net Command

The built-in Windows net command, grouped by task, with examples and the SOC angle on each. Click any command to copy it.

Accounts

Users

net userList local user accounts on this host.
net user jsmithDetails for one account — group membership, last logon, password-set date, whether it's active.
net user jsmith /domainThe same, but for a domain account (queried from the DC).
net user administratorInspect the built-in admin — enabled state and last logon are both worth noting.
net user /domainEnumerate all domain accounts. A burst of this from a workstation is recon, not admin work.
net user svc_backup /active:noDisable an account — the defender's version, to lock out a compromised user quickly.
net user jsmith * /domainPrompt to reset a domain user's password (the * hides input). Part of containment after a compromise.

Membership

Groups

net localgroupList local groups on the host.
net localgroup administratorsWho is a local admin here. Should be short and known — an unexpected name is a lead.
net localgroup "Remote Desktop Users"Who can RDP in. Quote group names that contain spaces.
net group /domainList domain groups (run against the DC).
net group "Domain Admins" /domainMembers of Domain Admins — the crown-jewels group. Enumeration of this is a classic recon step.
net group "Domain Controllers" /domainLists the DCs in the domain.
net group "Enterprise Admins" /domainForest-wide admins — even more sensitive than Domain Admins.

Connections

Sessions & shares

net sessionWho is connected to this host over SMB right now, and from which IP. Great for spotting who's reaching a server.
net useCurrent drive mappings and connections from this host to others.
net use \\SRV01\shareConnect to a remote share. Repeated connections across many hosts can indicate lateral movement.
net use * /deleteDrop all current connections — useful when cleaning up after an incident.
net shareShares this host is offering, including hidden admin shares (C$, ADMIN$, IPC$).
net view \\SRV01List the shares a remote host exposes — where an attacker looks for data.
net view /domainBrowse machines in the domain. Broad host discovery in one command.

Discovery

Host & network info

net config workstationThis host's name, domain, and logged-on user — quick orientation on an unfamiliar box.
net config serverServer-service settings and the host's role.
net statistics workstationWorkstation service stats since boot — sessions, bytes, and the last boot time.
net statistics serverServer-side counters — logon failures and permission errors show here.
net time \\SRV01Read a host's clock. Also a cheap way to find a domain controller.
net time /domainThe domain time source — i.e. the authoritative DC.
net viewBrowse reachable hosts on the network.

Services

Services

net startList the services currently running — a fast inventory with no arguments.
net start SpoolerStart a service by name.
net stop SpoolerStop a service. Attackers stop AV/EDR or backup services before acting — a stopped security service is a red flag.
net stop "Windows Defender Antivirus Service"Quote service display names with spaces. Watch for defenses being stopped just before other activity.

Policy

Accounts & policy

net accountsLocal password and lockout policy — min length, max age, lockout threshold.
net accounts /domainThe domain's account policy. Useful context before assessing a brute-force or spray.
net localgroup administrators /add jsmithAdd a user to local admins — the admin action, and also a common privilege-escalation step to alert on. Generates event 4732.
net user newsvc /addCreate a local account — legitimate provisioning, and also a persistence move. Generates event 4720; watch off-hours or on workstations.
net user jsmith /deleteRemove an account — cleanup, or an attacker erasing a created account (event 4726).

Defender's view

Detection notes

Because net is everywhere in normal admin work, hunt on sequence and context, not the single command.

net group "Domain Admins" /domain → net user … /domainRecon chains: group enumeration followed by user enumeration from a non-admin workstation is the reconnaissance fingerprint.
net1 user … / net1 localgroup …Watch net1.exe as well as net.exe — malware uses the child binary to slip past detections that only match "net".
4688 CommandLine contains 'net'Process-creation logging (with command line) is where you catch this. Cross-reference with 4720 / 4732 / 4726 for the account changes it makes.
net session / net use \\… across many hostsOne account touching share after share in a short window is lateral movement, not a user mapping a drive.
net stop <security service>Defense evasion — a stopped AV/EDR/backup service immediately before other activity is high-signal.

Related: the account changes these commands make land in the Windows Event IDs sheet (4720, 4726, 4728, 4732), and net lateral movement rides the ports on the Port Numbers sheet (445, 139, 135).