This chapter covers Windows user accounts and groups, a core topic for the CompTIA A+ 220-1102 exam under Objective 1.3 (Operating Systems). Understanding how Windows manages users and groups is essential for security, troubleshooting, and configuration tasks that appear on approximately 8-10% of exam questions. You will learn the differences between local and domain accounts, built-in groups, User Account Control (UAC), and how to manage accounts via GUI and command-line tools.
Jump to a section
Think of a Windows computer as a secure office building. A user account is like an employee's security badge — it identifies who you are and grants access to the building. But not all badges are equal. A standard user badge opens the front door and lets you into your own cubicle, but you cannot enter the server room or change the thermostat. An administrator badge is the master key — it opens every door, including the IT closet and the CEO's office. The building also has groups, like departments: 'Finance' group badge lets you into the finance floor, 'HR' group badge into HR. Instead of giving each employee individual door permissions, the security guard checks your group badge. If you are in 'Printers' group, you can use the printer on any floor. Built-in groups like 'Administrators' are like the building's security team — they have all-access. Service accounts are like janitors who have a special badge that works only at night and only for cleaning routes. Guest accounts are like a temporary visitor badge — limited access, expires quickly. Local users and groups are managed by the building's own security office (Local Security Authority), while domain users and groups are managed by a central headquarters (Active Directory). When you log in, Windows authenticates your badge (password or biometric) and then issues a token — like a temporary ID card that lists all your group memberships. Every time you try to open a file or run a program, Windows checks your token against the ACL (Access Control List) — the building's security rules. If your token lacks the right group, access is denied. This is why you should never give administrator privileges to everyday users — it's like giving every employee a master key to the entire building.
What Are Windows User Accounts and Groups?
Windows user accounts and groups are the foundation of authentication and authorization in Windows operating systems. A user account is a unique identity that allows a person or service to log on to a Windows system and access resources. Each account has a Security Identifier (SID) — a unique, immutable number that Windows uses internally to track permissions, not the username. Groups are collections of user accounts that simplify permission management: instead of assigning permissions to each user individually, you assign permissions to a group, and all members inherit those permissions.
Types of User Accounts
Windows supports two primary categories of user accounts: local accounts and domain accounts. Local accounts are stored in the Security Accounts Manager (SAM) database on a single computer and are only valid on that machine. Domain accounts are stored in Active Directory (AD) and can be used across multiple computers in a network. The CompTIA A+ 220-1102 exam focuses heavily on local accounts and the built-in accounts that come with Windows.
Built-in Local Accounts: - Administrator: The most powerful account. It has full control over the system, including the ability to install software, change system settings, and manage other users. By default, the built-in Administrator account is disabled in Windows 10/11 for security reasons. It has a well-known SID: S-1-5-21-...-500. - Guest: A limited account for temporary access. It is disabled by default. Even when enabled, it has restricted permissions (e.g., cannot install software or change system settings). Its SID ends with -501. - DefaultAccount: A built-in account used by the system for running services and tasks. It is not meant for interactive logon.
User Account Control (UAC): UAC is a security feature that prevents unauthorized changes to the operating system. When an administrator logs in, they receive two access tokens: one with standard user privileges and one with administrator privileges. By default, standard user operations use the standard token. When an operation requires administrative rights (e.g., installing software, changing system settings), UAC prompts the user for consent (for administrators) or credentials (for standard users). This prompt is called a 'consent prompt' or 'credential prompt'. The prompt appears on the Secure Desktop, a protected desktop that prevents other programs from interfering.
Types of Groups
Groups can be local (stored in SAM) or domain (stored in AD). The 220-1102 exam focuses on local groups. Groups have a specific scope that determines where they can be used.
Built-in Local Groups: - Administrators: Members have full control over the computer. The built-in Administrator account is a member by default. - Users: Members can run applications, use printers, and shut down the computer, but cannot make system-wide changes or install software that affects other users. - Guests: Members have the same rights as the Users group, but the Guest account is a member by default. Additional restrictions apply (e.g., no ability to create a password). - Power Users: In older Windows versions (XP/2000), this group had elevated privileges but less than Administrators. In Windows 10/11, Power Users is retained for backward compatibility but has no special privileges by default. - Remote Desktop Users: Members can log on remotely using Remote Desktop. - Backup Operators: Members can back up and restore files regardless of file permissions, but cannot change security settings. - Network Configuration Operators: Members can change TCP/IP settings. - Performance Log Users: Members can manage performance counters, logs, and alerts. - Performance Monitor Users: Members can access performance monitoring data. - Hyper-V Administrators: Members have full access to Hyper-V features.
