Windows Commands / IT Support Guides
Review local Windows accounts with Get-LocalUser
An unmanaged local account can complicate sign-in and device handover. Review account state before resetting passwords or changing group membership.
Environment and inputs: Windows 11 · Command Prompt unless PowerShell is specified
Try the diagnostic command
Use the stated shell and platform. Replace sample domains, addresses, services and paths with values from the system you are authorized to support.
Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordLastSetHow to read the result
The output describes local accounts rather than domain or cloud identities. Blank or unexpected activity fields need context and are not automatic evidence of compromise.
What to do next
Compare enabled accounts with the device's approved support and owner accounts. Route unexplained accounts to the identity owner and keep an alternative authorized recovery account available.
Before you make a change
The LocalAccounts module is Windows-specific and may be unavailable in a 32-bit PowerShell process on 64-bit Windows. Never disable the only usable administrator account.