How to Audit User Accounts on Your Windows PC

    List every account on the PC, check who is an administrator, and spot accounts created by malware or remote attackers.

    JDCS
    By Jordan Dickson · Reviewed by CSG Security Engineers

    Updated June 2026 · 1 min read

    Step 1: Use Settings

    Settings → Accounts → Other users shows accounts other than your own.
    Click each one and note the type — Administrator or Standard User.

    Good to know

    Settings hides some built-in accounts. Use steps 2–3 for a complete list.

    Step 2: Use Local Users and Groups

    Press Win + R, type lusrmgr.msc and press Enter. (Windows Home users will need to use step 3 instead.)
    Click Users to see every local account, including hidden ones like DefaultAccount and WDAGUtilityAccount, which are normal.
    Click GroupsAdministrators to see exactly who has admin rights.

    Step 3: Use Command Prompt (works on every edition)

    Press Win, type cmd, right-click → Run as administrator.
    Type net user and press Enter — that lists every account.
    Type net localgroup administrators — that shows only admins.

    Step 4: Look for red flags

    Names you do not recognise, or close-but-not-quite copies of your name (e.g. Admin1, UserService, your name with an extra letter).
    Accounts in the Administrators group that you did not create.
    Accounts created in the last 30 days you cannot explain.

    Good to know

    Built-in accounts that are normal: Administrator (disabled by default), Guest (disabled), DefaultAccount, WDAGUtilityAccount. Anything else is yours to verify.

    Was this guide helpful?

    Know someone who needs this? Send them the guide.

    JD

    Written by

    Jordan Dickson

    Founder, CyberSecurityGuides

    Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.

    Reviewed by CSG Security Engineers

    More from Device Security