List members of a Windows group using command line

Question

I would like to get a list of "normal" users in the Windows command line. By normal, I mean the users that appear when logging on to the computer. Thus, disabled accounts, accounts like System, and others that an average PC users would never log into, would not be in this list. I also need to know whether the users returned were admins or standard users. Any ideas?

Answer 1

To list users, use the net user command:

net user

You output get something like this:

User accounts for \\LOCALHOST

-------------------------------------------------------------------------------
joeuser          administrator                   guest
The command completed successfully.

If you need a list of users in a specific group, the use net localgroup:

net localgroup Users

You output get something like this:

Alias name     Users
Comment        Users are prevented from making accidental or intentional system-wide changes and can run most applications

Members

-------------------------------------------------------------------------------
NT AUTHORITY\Authenticated Users
NT AUTHORITY\INTERACTIVE
The command completed successfully.

This is for local system users, not domain accounts. If you want to know the membership of the Administrators group, you would just supply that as a parameter: net localgroup Administrators.

Answer 2

WMIC USERACCOUNT LIST BRIEF is another way to list the users in Windows. I'm not sure of the differences between net and WMIC. You can find more information about WMIC at http://ss64.com/nt/wmic.html

This is what WMIC USERACCOUNT LIST BRIEF returns on my machine:

C:\Users\ehtesh\AppData\Local>WMIC USERACCOUNT LIST BRIEF
AccountType  Caption                  Domain    FullName        Name            SID
512          wordless\Administrator   wordless                  Administrator   S-1-5-21-3098939154-701116006-2681273294-500
512          wordless\ehtesh          wordless                  ehtesh          S-1-5-21-3098939154-701116006-2681273294-1001
512          wordless\Guest           wordless                  Guest           S-1-5-21-3098939154-701116006-2681273294-501
512          wordless\HomeGroupUser$  wordless  HomeGroupUser$  HomeGroupUser$  S-1-5-21-3098939154-701116006-2681273294-1002

For more detailed information, you can call WMIC USERACCOUNT LIST FULL.

WMIC has information on a lot more about the system than just useraccounts. One example is Windows XP/Vista/7 Check Battery Charge from CMD?.

Answer 3

use below command to get local admin users wmic -U domain/user //ip "SELECT * FROM Win32_GroupUser"| awk -F'"' '{print $4 " : " $8}'|grep -i Administrators|awk -F':' '{print $2}'