Enable or Disable a User Account in Windows 11 and 10

To disable a Windows user account without deleting it, open an elevated Command Prompt and run net user "ACCOUNTNAME" /active:no — this works on every edition of Windows 11 and Windows 10, including Home. To bring it back, run the same command with /active:yes. The account's files, apps, and settings stay exactly where they are; the person just can't sign in until you flip it back on.

What "disabling" an account actually does (and the button that doesn't exist)

Here's the part almost nobody explains before sending you to a command line: Windows does not have one universal "disable this account" switch sitting in Settings. There's a Block button, but it only appears for accounts that are part of a Microsoft Family group — click into Settings > Accounts > Family & other users for a plain local account that was never added to a family group, and you won't find a disable option anywhere on that page. That's not a bug. It's just that Microsoft built account disabling as an administrative feature (Local Users and Groups, Command Prompt, PowerShell), and account blocking as a parental-controls feature (Family Safety) — and the two were never merged into one button for everyone.

Disabling an account is different from deleting it, and different from just removing a password. When you disable an account, Windows keeps the user profile, the files in C:\Users\AccountName, installed per-user app data, and every setting exactly as they were. The account simply can't be used to sign in — it disappears from the lock screen and Start menu's user list, and if someone tries to sign in with its credentials directly, Windows tells them the account is disabled. Nothing is deleted. Nothing is exported. It's reversible in one command, which is exactly why it's the right tool when you want to pause someone's access rather than end it for good.

Ethan puts it more bluntly when Jake asks which method to bookmark: "If you only remember one thing from this whole page, remember net user /active:no. It's the one command that works no matter what edition you're running, and it's the one nobody's tutorial gets wrong."

Method 1: Command Prompt with net user (works on Home, Pro, every edition)

The net user command has one job relevant here: adding, modifying, and displaying information about user accounts on the local computer, including an /active:{yes | no} switch that is the actual on/off control for a local account. It ships with every edition of Windows 11 and Windows 10 — Home included — because it's a Command Prompt utility, not a management console tied to a specific SKU.

1. Open Start and type cmd.
2. Right-click Command Prompt in the results and choose Run as administrator (or press Ctrl+Shift+Enter on the search result), then approve the User Account Control prompt.
3. Confirm the exact account name by typing net user alone and pressing Enter. This lists every local account on the machine — copy the name exactly as it appears, including capitalization and spaces.
4. Disable the account by typing net user "ACCOUNTNAME" /active:no and pressing Enter, replacing ACCOUNTNAME with the real name. Wrap it in quotation marks if the name has a space in it (for example "Jo Ann").
5. Watch for the confirmation — Windows replies "The command completed successfully" with no further prompt.

To reverse it later, run the identical command with /active:yes instead of /active:no. There's no separate "undo" command — it's the same switch in both directions, which is part of why this method is so hard to get wrong.

Method 2: PowerShell with Disable-LocalUser and Enable-LocalUser

PowerShell's Microsoft.PowerShell.LocalAccounts module gives you dedicated cmdlets instead of a flag on a decades-old command. Disable-LocalUser disables a local user account; Enable-LocalUser re-enables one. Functionally they do exactly what net user /active:no does — when an account is disabled, the user can't log on; when it's enabled, they can — but the syntax reads more clearly if you're scripting something or managing several accounts at once.

1. Open Start, type PowerShell, right-click Windows PowerShell, and choose Run as administrator.
2. List local accounts with Get-LocalUser if you need to double-check a name — this also shows an Enabled column of True or False for every account.
3. Disable the target account with Disable-LocalUser -Name "ACCOUNTNAME".
4. Re-enable it later with Enable-LocalUser -Name "ACCOUNTNAME".

Both cmdlets also accept a piped object, so Get-LocalUser Guest | Disable-LocalUser is valid if you'd rather pull the account object first. Note the one hardware caveat that trips people up: this module isn't available in 32-bit PowerShell running on a 64-bit system — if the cmdlet isn't recognized, check you launched the 64-bit PowerShell shortcut, not the x86 one.

