Windows Security · 2.2

👥 Account Management

Who should exist, who shouldn't, and who's an admin⏱ ~3 min

One of the highest-scoring areas in CyberPatriot is account management. The scenario will tell you which users are authorized — everyone else should be removed.

Account Types

Account Type	Description	Competition Risk If Mismanaged
Administrator	Full control — can change security settings, install software, access all files	Too many admins = vulnerabilities; remove unauthorized admins
Standard User	Normal daily tasks; cannot change system settings	Correct for most users
Guest	Minimal permissions, no password by default	Must be disabled — it's always a vulnerability
Built-in Administrator	Hidden default admin account on all Windows installs	Rename it, give it a strong password, and restrict use

Opening Local Users and Groups

powershell

# Fastest: Win+R → type:
lusrmgr.msc
 
# Or via command line:
net user                          # list all users
net user USERNAME                 # details about one user
net localgroup Administrators     # list admins

Competition Checklist — Accounts

•Remove unauthorized users — compare user list to the scenario's authorized users list
•Remove unauthorized admins — check Administrators group; only IT staff should be admins
•Disable the Guest account — right-click Guest → Properties → check 'Account is disabled'
•Rename the built-in Administrator — right-click Administrator → Rename → pick something non-obvious
•Set passwords for all accounts — right-click user → Set Password; no blank passwords allowed
•Enable accounts that should be active — uncheck 'Account is disabled' for authorized users

Command Line Alternative (faster in competition)

cmd

# Add a user
net user USERNAME PASSWORD /add
 
# Delete a user
net user USERNAME /delete
 
# Remove someone from Administrators group
net localgroup administrators USERNAME /delete
 
# Disable the Guest account
net user Guest /active:no
 
# List all accounts and their status
net user

⚠ WarningAlways check the scenario description before deleting users. Deleting an authorized user is a penalty. When in doubt, disable the account instead of deleting it.

🧠Quick Checkfirst try = +5 XP

What should you always do with the Guest account?

🎮 Practice what you learned

🏰

Password Fort

Build passwords that survive a brute-force siege

→🕵️

Log Analysis

Hunt attackers through real firewall & access logs

→

⭐ 0 XP🔥 0 days

Open the full interactive CyberPatriot Prep module →