Windows 10: Add or Remove Users from Groups in Windows 10

How to: Add or Remove Users from Groups in Windows 10

How to Add or Remove Users from Groups in Windows 10


You can limit the ability of users to perform certain actions by adding or removing the user from being a member of groups. Each group has its own default rights and permissions. When a user is a member of a group, the user will be assigned the rights and permissions of the group to them.

A right authorizes a user to perform certain actions on a computer, such as backing up files and folders or shutting down a computer.

A permission is a rule that is associated with an object (usually a file, folder, or printer), and it regulates which users can have access to the object and in what manner.

This tutorial will show you how to add or remove users as members of groups to limit the ability of users to perform certain actions in Windows 10.

You must be signed in as an administrator to add or remove users from groups.



Warning Changes to a users's group membership are not effective until the next time the user signs in.



Note The following table provides descriptions of the default local groups that are located in the Groups folder in Local Users and Groups (lusrmgr.msc).

[table][tr][td]Group[/td] [td]Description[/td] [/tr] [tr][td]Access Control Assistance Operators[/td] [td]Members of this group can remotely query authorization attributes and permissions for resources on this computer.[/td] [/tr] [tr][td]Administrators[/td] [td]Members of this group have full control of the computer, and they can assign user rights and access control permissions to users as necessary. The Administrator account is a default member of this group. When a computer is joined to a domain, the Domain Admins group is added to this group automatically. Because this group has full control of the computer, use caution when you add users to it.[/td] [/tr] [tr][td]Backup Operators[/td] [td]Members of this group can back up and restore files on a computer, regardless of any permissions that protect those files. This is because the right to perform a backup takes precedence over all file permissions. Members of this group cannot change security settings.[/td] [/tr] [tr][td]Cryptographic Operators[/td] [td]Members of this group are authorized to perform cryptographic operations.[/td] [/tr] [tr][td]Distributed COM Users[/td] [td]Members of this group are allowed to start, activate, and use DCOM objects on a computer.[/td] [/tr] [tr][td]Event Log Readers[/td] [td]Members of this group can read event logs from local machine.[/td] [/tr] [tr][td]Guests[/td] [td]In a computer joined to the domain, members of this group have a temporary profile created at log on, and when the member logs off, the profile is deleted. Profiles in workgroup environments are not deleted. The Guest account (which is disabled by default) is also a default member of this group. Members of this group will have a temporary profile created at log on, and when the member logs off, the profile will be deleted. The Guest account (which is disabled by default) is also a default member of this group.[/td] [/tr] [tr][td]Hyper-V Administrators[/td] [td]Members of this group have complete and unrestricted access to all features of Hyper-V.[/td] [/tr] [tr][td]IIS_IUSRS[/td] [td]This is a built-in group that is used by Internet Information Services (IIS).[/td] [/tr] [tr][td]Network Configuration Operators[/td] [td]Members of this group can make changes to TCP/IP settings, and they can renew and release TCP/IP addresses. This group has no default members.[/td] [/tr] [tr][td]Performance Log Users[/td] [td]Members of this group can manage performance counters, logs, and alerts on a computer — both locally and from remote clients — without being a member of the Administrators group.[/td] [/tr] [tr][td]Performance Monitor Users[/td] [td]Members of this group can monitor performance counters on a computer — locally and from remote clients — without being a member of the Administrators group or the Performance Log Users groups[/td] [/tr] [tr][td]Power Users[/td] [td]By default, members of this group have no more user rights or permissions than a standard user account. The Power Users group in previous versions of Windows was designed to give users specific administrator rights and permissions to perform common system tasks. In this version of Windows, standard user accounts inherently have the ability to perform most common configuration tasks, such as changing time zones. For legacy applications that require the same Power User rights and permissions that were present in previous versions of Windows, administrators can apply a security template that enables the Power Users group to assume the same rights and permissions that were present in previous versions of Windows.[/td] [/tr] [tr][td]Remote Desktop Users[/td] [td]Members of this group can log on to the computer remotely.[/td] [/tr] [tr][td]Remote Management Users[/td] [td]Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user.[/td] [/tr] [tr][td]Replicator[/td] [td]This group supports replication functions. The only member of the Replicator group should be a domain user account that is used to log on the Replicator services of a domain controller. Do not add user accounts of actual users to this group.[/td] [/tr] [tr][td]System Managed Accounts Group[/td] [td]Members of this group are managed by the system.[/td] [/tr] [tr][td]Users[/td] [td]Members of this group can perform common tasks, such as running applications, using local and network printers, and locking the computer. Members of this group cannot share directories or create local printers. By default, the Domain Users, Authenticated Users, and Interactive groups are members of this group.Therefore, any user account that is created in the domain becomes a member of this group.[/td] [/tr] [tr][td]HomeUsers[/td] [td]HomeUsers Security Group[/td] [/tr] [/table]

CONTENTS:

• Option One: To Add Groups to Users from Users folder in Local Users and Groups
• Option Two: To Remove Groups from Users from Users folder in Local Users and Groups
• Option Three: To Add Users to Groups from Groups folder in Local Users and Groups
• Option Four: To Remove Users from Groups from Groups folder in Local Users and Groups
• Option Five: To Add User to Group in Command Prompt
• Option Six: To Remove User from Group in Command Prompt
• Option Seven: To Add User to Group in PowerShell
• Option Eight: To Remove User from Group in PowerShell

OPTION ONE [/i] To Add Groups to Users from Users folder in Local Users and Groups
*note Local Users and Groups is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Five below.