Special Identity Groups (not visible in GUI): - Everyone: Includes all users, including guests and anonymous users. - Authenticated Users: Includes all users who have logged on with a valid username and password (excludes Guest if not authenticated). - Interactive: Users who log on locally. - Network: Users who access the computer over the network. - Creator Owner: The user who created a file or folder.
How User Account Authentication Works
When a user logs on to Windows, the following process occurs: 1. The user provides credentials (username and password, or smart card, or biometric). 2. The Local Security Authority (LSA) validates the credentials against the SAM database (for local accounts) or against Active Directory (for domain accounts). 3. If authentication succeeds, the LSA creates an access token. This token contains the user's SID, the SIDs of all groups the user belongs to, and the user's privileges. 4. Every process launched by the user inherits a copy of this token. 5. When the process tries to access an object (file, registry key, printer), Windows compares the token's SIDs against the object's Access Control List (ACL). If a matching Allow entry is found, access is granted; if a Deny entry is found, access is denied. Deny entries always override Allow entries.
Managing User Accounts and Groups via GUI
Local Users and Groups MMC Snap-in (lusrmgr.msc):
- Available in Windows Pro, Enterprise, and Education editions (not in Windows Home).
- To open: Press Win+R, type lusrmgr.msc, and press Enter.
- Under 'Users', you can create, disable, rename, and delete local user accounts. You can also set passwords and manage group memberships.
- Under 'Groups', you can create new local groups and add/remove members.
Computer Management Console:
- Right-click 'This PC' > Manage > Local Users and Groups.
- Alternatively, open compmgmt.msc.
Settings App (Windows 10/11): - For basic user management: Settings > Accounts > Family & other users. - You can add new users, change account types (Standard or Administrator), and set up password reset disks.
Managing User Accounts via Command Line
net user command:
- net user : Lists all user accounts.
- net user username password /add : Creates a new user account with password.
- net user username /delete : Deletes a user account.
- net user username /active:yes : Enables a disabled account.
- net user username * : Prompts to set/change password.
net localgroup command:
- net localgroup : Lists all local groups.
- net localgroup groupname /add : Creates a new local group.
- net localgroup groupname username /add : Adds a user to a group.
- net localgroup groupname username /delete : Removes a user from a group.
WMIC (Windows Management Instrumentation Command-line):
- wmic useraccount get name,sid : Lists all user accounts with their SIDs.
- wmic group where name='Administrators' get name,sid : Gets SID of a group.
PowerShell cmdlets:
- Get-LocalUser : Lists local user accounts.
- New-LocalUser -Name "username" -Password (ConvertTo-SecureString "password" -AsPlainText -Force) : Creates a new local user.
- Add-LocalGroupMember -Group "Administrators" -Member "username" : Adds user to group.
- Get-LocalGroup : Lists local groups.
User Account Control (UAC) Deep Dive
UAC is a mandatory access control mechanism that restricts application permissions. When an administrator logs in, Windows creates two tokens: a filtered token with standard user privileges and a full token with administrator privileges. By default, applications run with the filtered token. When an application requires administrator privileges, Windows checks if the executable is marked as 'requireAdministrator' in its manifest. If so, UAC prompts for consent (for administrators) or credentials (for standard users). The prompt appears on the Secure Desktop, which is a separate desktop that only the operating system can access. This prevents malicious software from mimicking the prompt.
UAC Levels: - Always notify (highest): Prompts for all changes, including Windows settings. - Notify me only when apps try to make changes to my computer (default): Prompts only when a program tries to make system changes. - Notify me only when apps try to make changes (do not dim my desktop): Same as default but without Secure Desktop. - Never notify (lowest): UAC is effectively disabled (not recommended).
To change UAC settings: Control Panel > User Accounts > Change User Account Control settings.
