Pearson's OSCP Notebook

net user

Properties1
tagsnet, net-user, net-localgroup, windows, cmd, enumeration, manual-enum, active-directory, privilege-escalation, oscp

4 min read

net user / net group — Manual Windows Enumeration

What is net.exe?

Built-in Windows command for users, groups, shares, sessions, and password policy. First stop for manual enum after whoami on any Windows shell — CMD, WinRM, or RDP.

OSCP use: Find local admins, domain users, disabled accounts, password policy before spray, and whether you’re on a domain-joined host. Works without PowerShell (unlike PowerView).

Run from: CMD, cmd.exe via evil-winrm, Impacket -x "net user", SQL xp_cmdshell.

Syntax Overview

net user [username [password | *] [/domain] [options]]
net localgroup [groupname [username] [/add | /delete] [/domain]]
net group [groupname [/domain] [options]]
net accounts [/domain]
net share
net session
net use

Template

net localgroup administrators Eric.Wallows /add
net localgroup "Remote Desktop Users" jsmith /add

## 📌 1) net user — Users

### List all users

```cmd
net user
net user /domain              REM Domain users (needs domain creds / joined host)

View one user (groups, last logon, flags)

net user %username%
net user administrator
net user jsmith /domain

Look for in output:

FieldWhy it matters
Local Group MembershipsIs user in Administrators?
Global Group membershipsDomain groups (Domain Admins, etc.)
Account activeYes/No
Password last setStale creds / spray timing
Last logonActive account
Password requiredBlank password allowed?
User may change passwordPolicy hint
Logon hours allowedRestrictions

Add / modify users (needs privs)

net user john johnjohn /add
net user hacker P@ssw0rd123! /add /domain
net user john /active:yes
net user hacker /expires:never
net user hacker /passwordreq:yes
net user hacker *                    REM Prompt for password

Delete user

net user hacker /delete
net user hacker /delete /domain

📌 2) net localgroup — Local Groups

List local groups

net localgroup

View group members

net localgroup administrators
net localgroup "Remote Desktop Users"
net localgroup "Backup Operators"

Common groups to check:

GroupRelevance
AdministratorsLocal admin
Remote Desktop UsersRDP access
Backup OperatorsBackup priv abuse
Power UsersLegacy, sometimes misconfig
UsersDefault group

Add user to local group

net localgroup administrators john /add
net localgroup "Remote Desktop Users" jsmith /add

📌 3) net group — Domain Groups

Requires domain context (/domain) and usually domain user creds:

net group /domain
net group "Domain Admins" /domain
net group "Domain Users" /domain
net group "Enterprise Admins" /domain
net group "Account Operators" /domain
net group "Server Operators" /domain

Add/remove domain group member (needs rights):

net group "Domain Admins" jsmith /add /domain
net group "Domain Admins" jsmith /delete /domain

On AD sets, pair with PowerView, CrackMapExec - nxc, ldapsearch — net is quick from any shell.

📌 4) net accounts — Password Policy

Check before password spray — lockout threshold and reset time:

net accounts
net accounts /domain
FieldSpray impact
Lockout thresholdHow many bad attempts before lockout
Lockout durationHow long account stays locked
Lockout observation windowWindow for counting failures
Minimum password lengthWordlist tuning
Maximum password ageExpiry behavior

Compare with nxc smb TARGET --pass-pol and CrackMapExec - nxc.

📌 5) Other net Commands (Enum)

net share                       REM SMB shares on this host
net session                     REM Active SMB sessions (admin)
net use                         REM Mapped drives / connections
net view \\TARGET               REM Shares on remote host
net view /domain                REM Domain computers (legacy)
net config workstation          REM Computer name, domain, logon server
net config server               REM Server role
net statistics workstation      REM Stats since boot

📌 6) CMD vs PowerShell Equivalents

TaskCMDPowerShell
List usersnet userGet-LocalUser / Get-ADUser -Filter *
Local adminsnet localgroup administratorsGet-LocalGroupMember administrators
Current userwhoami /allwhoami /all or [System.Security.Principal.WindowsIdentity]::GetCurrent()
Domain groupsnet group "Domain Admins" /domainGet-ADGroupMember "Domain Admins"

Use net when PowerShell is restricted or you’re in pure cmd.exe.

📌 7) OSCP Manual Enum Workflow

whoami /all
net user %username%
net user
net localgroup
net localgroup administrators
net accounts
 
REM If domain-joined:
net user /domain
net group "Domain Admins" /domain
net accounts /domain
systeminfo | findstr /B /C:"Domain"

Then: Windows PrivEsc, Privesc Tools, PowerView if PS available.

📌 8) Common Errors

ErrorMeaning
System error 5Access denied — need higher privs
The user name could not be foundWrong username or wrong /domain
The request will be processed at a domain controllerNormal for /domain queries
Empty /domain listNot domain-joined or no domain auth

📌 Quick Cheat Sheet

net user
net user %username%
net localgroup administrators
net accounts
net user /domain
net group "Domain Admins" /domain
net share
whoami /all
REM Add admin (after privesc)
net user hacker P@ssw0rd123! /add
net localgroup administrators hacker /add

Graph View

Backlinks