Disable a stale account and remove its local admin rights
On a canned Windows workstation, list the Administrators group to confirm the stale account tcontractor is a member, disable it with net user /active:no (reversible, not a delete), remove it from the Administrators group, and verify by reading net user tcontractor that Account active is No and Local Group Memberships no longer lists Administrators. Disabling and removing local admin is local account containment on this machine; it is NOT full deprovisioning, because the user's mailbox, tokens or sessions, and access on other systems persist until the offboarding process revokes them. Do not claim this canned account or machine is real. This page teaches a job procedure. These are not exam questions, this is not a score predictor, and nothing here is taken from any certification exam.
Steps
- 1
Run net localgroup Administrators. Confirm the members include tcontractor (a stale account that should not have local admin).
- 2
Run net user tcontractor /active:no. The command completes; the account is disabled (reversible, not deleted).
- 3
Run net localgroup Administrators tcontractor /delete. The command completes; the account loses local admin.
- 4
Run net user tcontractor. Confirm Account active No and Local Group Memberships no longer lists Administrators.
What you should see
net localgroup Administrators showed tcontractor as a member; after disabling and removing the membership, net user tcontractor shows Account active No and Local Group Memberships without Administrators. The account is contained on this machine, not fully deprovisioned.