Password Policies and Account Lockout
Windows enforces password policies that are configured in Local Security Policy (secpol.msc) or Group Policy. Key settings: - Enforce password history: Remember a set number of previous passwords to prevent reuse (default: 0 in standalone, 24 in domain). - Maximum password age: How long a password can be used before it must be changed (default: 42 days in domain, 0 = never expire in standalone). - Minimum password age: How long a password must be used before it can be changed (default: 0 in standalone, 1 day in domain). - Minimum password length: Minimum number of characters (default: 0 in standalone, 7 in domain). - Password must meet complexity requirements: Requires passwords to have three of four character types (uppercase, lowercase, digits, non-alphanumeric). Enabled by default in domain, disabled in standalone. - Account lockout threshold: Number of failed logon attempts before account is locked (default: 0 = never lock). - Account lockout duration: Minutes the account remains locked (default: 30 minutes). - Reset account lockout counter after: Minutes after which the failed attempt counter resets (default: 30 minutes).
User Profiles
Each user account has a profile that stores personal settings, documents, and configuration. Profiles are stored in C:\Users\<username>. There are three types:
- Local profile: Created when a user logs on for the first time. Stored locally.
- Roaming profile: Stored on a network server and downloaded to any computer the user logs on to (used in domain environments).
- Mandatory profile: A read-only roaming profile that users cannot change.
Interaction with Active Directory
In a domain environment, user accounts are stored in Active Directory. The local SAM is not used for domain accounts. Domain users can log on to any domain-joined computer using their domain credentials. The computer must trust the domain controller. Group Policy Objects (GPOs) apply settings to users and computers. The 220-1102 exam expects you to know the difference between local and domain accounts, but does not require deep Active Directory knowledge.
Create a Local User Account
Open Computer Management (compmgmt.msc) > Local Users and Groups > Users. Right-click in the right pane and select 'New User'. Enter a username, full name, and description. Set a password and confirm. You can also set password options: 'User must change password at next logon' forces the user to create a new password on first login; 'User cannot change password' prevents the user from changing it; 'Password never expires' overrides password aging policies; 'Account is disabled' prevents the account from being used. Click Create. The new user is added to the Users group by default. To change group membership, right-click the user > Properties > Member Of tab > Add > enter the group name > Check Names > OK.
Add User to a Group
Open Local Users and Groups (lusrmgr.msc). Navigate to Groups. Double-click the target group (e.g., Administrators). Click Add. In 'Enter the object names to select', type the username (or group name) and click Check Names to validate. Click OK. The user is now a member of that group and inherits its permissions. You can also add users via command line: `net localgroup Administrators username /add`. To remove: `net localgroup Administrators username /delete`.
Configure User Account Control
Open Control Panel > User Accounts > Change User Account Control settings. Drag the slider to one of four levels: Always notify (highest), Notify me only when apps try to make changes (default), Notify me only when apps try to make changes (do not dim desktop), or Never notify. Click OK. Changes take effect immediately. The Secure Desktop is used at the two highest levels. For security, the default level is recommended. Lowering UAC reduces security and is not recommended for standard users.
Set Password Policy via Local Security Policy
Open Local Security Policy (secpol.msc). Expand Account Policies > Password Policy. Double-click a policy to set it. For example, set 'Minimum password length' to 8 characters. Set 'Password must meet complexity requirements' to Enabled. These policies apply to all local users. After changing, existing passwords are not affected; new passwords must comply. For account lockout, go to Account Lockout Policy. Set 'Account lockout threshold' to 5 invalid attempts. Set 'Account lockout duration' to 30 minutes. Set 'Reset account lockout counter after' to 30 minutes.
Enable the Built-in Administrator Account
The built-in Administrator account is disabled by default in Windows 10/11. To enable it, open Command Prompt as Administrator. Type `net user administrator /active:yes` and press Enter. To set a password: `net user administrator *` and enter the password when prompted. Alternatively, use Local Users and Groups: right-click Administrator > Properties > uncheck 'Account is disabled'. Be cautious: enabling this account without a strong password is a security risk. For daily use, create a separate admin account instead.
In enterprise environments, managing user accounts and groups is a daily task for IT support. Here are three common scenarios:
Scenario 1: Onboarding a New Employee When a new employee joins, the IT administrator creates a domain user account in Active Directory (not local). The account is added to appropriate security groups (e.g., 'Sales', 'VPN Users', 'FileShare_ReadWrite'). The user logs on to their assigned computer using domain credentials. The computer must be domain-joined. If the computer is not domain-joined, a local account is created instead. The administrator must ensure the account has a strong initial password and that 'User must change password at next logon' is checked. Common mistakes: forgetting to add the user to the correct groups, leading to access denied errors; or leaving the password never expire, violating security policy.