1. Press the Win+R keys to open Run, type lusrmgr.msc into Run, and click/tap on OK to open Local Users and Groups.

2. Click/tap on Users in the left pane of Local Users and Groups. (see screenshot below step 3)

3. Right click or press and hold on the user name (ex: "Brink2") you want to add groups to be a member of, and click/tap on Properties. (see screenshot below)



4. Click/tap on the Member Of tab, and click/tap on the Add button. (see screenshot below)



5. Click/tap on the Advanced button. (see screenshot below)



6. Click/tap on the Find Now button, select the name of the group (ex: "Administrators") you want to add, and click/tap on OK. (see screenshot below)

*note If you like, you can press and hold the Ctrl key to select more than one group.



7. Click/tap on OK. (see screenshot below)



8. Click/tap on OK. (see screenshot below)



9. When finished, you can close Local Users and Groups if you like.





OPTION TWO [/i] To Remove Groups from Users from Users folder in Local Users and Groups
*note Local Users and Groups is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Six below.

1. Press the Win+R keys to open Run, type lusrmgr.msc into Run, and click/tap on OK to open Local Users and Groups.

2. Click/tap on Users in the left pane of Local Users and Groups. (see screenshot below step 3)

3. Right click or press and hold on the user name (ex: "Brink2") you want to remove groups from, and click/tap on Properties. (see screenshot below)



4. Click/tap on the Member Of tab, select the group (ex: "Administrators") you want to remove, and click/tap on the Remove button. (see screenshot below)

*note If you like, you can press and hold the Ctrl key to select more than one group.



5. Click/tap on OK. (see screenshot below)



6. When finished, you can close Local Users and Groups if you like.





OPTION THREE [/i] To Add Users to Groups from Groups folder in Local Users and Groups
*note Local Users and Groups is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Five below.
1. Press the Win+R keys to open Run, type lusrmgr.msc into Run, and click/tap on OK to open Local Users and Groups.

2. Click/tap on Groups in the left pane of Local Users and Groups. (see screenshot below step 3)

3. Right click or press and hold on the group name (ex: "Administrators") you want to add users as members of, and click/tap on Properties. (see screenshot below)



4. Click/tap on the Add button. (see screenshot below)



5. Click/tap on the Advanced button. (see screenshot below)



6. Click/tap on the Find Now button, select the name of the user account (ex: "Brink2") you want to add as a member, and click/tap on OK. (see screenshot below)

*note If you like, you can press and hold the Ctrl key to select more than one user.



7. Click/tap on OK. (see screenshot below)



8. Click/tap on OK. (see screenshot below)



9. When finished, you can close Local Users and Groups if you like.





OPTION FOUR [/i] To Remove Users from Groups from Groups folder in Local Users and Groups
*note Local Users and Groups is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Six below.

1. Press the Win+R keys to open Run, type lusrmgr.msc into Run, and click/tap on OK to open Local Users and Groups.

2. Click/tap on Groups in the left pane of Local Users and Groups. (see screenshot below step 3)

3. Right click or press and hold on the group name (ex: "Administrators") you want to remove users as members of, and click/tap on Properties. (see screenshot below)



4. Select a user name (ex: "Brink2") you want to remove as a member, and click/tap on the Remove button. (see screenshot below)

*note If you like, you can press and hold the Ctrl key to select more than one user.



5. Click/tap on OK. (see screenshot below)



6. When finished, you can close Local Users and Groups if you like.





OPTION FIVE [/i] To Add User to Group in Command Prompt
1. Open an elevated command prompt.

2. Type the command below into the elevated command prompt, and press Enter. (see screenshot below)
*Arrow net localgroup "Group" "User" /add

*note Substitute Group in the command above with the actual name of the group (ex: "Administrators") you want the user to be a member of.

Substitute User in the command above with the actual name of the user account (ex: "Brink2") you want to be a member of the group.

For example: net localgroup "Administrators" "Brink2" /add
3. When finished, you can close the elevated command prompt if you like.









OPTION SIX [/i] To Remove User from Group in Command Prompt
1. Open an elevated command prompt.

2. Type the command below into the elevated command prompt, and press Enter. (see screenshot below)
*Arrow net localgroup "Group" "User" /delete

*note Substitute Group in the command above with the actual name of the group (ex: "Administrators") you want the user to no longer be a member of.

Substitute User in the command above with the actual name of the user account (ex: "Brink2") you want to no longer be a member of the group.

For example: net localgroup "Administrators" "Brink2" /delete
3. When finished, you can close the elevated command prompt if you like.









