How to Audit Windows User Accounts and Stop Unauthorized Access

Why Windows User Account Security Is Often Overlooked

Most Windows users focus on antivirus software and firewalls when thinking about PC security — and those are important. But one of the most common entry points for attackers is something far simpler: weak or unmonitored user accounts. Old accounts left over from previous users, built-in accounts with default passwords, and accounts with excessive privileges can all give an attacker a foothold on your system.

This guide walks you through a complete Windows user account audit — finding every account on your PC, reviewing its permissions, and locking down anything that shouldn't be there. Running DiagnoseMyPc alongside these steps gives you an even clearer picture of your system's security posture.

Step 1: List Every User Account on Your PC

Before you can secure your accounts, you need to know what exists. Open a Command Prompt or PowerShell window as Administrator and run:

net user

This lists all local user accounts on the machine. You may be surprised to find accounts you didn't create — especially on older PCs or machines that have been used by multiple people.

For more detail on each account, run:

net user <username>

Replace <username> with any account name from the list. This shows the account's last logon date, password expiry, group memberships, and whether the account is currently active.

Check for Hidden and Built-In Accounts

Windows includes several built-in accounts that are often forgotten:

To see all accounts including hidden ones, use:

Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordLastSet

Run this in PowerShell (as Administrator). The Enabled column tells you which accounts are active.

Step 2: Review Group Memberships and Privileges

Not all accounts are equal. Accounts in the Administrators group have full control over your PC — they can install software, change system settings, and access all files. Standard users have far more limited access.

To see which accounts have administrator privileges, run:

net localgroup administrators

If you see accounts in this list that shouldn't have admin rights, that's a serious security risk. Limit administrator access to only the accounts that genuinely need it.

Principle of Least Privilege

A core security principle is least privilege: every account should have only the permissions it needs to do its job — nothing more. For day-to-day use, consider running as a Standard User and only elevating to admin when necessary. This limits the damage malware can do if it compromises your session.

To change an account's type in Windows 11/10:

Step 3: Disable or Delete Accounts You Don't Need

Every active account is a potential attack surface. If an account isn't being used, disable or delete it.

Disable an Account (Recommended Over Deleting)

Disabling preserves the account's files and settings while preventing login:

net user <username> /active:no

To re-enable it later:

net user <username> /active:yes

Delete an Account

If you're certain an account is no longer needed:

net user <username> /delete

Warning: Deleting an account permanently removes its profile and files. Always back up important data first.

Disable the Built-In Administrator Account

If the built-in Administrator account is enabled and you don't need it, disable it:

net user administrator /active:no

This closes a common attack vector that malware and ransomware frequently target.

Step 4: Enforce Strong Password Policies

Weak passwords are an open invitation. Windows lets you enforce password requirements through Local Security Policy (available on Windows Pro and Enterprise editions).

Open Local Security Policy by pressing Win + R, typing secpol.msc, and pressing Enter. Navigate to:

Account Policies → Password Policy

Key settings to configure:

For Windows Home users who don't have secpol.msc, you can set a minimum password length via the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SAM

However, using a password manager and setting strong passwords manually is the most practical approach for Home users.

Step 5: Enable and Review Windows Login Audit Logs

Windows can log every successful and failed login attempt — invaluable for detecting unauthorized access.

To enable logon auditing (Pro/Enterprise):

To view the logs, open Event Viewer (eventvwr.msc) and navigate to:

Windows Logs → Security

Filter for Event ID 4625 (failed logon) to spot brute-force attempts, and Event ID 4624 (successful logon) to verify only expected accounts are logging in.

Step 6: Check for Remote Access and Network Accounts

If your PC is connected to a domain or has Remote Desktop enabled, additional accounts may have access that don't appear in the local user list.

To check if Remote Desktop is enabled:

Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections

A value of 0 means Remote Desktop is enabled. If you don't need it, disable it:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 1

Also check which accounts are in the Remote Desktop Users group:

net localgroup "Remote Desktop Users"

Remove any accounts that shouldn't have remote access.

Using DiagnoseMyPc to Spot Account-Related Security Issues

DiagnoseMyPc scans your system and flags security misconfigurations — including issues related to user accounts, privilege escalation risks, and exposed system settings. Running a diagnostic gives you a structured report of vulnerabilities you might miss during a manual audit, with clear guidance on how to fix each one.

After completing your manual account audit, run DiagnoseMyPc to catch anything you may have overlooked and to verify that your changes have taken effect. It's a fast, reliable way to confirm your PC's security baseline.

Take Control of Your PC's Security Today

User account hygiene is one of the most effective — and most underused — security measures available to Windows users. By auditing your accounts, removing unnecessary privileges, and enforcing strong passwords, you dramatically reduce your attack surface without spending a penny.

Ready to go further? Try DiagnoseMyPc for free and get a comprehensive security and performance report in minutes. It's the fastest way to find hidden vulnerabilities and get actionable steps to fix them before attackers do.