Scenario 2: Troubleshooting 'Access Denied'
A user reports they cannot access a shared folder. The helpdesk checks the folder's permissions: the folder grants 'Modify' to the 'Finance' group. The user is not in the Finance group. Solution: Add the user to the Finance group (via AD or local group). Alternatively, if the user needs temporary access, the administrator can use 'Effective Access' tab in Advanced Security Settings to check which permissions the user actually has. Another common issue: the user has multiple group memberships that conflict — a Deny entry for one group overrides Allow entries from other groups. The administrator must examine the user's token using whoami /groups or gpresult /r.
Scenario 3: Securing a Shared Computer In a lab or kiosk environment, multiple users share a single Windows computer. The administrator creates local standard user accounts for each user. To prevent users from installing software or changing system settings, the accounts are placed only in the Users group, not Administrators. UAC is set to the default level. Additionally, Group Policy (or Local Group Policy) can restrict access to Control Panel, prevent command prompt, and set a time limit for logon sessions. The Guest account is kept disabled. If a user needs temporary access, a guest account can be enabled but with strict limitations. Performance considerations: too many user profiles can consume disk space; profiles can be deleted via System Properties > Advanced > User Profiles > Settings.
Common misconfigurations: - Giving a user administrative privileges unnecessarily (e.g., to install a printer driver). This exposes the system to malware and accidental changes. Instead, use Group Policy to deploy drivers or provide the user with a one-time admin password via LAPS (Local Administrator Password Solution). - Not disabling old accounts when employees leave. This creates security holes. Automated scripts or HR integration should disable accounts upon termination. - Setting passwords that never expire on service accounts. This violates security best practices; service accounts should have long, complex passwords that are rotated regularly.
The CompTIA A+ 220-1102 exam tests Windows user accounts and groups under Objective 1.3: 'Given a scenario, use features and tools to manage the operating system.' Specifically, you must know:
How to create, delete, and modify local user accounts.
The difference between local and domain accounts.
Built-in accounts: Administrator, Guest, DefaultAccount.
Built-in groups: Administrators, Users, Guests, Power Users, Remote Desktop Users, Backup Operators.
User Account Control (UAC): what it does, the four notification levels, and the Secure Desktop.
Password policies: minimum password length, complexity, account lockout threshold.
Tools: Local Users and Groups (lusrmgr.msc), Computer Management, net user, net localgroup, WMIC, PowerShell.
Common Wrong Answers: 1. 'The built-in Administrator account is enabled by default.' WRONG. It is disabled in Windows 10/11. Candidates often assume it's enabled because it was in older versions. 2. 'UAC completely prevents malware from running.' WRONG. UAC prompts for consent but does not block malware if the user approves. It reduces the risk but is not a complete defense. 3. 'Power Users group has special privileges in Windows 10.' WRONG. Power Users exists for backward compatibility but has no additional privileges over Users. 4. 'You can manage local users from the Settings app in Windows Home.' WRONG. Local Users and Groups snap-in is not available in Windows Home; you must use command-line tools.
Exam-Specific Values: - SID for Administrator: ends with -500. - SID for Guest: ends with -501. - Default maximum password age in domain: 42 days. - Default account lockout threshold: 0 (never lock). - UAC default level: 'Notify me only when apps try to make changes to my computer' (second from top).
Edge Cases: - Renaming the built-in Administrator account does not change its SID; it remains -500. - Disabling the Administrator account does not prevent it from being used in Safe Mode (if enabled). - The Guest account, when enabled, is a member of the Guests group and the Everyone group. - User profiles are not deleted when a user account is deleted; you must manually delete the profile folder.
How to Eliminate Wrong Answers: - If a question asks about managing local users on a Windows Home edition, eliminate options that mention lusrmgr.msc or Computer Management > Local Users and Groups. The correct answer will involve net user or PowerShell. - If a question mentions 'Secure Desktop', it is related to UAC. The Secure Desktop is used only when UAC is set to 'Always notify' or the default level. - If a question asks about a group that can back up files without permission, the answer is Backup Operators, not Administrators (though Administrators can also do it).
The built-in Administrator account SID ends with -500; Guest account SID ends with -501.
UAC uses the Secure Desktop to prevent malicious programs from mimicking the consent prompt.
The default UAC level is 'Notify me only when apps try to make changes to my computer'.
Local Users and Groups snap-in (lusrmgr.msc) is not available in Windows Home edition.
Power Users group has no special privileges in Windows 10/11; it is retained for backward compatibility.
Account lockout threshold default is 0 (disabled); must be manually configured.
Deleting a user account does not delete the user's profile folder.
