroupMember and get the task done with simple ease while using cmd as you desire.

Batch Script (members of a group only)

Note: Add the -Recursive switch to get members of other nested group members if applicable.

Output Example

Furthermore, if you need to get more than just the group members of the group you query, you can save that detail to a variable and then pipe that variable array object over to a ForEach-Object loop and then iterate over the Get-ADUser and pull out the specific properties from there as needed.

Find users in group windows

This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.

Answered by:

Question

-> I am trying to configure ‘Windows Server 2012 R2’.

-> I am trying to add some users to the administrative group.

-> Went to ‘Computer Management’ and I dont find «Local Users and Groups»

Am I missing something here?

Answers

Be kind and Mark as Answer if I helped.

All replies

Be kind and Mark as Answer if I helped.

Yes, I have made the machine to be a domain controller.

-> I am creatinng my own developer environment for SharePoint with Active directory, application server on it. The machine is a VM player.

-> Now, I have a user created and how to add him as an administrator similar to System administrator? Just give him persmissions by going to AD?

Be kind and Mark as Answer if I helped.

«Microsoft are idiots for removing this functionality from the server when even though rarely needed, its sometimes is. «

The issue is that once a machine is a domain controller, it no longer has anything known as a local account. Any account created on that system is a domain account. It’s not that ‘Microsoft are idiots’ but that you need to understand how domain controllers work and what their purpose is in a secure environment. Creating non-domain accounts with elevated privileges on a domain controller creates a security hole big enough to drive a semi through.

If an application cannot have their requirements satisfied by a domain account, the last place that application should run is on a domain controller.

If you’re running software that requires a local login that is a member of a local administrators group, it will not work on a domain controller. (I’m thinking of StorageTek’s CAM software. shame on them)

You can add local user accounts, localgroups, change localgroup membership, change local user passwords, enable or disable, or unlock local accounts with the NET USER and NET LOCALGROUP commands on any windows XP,7,8,10 including Home editions, also Windows Server versions 2000, 2003, 2008, 2012.

And you can also do this on any domain controller when it is booted in Directory Services Restore Mode. Although you can’t use any of the local accounts or groups while in normal Domain Controller Active Directory mode.

You can set the local administrator password for the purpose of logging in while the DC is in DSRM.
This password is set using the ndtsutil command on the DC while in normal mode.

How to list the users and groups of an AD Security Group when not a domain admin

I am on Windows 8 connected to domain.

I wish to view the users and groups of an AD Security group. I am not the owner of the group. The command:

shows the direct users of that group but does not show the groups within the group.

As an alternative to the Windows 8, I also have remote access to a Windows Server 2008 R2 and am an admin for that machine but not an admin for the domain. The program «dsget» does not appear to be installed.

This question is expanding on this one (511715)

3 Answers 3

Go to ‘Computer’, click on ‘Network’ from the left menu, in the top bar select ‘Search Active Directory’

You should be able to search for groups and view membership here, even if not an admin.

Run this from a command prompt to get the complete membership of an AD group (users AND groups). Tested on Windows 10.

There’s a handy Advanced Tab in there that supports partial string searches (starting with, ending with).

Sysinternals offers AD Explorer, a utility for listing the complete LDAP structure of an AD forest. It’s slighty overkill for your intended use, though.

I don’t know which permissions exactly are necessary for querying this data, but I guess any logged-in user can do it. I never had any problems querying just about everything, but maybe the domain at work isn’t secured properly.

Usability note: You need not enter your credentials if you’re logged on as a domain user.

You do, however, need the IP address or host name of a Domain Controller. It’s likely this is the same as your DNS server, so just fire up nslookup and try the address displayed there.