There have been questions like this, where people ask to do the impossible of letting a non-Administrator user make an Administrator account.

But my question is a bit different: Is it possible for a non-administrator user to create another non-administrator user?

In my ideal setup, I would want one Administrator account, one non-admin "Manager" account that can create other non-admin accounts, and then various other non-admin accounts that do not have the permission to create new accounts. (I have done searching on Google, but can't seem to come up with the right combination of words to search for, because the only results I get are people trying to make themselves administrator, or create admin accounts.)

Is this possible? Thank you.

Edit 1: There is a domain user on the machine, but I didn't think that this would affect a local user's ability to create another local user. phi's answer is still useful, because a full solution would require both a solution for the "Manager" account being an AD account, and a solution for Manager being a local account. I will try to find where those AD options are, and hopefully be able to say if it helps.

  • Are you sure, that a user by default doesn't already have the ability to create new users? If you are on a AD domain that is indeed task that should be reserved for only Administrators. On the local machine, creating a non-Administrator user, isn't an elevated task. – Ramhound Nov 29 '17 at 19:14
  • @Ramhound Maybe this explanation will help clarify: One of the user accounts is on an AD domain, and can run as Administrator, but that shouldn't matter because I created a machine-local, non-AD, non-Administrator account. Then, running under that account, I have tried both adding another account via compmgmt.msc (System Tools -> Local Users and Groups -> Users), and by using the net command (net user /add the_user the_pass). Both give "Access is Denied". I feel like there's some vital piece of information I'm ignorant of. – Talset Nov 29 '17 at 19:29
  • The machine being connected to an AD domain is vital information. – Ramhound Nov 29 '17 at 20:01
  • Even though the account I am currently logged in to is a local non-admin? Mea culpa, I didn't realize. – Talset Nov 29 '17 at 20:14

With an Active Directory setup, you could just give people permissions to create accounts. They usually are able to log in, but have no further permission if the Manager has no permission to edit the Administrators group, the contained groups and the group policies.

Without AD, you might need some kind of windows service that does this for the manager (due to the lack of setuid/sudo functionality on windows.)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.