Standard users can change their own passwords unless restricted by policy.
The Guest account is disabled by default; when enabled, it has very limited permissions.
Use net user command to create, delete, or modify local user accounts from command line.
These come up on the exam all the time. Here's how to tell them apart.
Local User Account
Stored in SAM database on a single computer.
Only valid on that specific computer.
Created via lusrmgr.msc, net user, or Settings.
Cannot be used to log on to other computers in the network.
Password is stored locally; no central management.
Domain User Account
Stored in Active Directory on a domain controller.
Can log on to any domain-joined computer in the domain.
Created via Active Directory Users and Computers (ADUC).
Supports single sign-on across network resources.
Password policy and account settings are managed centrally via Group Policy.
Mistake
The built-in Administrator account is enabled by default in Windows 10/11.
Correct
The built-in Administrator account is disabled by default in Windows 10/11 for security reasons. It must be manually enabled via net user or Local Users and Groups.
Mistake
UAC completely stops malware from making system changes.
Correct
UAC prompts for consent or credentials, but if the user approves, the change proceeds. Malware can trick users into approving. UAC reduces risk but is not a complete security solution.
Mistake
The Power Users group has special privileges in Windows 10/11.
Correct
Power Users exists for backward compatibility but has no additional privileges over the Users group in modern Windows. Its historical elevated permissions have been removed.
Mistake
Deleting a user account also deletes the user's profile folder.
Correct
Deleting a user account does not automatically delete the profile folder (C:\Users\<username>). You must manually delete the folder or use System Properties > User Profiles to remove it.
Mistake
A user must be an administrator to change their own password.
Correct
Standard users can change their own password without administrator privileges, provided the password policy allows it. However, an administrator can force a password change.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Open Command Prompt as Administrator and type `net user administrator /active:yes`. To set a password, type `net user administrator *` and enter the password when prompted. Alternatively, use Local Users and Groups (lusrmgr.msc) if available, right-click Administrator, uncheck 'Account is disabled', and click OK. Be aware that enabling this account is a security risk; use a strong password and disable it when not needed.
A local user account is stored on a single computer and can only log on to that computer. A domain user account is stored in Active Directory and can log on to any computer that is joined to the domain. Domain accounts also allow single sign-on to network resources like file shares and printers. Local accounts are managed via lusrmgr.msc or net user; domain accounts are managed via Active Directory Users and Computers.
UAC is a security feature that prevents unauthorized system changes. When an administrator logs in, Windows creates two tokens: one with standard privileges and one with admin privileges. Applications run with the standard token by default. When an app requires admin rights, UAC prompts for consent (admin) or credentials (standard user). The prompt appears on the Secure Desktop, a protected desktop that other programs cannot access. UAC has four levels; the default is 'Notify me only when apps try to make changes to my computer'.
Windows 10 Home edition does not include the Local Users and Groups MMC snap-in (lusrmgr.msc). However, you can still manage local users using the command line: `net user` to list, create, or modify users, and `net localgroup` to manage groups. PowerShell cmdlets like Get-LocalUser and New-LocalUser also work. The Settings app provides basic user management under Accounts > Family & other users.
In a standalone Windows system, default password policy: password history = 0 remembered, maximum age = 0 (never expire), minimum age = 0, minimum length = 0, complexity disabled, lockout threshold = 0 (never lock). In a domain, defaults are: history = 24, max age = 42 days, min age = 1 day, min length = 7, complexity enabled, lockout threshold = 5. These can be changed via Local Security Policy (secpol.msc) or Group Policy.
Use the `net localgroup` command. For example, to add user 'jsmith' to the Administrators group: `net localgroup Administrators jsmith /add`. To remove: `net localgroup Administrators jsmith /delete`. You must run the command as an administrator. Alternatively, use PowerShell: `Add-LocalGroupMember -Group "Administrators" -Member "jsmith"`.
The Secure Desktop is a protected desktop that only the Windows operating system can access. When UAC prompts for consent or credentials, the screen dims and the prompt appears on the Secure Desktop. This prevents malicious programs from mimicking the prompt or interfering with the user's response. The Secure Desktop is used when UAC is set to 'Always notify' or the default level. If you choose 'Notify me only when apps try to make changes (do not dim my desktop)', the Secure Desktop is not used.
You've just covered Windows User Accounts and Groups — now see how well it sticks with free 220-1102 practice questions. Full explanations included, no account needed.
Done with this chapter?