Adding Windows Local Users at the Command Line

net user and net localgroup create local accounts and add them to groups from the command line — the standard post-exploitation step for establishing a durable account on a compromised Windows host. Microsoft documents both in the Windows Commands reference.

Create and empower a user

# Create a local user
net user $USERNAME $PASSWORD /add
 
# Add to local Administrators
net localgroup Administrators $USERNAME /add
 
# Add to Remote Desktop Users (allow RDP logon)
net localgroup "Remote Desktop Users" $USERNAME /add
 
# Enable RDP on the host (otherwise the RDP group membership is moot)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" `
    /v fDenyTSConnections /t REG_DWORD /d 0 /f

All of these require local administrator or SYSTEM privileges. The full sequence — create user, grant admin, allow RDP, then enable RDP — turns a transient shell into persistent remote access with legitimate-looking credentials.

Notable behaviors

• Password-policy bypass: net user does not reliably enforce the local password policy the way the GUI does, so a weak or policy-violating password can sometimes be set from the command line. Useful for the attacker, and a detection gap worth knowing.
• Account-type scoping: /add creates a local account on a workstation/member server; on a domain controller, net user creates a domain account — a much higher-impact action.
• Group membership is the privilege: creating the user alone grants nothing; it’s the net localgroup Administrators line that makes the account useful.

Detection

• Security EID 4720 (user account created) and EID 4732 (member added to a security-enabled local group) fire on the first two commands.
• New local admin accounts, and any account added to “Remote Desktop Users” outside a change window, are high-signal persistence events.
• The fDenyTSConnections = 0 registry write is itself a tell that RDP was just enabled (Sysmon EID 13).

Related

• windows-reconnaissance-commands — enumerating existing users/groups before adding your own
• windows-services — services are the other common persistence vehicle
• registry-run-keys-and-startup-folder — complementary persistence primitive

Sources

• net user — Microsoft Learn
• Net localgroup — Microsoft Learn
• NET ACCOUNTS / NET GROUP / NET LOCALGROUP — SS64