net — Windows Command Multitool

net.exe is the legacy-but-ubiquitous Windows CLI for accounts, groups, shares, and sessions. It ships on every Windows install, requires no upload, and is a first-stop reconnaissance (and post-exploitation manipulation) tool.

Reconnaissance

Command	Output
net users	All local user accounts
net user $USER	Detail on local user $USER (groups, password age, flags)
net users /domain	All domain users
net user $USER /domain	Detail on domain user $USER
net group /domain	Domain groups
net group "$GROUP" /domain	User members of a domain group (try "Domain Admins")
net localgroup	Local groups
net localgroup "$GROUP"	Members of a local group (try "Administrators")
net share	All shares exported by this machine

Local vs domain accounts

Windows permits a local user and a domain user to share a name. Compare whoami output (MACHINE\user vs DOMAIN\user) with hostname to tell which context you’re in.

Blind spot: nested groups

net group "$GROUP" /domain lists only direct user members — domain groups nested inside $GROUP are not expanded. A domain admin effective through group nesting is invisible here. Full recursive membership requires PowerShell (Get-ADGroupMember -Recursive) or PowerView.

Manipulation (requires admin/SYSTEM)

# Reset a user's password
net user $USERNAME $PASSWORD
 
# Create a domain user
net user $USERNAME $PASSWORD /add /domain
 
# Grant domain admin
net group "Domain Admins" $USERNAME /add /domain

Useful local-group targets for persistence: Administrators, Backup Operators, Remote Management Users:

net localgroup "Remote Management Users" $USERNAME /add

Sources

• net user — Microsoft Learn
• Net group — Microsoft Learn
• Net localgroup — Microsoft Learn
• Net share — Microsoft Learn

Related: windows-reconnaissance-commands, whoami, add-windows-local-users-command-line, windows-unix-command-equivalents, wmic