Is it a Virus?
✔ NO - Safe
Must be located at C:\Windows\System32\lusrmgr.msc (or opened via mmc.exe)
Warning
MMC Snap-Ins can spawn host processes
mmc.exe hosts the lusrmgr.msc snap-in; multiple console instances may appear during admin tasks
Can I Disable?
✔ YES
Close the MMC window or restrict access to administrators only; built-in tool cannot be uninstalled
What is lusrmgr.msc?
lusrmgr.msc is the Local Users and Groups Manager, a Windows administrative snap-in used to create, modify, or delete local user accounts and security groups. It runs inside the Microsoft Management Console (MMC) host and is typically accessed by IT admins to configure local identities and memberships.
This MMC-based tool edits local accounts and groups by updating the Security Accounts Manager (SAM) database. When changes are saved, the console applies them to local security settings and memberships, sometimes requiring a logoff for changes to take full effect.
Quick Fact: lusrmgr.msc is part of the Windows Admin Tools and is the primary GUI for local account administration on Windows Pro/Enterprise editions.
Types of lusrmgr Processes
- MMC Host Process (mmc.exe): Container that loads the Local Users and Groups snap-in
- lusrmgr.msc Snap-in UI: GUI for creating and managing local users and groups
- User Accounts Management: Operations to reset passwords, unlock accounts, and configure local permissions
- Group Management: Manage local group memberships and permissions
- Policy Interaction (Local): Applies local policy changes related to user rights and restrictions
Is lusrmgr.msc Safe?
Yes, lusrmgr.msc is safe when used from a legitimate Windows installation (C:\Windows\System32\lusrmgr.msc) or opened via a trusted MMC host.
Is lusrmgr.msc a Virus or Malware?
The real lusrmgr.msc is NOT a virus. Malware may disguise itself with similar names, so verify location and digital signature.
How to Tell if lusrmgr.msc is Legitimate or Malware
- File Location: Must be in
C:\Windows\System32\lusrmgr.msc (or C:\Windows\SysWOW64\lusrmgr.msc on 32-bit/WOW64 systems). Any other path is suspicious.
- Digital Signature: Right-click the file -> Properties -> Digital Signatures. Should show a valid Microsoft signature, e.g.,
Microsoft Corporation.
- Resource Usage: Normal usage is light (MMC host), not continuous 100% CPU. Unusual spikes with no admin action warrant review.
- Behavior: Should only run when opened by an administrator. Unexpected background launches indicate potential tampering.
Red Flags: If lusrmgr.msc is located outside System32 (e.g., Temp, AppData), has no valid signature, or runs without an MMC host, scan with antivirus and verify Windows Integrity.
Why Is lusrmgr.msc Running on My PC?
lusrmgr.msc runs when an administrator opens the Local Users and Groups Snap-In to manage accounts or when a script or admin task loads the MMC console for user/group configuration.
Reasons it's running:
- Administrative task opened: An admin opened the Local Users and Groups tool to create, modify, or remove accounts and group memberships.
- Local group policy and rights edits: Changes to local security policies or user rights assignments may trigger the need to configure accounts and groups.
- Scripting or remote management: Automated admin tasks or remote management sessions may launch the MMC console to perform user/group updates.
- System maintenance: During maintenance windows, administrators review or adjust access controls and permissions.
- Policy auditing and review: Auditors or admins periodically review local accounts and group memberships for compliance.
Can I Disable or Remove lusrmgr.msc?
Yes, you can restrict access to lusrmgr.msc. It is a built-in admin tool and cannot be fully uninstalled, but you can limit who can run it.
How to Stop lusrmgr.msc
- Block via AppLocker: Create a rule to deny execution of lusrmgr.msc for non-admin or non-designated users.
- Restrict via Group Policy: Policy: User Configuration -> Administrative Templates -> System -> Don't run specified Windows applications; add lusrmgr.msc
- Hide Administrative Tools: Remove access to Administrative Tools from non-admin accounts via user restrictions.
- Limit MMC hosting: Configure AppLocker/WDAC to only allow mmc.exe as needed and prevent local snap-ins without authorization.
- Audit access attempts: Enable auditing to monitor when lusrmgr.msc is opened or attempted by standard users.
How to Remove or Disable lusrmgr.msc (Local Users and Groups)
- ✔ There is no separate uninstall for lusrmgr.msc because it is a built-in Windows MMC snap-in.
- ✔ Use AppLocker or WDAC to block non-admin users from running lusrmgr.msc.
- ✔ Restrict access to Administrative Tools or upgrade to an edition that supports stricter account control (e.g., Windows Pro/Enterprise).
Common Problems: Local Users and Groups Issues
If lusrmgr.msc or its MMC host has problems, try these common causes and solutions to restore正常 operations.
Common Causes & Solutions
- Cannot open the Local Users and Groups console: Run as Administrator or ensure the user has administrative privileges; verify path C:\Windows\System32\lusrmgr.msc
- Access denied when editing accounts: Use an administrator account; check group membership and user rights; verify UAC settings
- Group memberships not applying: Close and re-open the console, log off and back on, or restart the system to refresh token caches
- MMC snap-in crashes or freezes: Update Windows, run System File Checker (sfc /scannow), and check for corrupt MMC or snap-in DLLs
- Cannot see all local accounts or groups: Ensure you are not filtering results; show hidden accounts if needed and verify that the SAM database is accessible
- Tool not available on Windows Home: lusrmgr.msc is not included in Windows Home editions; upgrade to Windows Pro/Enterprise or use alternative management methods
Quick Fixes:
1. Run lusrmgr.msc as Administrator to validate permissions
2. Verify the file location: C:\Windows\System32\lusrmgr.msc
3. Restart the MMC host or log off/log back on after changes
4. Check for Windows updates and apply security patches
5. If issues persist, use a system file check (sfc /scannow) and DISM to repair corrupt files
Frequently Asked Questions
Is lusrmgr.msc safe to use?
Yes. It is a built-in Windows MMC snap-in for local user and group management. Use with administrator privileges and verify the file path C:\Windows\System32\lusrmgr.msc.
What can I do if lusrmgr.msc won't open?
Run as Administrator, check that the Windows edition supports it (Pro/Enterprise), verify the path, and check for corrupted system files with sfc /scannow.
Can I run lusrmgr.msc on Windows Home?
No. lusrmgr.msc is not available on most Windows Home editions; upgrade to Windows Pro/Enterprise or use alternate local user management methods.
How do I add a user with admin rights using lusrmgr.msc?
Open lusrmgr.msc, create a new user under Users, then assign the user to the Administrators group via Group Memberships; ensure you are an administrator when performing this action.
Can I export or backup local users/groups from lusrmgr.msc?
lusrmgr.msc itself does not provide a direct export feature. Use PowerShell commands (e.g., Get-LocalUser, Get-LocalGroup) and export results, or script management tasks for backup.
Why do some accounts or groups disappear in lusrmgr.msc?
Accounts may be filtered or hidden due to permissions, scope (local vs domain), or corruption in the SAM database. Verify the correct scope and run integrity checks on Windows.