killchain-compendium/Post Exploitation/Windows/Add Users.md

# Users

## List Users

List local users

```
net user
```

List users of the domain

```
net user /domain
```

Get more information about a user

```
net user Administrator /domain
```

## List Groups

List local groups

```
net localgroup
```

List groups of the domain

```
net group /domain
```

Get more information about a group

```
net group Administrator /domain
```

## Add user as system user

```sh
net user <username> <password> /add
```

```sh
net localgroup Administrator <username> /add
```

```sh
net localgroup "Remote Management Users" <username> /add
```

```sh
net user <username>
```

connect via winRM afterwards using the new user