​

Method 3: Local Users and Groups — the checkbox, but Pro/Enterprise/Education only

If you'd rather click a checkbox than type a command, lusrmgr.msc (Local Users and Groups) gives you exactly that — an "Account is disabled" box right in the account's Properties dialog. The catch, confirmed repeatedly through Microsoft's own support channels: this snap-in, like Local Group Policy Editor, simply isn't included in Windows 10 or Windows 11 Home. Try to run it there and you'll either get "MMC could not create the snap-in" or a message saying the snap-in can't be used with this edition of Windows.

If you're on Pro, Enterprise, or Education

1. Press Win + R, type lusrmgr.msc, and press Enter.
2. Click Users in the left-hand pane to open the folder.
3. Double-click the account you want to change.
4. Check "Account is disabled" to turn it off, or uncheck the same box to turn it back on.
5. Click Apply, then OK.

This is genuinely a nicer interface than a command line if you're managing several accounts on one machine and want to see their status at a glance — the Users folder lists every local account with columns you can scan, and disabled accounts are visually marked. It just isn't an option if "this feature is not available in this edition of Windows" is the message staring back at you, which is the single most common reason a reader lands on this page in the first place.

Method 4: Settings > Family & other users — only for Microsoft Family members

There is a genuine graphical block/unblock switch in Windows, but it only exists for accounts that belong to your Microsoft Family group — typically a child or another adult you've invited through Family Safety, not a plain second local account you created for a roommate or an employee.

1. Press Win + I to open Settings.
2. Go to Accounts, then Family & other users.
3. Select the family member's name under the Family section (not Other users).
4. Choose Block, then confirm. Their name still shows connected devices, but they can no longer sign in.
5. Choose Allow the same way to reverse it.

Blocking a family member this way doesn't touch their files or their Microsoft account elsewhere — it's a sign-in restriction for that device, and it's reversible from the same screen or from the Microsoft Family Safety website. If the account you're trying to disable shows up under "Other users" instead of under a Family heading, this Block button won't appear for it at all, and that's the exact moment most people end up back at Method 1.

Which method actually fits your situation

Four legitimate methods exist, and exactly one of them works everywhere. Here's how to pick without trial and error:

Windows 10: the same steps, one honest note about support

Every method above is identical on Windows 10 — the net user syntax, the PowerShell cmdlets, the lusrmgr.msc edition restriction, and the Family & other users location in Settings all work the same way. If you followed the Windows 11 steps, you already know the Windows 10 steps.

The one thing worth saying plainly: Windows 10 reached the end of free security updates on October 14, 2025. It still runs, still boots, and account management still works exactly as described here — but if that PC isn't enrolled in Extended Security Updates, it's no longer receiving the monthly security patches that used to close vulnerabilities in exactly the kind of local-account and sign-in code this article covers. If you're managing user accounts on a shared or work computer that's still on Windows 10, it's worth checking whether it's ESU-enrolled or eligible for a Windows 11 upgrade, since the underlying account-management tools you're using today will keep working either way.

Special cases: the built-in Administrator account and the Guest account

Two accounts on every Windows install behave differently from the account you created for yourself, and both are relevant if you're reading this because of a specific one of them.

The built-in Administrator account

Microsoft's own documentation on local accounts is clear: you can't delete or lock out the default Administrator account, but you can rename or disable it — and Windows Setup disables it by default and creates a different local account (the one you signed in as during setup) as the actual administrator. That's a deliberate security choice, not a bug: an unrestricted account with no password by default is a target, so it stays off unless you specifically enable it. It's disabled with the exact same net user Administrator /active:no command, or by unchecking "Account is disabled" in lusrmgr.msc where available. If you disable it and then can't sign into anything else, Microsoft's own troubleshooting documentation notes you can still reach a disabled Administrator account by starting Windows in Safe Mode — being disabled doesn't block Safe Mode sign-in the way it blocks a normal boot.

The Guest account

By default, the Guest account is disabled and has a blank password, according to Microsoft's current local-accounts documentation — you likely don't need to disable it because it already is. If you see it active on a machine you're managing, that means someone enabled it deliberately at some point, and turning it back off is the same net user Guest /active:no command as any other account.