OPTION SEVEN [/i] To Add User to Group in PowerShell
*note For more Add-LocalGroupMember command options and details, see: Add-LocalGroupMember - Microsoft Docs

1. Open an elevated PowerShell.

2. Type the command below into the elevated PowerShell, and press Enter. (see screenshot below)
*Arrow Add-LocalGroupMember -Group "Group" -Member "User"

*note Substitute Group in the command above with the actual name of the group (ex: "Administrators") you want the user to be a member of.

Substitute User in the command above with the actual name of the user account (ex: "Brink2") you want to be a member of the group.

For example: Add-LocalGroupMember -Group "Administrators" -Member "Brink2"
3. When finished, you can close the elevated PowerShell if you like.









OPTION EIGHT [/i] To Remove User from Group in PowerShell
*note For more Remove-LocalGroupMember command options and details, see: Remove-LocalGroupMember - Microsoft Docs

1. Open an elevated PowerShell.

2. Type the command below into the elevated PowerShell, and press Enter. (see screenshot below)
*Arrow Remove-LocalGroupMember -Group "Group" -Member "User"

*note Substitute Group in the command above with the actual name of the group (ex: "Administrators") you want the user to no longer be a member of.

Substitute User in the command above with the actual name of the user account (ex: "Brink2") you want to no longer be a member of the group.

For example: Remove-LocalGroupMember -Group "Administrators" -Member "Brink2"
3. When finished, you can close the elevated PowerShell if you like.





That's it,
Shawn


Related Tutorials

• How to Add a Local Account or Microsoft Account in Windows 10
• How to Add a Guest Account in Windows 10
• How to Delete a User Account in Windows 10
• How to Enable or Disable User Accounts in Windows 10
• How to Enable or Disable Built-in Elevated Administrator Account in Windows 10
• How to Change Account Type of Users in Windows 10
• How to Check if User is a Local Account or Microsoft Account in Windows 10
• How to Switch to a Local Account from a Microsoft Account in Windows 10
• How to Switch to a Microsoft Account from a Local Account in Windows 10
• How to Determine if Users are an Administrator or Standard User in Windows 10
• How to Change Owner of File, Folder, Drive, or Registry Key in Windows 10
• How to Change User Rights Assignment Security Policy Settings in Windows 10
• How to Add Reset Permissions to Context Menu in Windows
• Enable or Disable Inherited Permissions for Files and Folders in Windows
• How to Add Inherited Permissions Context Menu in Windows
• Change Permissions of File, Folder, Drive, or Registry Key for Users and Groups in Windows 10
• How to Add List Permissions Context Menu in Windows
• How to Backup and Restore Permissions of Files, Folders, or Drives in Windows 10
• How to Add or Remove Remote Desktop Users in Windows
• How to Allow or Prevent Users and Groups to Shut down System in Windows 10
• How to Allow or Prevent Users and Groups to Change Time Zone in Windows 10
• How to Allow or Prevent Users and Groups to Sign in Locally to Windows 10
• How to Deny Users and Groups to Sign in Locally to Windows 10
• How to Allow or Prevent Users and Groups to Log on with Remote Desktop in Windows 10
• How to Deny Users and Groups to Log on with Remote Desktop in Windows 10
• How to Allow or Prevent Users and Groups to Create a Pagefile in Windows 10

:)

 

Show Local users and Groups


Hello Frank, and welcome to Ten Forums.

If you have the Windows 10 Home edition, then it will not have Local Users and Groups (lusrmgr.msc) included in it. It's only available in the Pro and Enterprise editions instead.

If you like, you could use step 3 in OPTION THREE of the tutorial below list users in a group.

https://www.tenforums.com/tutorials/6...a.html#option4

 

Show Local users and Groups

Hey Brink, I was just looking at groups in netplwiz today and I noticed that my user account is just in the Admin group now, it used to be in Users and Admin. I have home, so I can't change it. I don't know how it changed. I guess there's nothing I can do about it. Will it be a problem?
I'm tempted to downgrade to my 8.1 pro and go to 10 pro.

 

NT AUTHORITY\Authenticated Users added to Users group upon every restart

I have a Windows 10 computer that I would only like certain users on a domain to be able to login to. Lets say limit access to only those users in the group named football.

I have added the football group to the Windows users group. The computer is on a domain and I noticed the following two groups both of which I removed from the Windows users group.

• NT AUTHORITY\Authenticated Users
• NT AUTHORITY\Interactive

I have tested that NT AUTHORITY\Authenticated Users is allowing users outside of the football group to login to the computer and this is not wanted.

If I remove both of these groups from the Windows users group then they will reappear upon every restart of the computer. This did not have with Windows 7. This seems to be a security problem???

 

Removing a "hidden" user and user files

Thanks for your patience. I was able with "Net User" to remove the left over user. It no longer appears when I invoke Net User.

Now for the user's folder which remains behind. After performing the series of steps that you suggested, I attempted to delete this folder. The result again was an error message about permission


"Administrators" appears on the list in the list of advanced security.

 

Remove account


I suggest you backup your personalized files first before removing the account.
To delete an account, follow these steps:

1. Press WIN + X keys and click Command Prompt (Admin) from the menu.
2. Type the following command and press Enter. Replace test with the name of your sister's account. Code:
   
   Code:

   net user test /del