What actually happens after you disable an account

The account disappears from the lock screen and the Start menu's account switcher. Anyone who tries to sign in using its credentials directly — from the "Other user" tile, for instance — gets told the account is disabled and can't reach the desktop. The user's profile folder under C:\Users\ stays exactly where it is, fully intact, with every file, every piece of app data, and every setting untouched. Nothing about disabling an account changes file permissions, deletes anything from OneDrive, or removes the person's Microsoft account from other devices. It's purely a local sign-in gate on that one machine.

If the account was mid-session when you disabled it — actively signed in on that PC through Fast User Switching — Windows does not force it to sign out immediately. The active session continues until that person signs out or the machine restarts; the disable only prevents a fresh sign-in going forward. If you need an immediate cutoff rather than a "can't come back" cutoff, you'll want to sign that session out yourself first.

When it doesn't work: real failure modes and what they mean

Every "it's not working" report on this topic traces back to one of a small number of causes. Match your symptom below:

"net user" says the account doesn't exist

Run net user with no name first to get the exact list. Account names with spaces or apostrophes ("Jo Ann M. Jones") need to be wrapped in quotation marks in the command, and the name has to match exactly, including capitalization in some configurations. If it still won't resolve, check whether the account is actually a Microsoft account rather than a local one — local commands still target the local shadow account it creates, but the display name on-screen and the underlying account name aren't always identical.

lusrmgr.msc won't open, or says the snap-in can't be used with this edition

This is edition-locked out, not broken. Local Users and Groups and Local Group Policy Editor are both withheld from Windows 10 and Windows 11 Home. There's no supported way to unlock the console itself on Home — use Command Prompt or PowerShell instead; both do the identical job.

The account still shows up on the sign-in screen after you disabled it

Give it a full restart, not just a sign-out — the lock screen's list of accounts is sometimes cached until the next boot. If it persists after a restart, re-run net user "ACCOUNTNAME" (no switch) to check the Account active field actually reads No; a typo in the account name during the disable step silently does nothing rather than throwing a clear error.

There's no Block button under Family & other users for the account you want

That confirms the account isn't part of your Microsoft Family group — it's an ordinary local or Microsoft "other user" account. Block/Allow only exists for Family members. Use Method 1 or 2 instead.

You disabled your own account and now nothing signs in

If no other administrator account is enabled, boot into Safe Mode (or Windows Recovery Environment) and re-enable it from an elevated Command Prompt there, using the same /active:yes switch. This is precisely why the warning above exists — always keep a second enabled administrator on any machine you're managing this way.

Edge cases: laptops, domain machines, and remote sessions

Everything above assumes a local account on a standalone machine — the situation almost everyone reading this is actually in. A few setups change the picture:

Domain-joined PCs: if the account in question is a domain account rather than a local one, net user and Disable-LocalUser only manage local accounts on that machine. Domain accounts get disabled centrally through Active Directory by a domain administrator — a local disable command won't touch them at all.

Remote Desktop and always-on machines: disabling an account someone is actively connected to over Remote Desktop behaves the same as a local Fast User Switch session — the current connection isn't forcibly dropped, but a fresh Remote Desktop sign-in attempt afterward will be refused.

Laptops shared between family members: if the account is part of your Family group, Block/Allow in Settings is genuinely the simplest path and needs no elevated Command Prompt at all — reserve Method 1 for accounts that were never added to the family group in the first place.

Windows 11 Home specifically: because Home lacks both Local Group Policy Editor and Local Users and Groups, Home users have exactly two working paths for a non-Family account — Command Prompt or PowerShell. There's no third option hiding in Settings.

Automating it for more than one account

If you're clearing out a batch of old accounts on a shared machine — seasonal staff, a school lab, a family PC accumulating "temp" logins over the years — PowerShell scales better than typing individual commands. A short script can pipe Get-LocalUser results through a filter and disable everything that matches, which is safer than deleting in bulk because you can always reverse a mistaken disable with the matching Enable-LocalUser call, but you can't undo a bulk delete.

For a one-off scheduled disable — say, an account that should stop working after a specific date — Windows doesn't have a native "expire this account on this date" toggle for local accounts the way domain Group Policy can, so the practical approach is a Scheduled Task set to run Disable-LocalUser at the time you want, using an administrator-level scheduled task so it can run with the right permissions even if nobody is signed in at that moment.

The privacy angle before you disable someone else's account

Because disabling doesn't touch files, it's tempting to treat it as harmless and reversible in every sense — technically true, but worth pausing on if the account belongs to someone else and you're not the sole owner of the machine. A disabled account's files remain fully readable by any administrator on that PC, including you. If you're disabling a family member's or employee's account temporarily, it's worth being upfront that you can browse into their user folder while it's disabled, rather than letting them assume "disabled" means "sealed off."

Frequently asked questions

Does disabling a user account delete their files?

No. The profile folder, apps, and settings stay untouched — only sign-in access is blocked.

What's the difference between disabling an account and blocking a Family member?

They achieve the same practical result — the person can't sign in — but Block/Allow in Settings only exists for Microsoft Family group members, while disabling via Command Prompt, PowerShell, or lusrmgr.msc works on any local account.

Can I disable an account without being an administrator?

No. Every method here requires elevated (administrator) permissions, either through an elevated Command Prompt/PowerShell window or an administrator account signed into Settings.

Can I disable the account I'm currently using?

You can technically run the command, but you shouldn't if it's the only enabled administrator account on the machine — you'll lock yourself out until you can reach Safe Mode. Always disable from a different administrator account.

Why doesn't netplwiz have a disable option?

Netplwiz (the User Accounts dialog) manages whether a password is required at sign-in and which group an account belongs to — it was never built with an active/inactive toggle. That toggle only exists in Local Users and Groups, Command Prompt, and PowerShell.

Is Local Users and Groups (lusrmgr.msc) available in Windows 11 Home?

No. It's restricted to Pro, Enterprise, and Education editions, the same restriction Windows applies to Local Group Policy Editor.

How do I re-enable an account I disabled?

Run the same command with the opposite switch: net user "ACCOUNTNAME" /active:yes, or Enable-LocalUser -Name "ACCOUNTNAME" in PowerShell, or uncheck "Account is disabled" in lusrmgr.msc.

Is the Guest account the same thing as any disabled account?

It behaves the same way once disabled, but it's already off by default with a blank password on both Windows 10 and Windows 11 — you generally don't need to do anything to it unless someone previously enabled it.

Can I disable the built-in Administrator account?

Yes, using the same net user or PowerShell commands — and it's disabled by default on a fresh Windows install already, specifically because an unrestricted account with no set password is a security risk.

I disabled the built-in Administrator account and now I can't get back into it — what do I do?

Start Windows in Safe Mode. A disabled Administrator account can still sign in through Safe Mode, which lets you re-enable it normally afterward.

Does disabling an account stop OneDrive or email syncing for that person?

It stops any process from running under that Windows sign-in on that device, including background sync tied to that local session — but it does not touch their Microsoft or email account itself, which remains fully active elsewhere.

Will a disabled account still show up if I type "net user" with no name?

Yes — the plain net user list shows every local account regardless of enabled/disabled status. Run net user "ACCOUNTNAME" to see the specific Account active field.

Can I schedule an account to disable automatically at a certain time?

There's no built-in expiry toggle for local accounts, but you can set a Scheduled Task to run the Disable-LocalUser PowerShell command at whatever time you choose.

What's the safest method on a shared family computer?

If the account belongs to your Microsoft Family group, Block/Allow in Settings needs no command line and is the simplest option. For anything outside the Family group, net user is the most dependable fallback.

Does disabling an account log the active session out immediately?

No — an already-active session (through Fast User Switching or Remote Desktop) continues until the person signs out or the PC restarts. The disable only blocks future sign-in attempts.

Revision note. Written September 2026, covering current Windows 11 (including 25H2) and Windows 10 builds across Home, Pro, Enterprise, and Education editions. This will need a second look if Microsoft ever folds account disabling into Settings for non-Family accounts — until then, the command-line route remains the one steady path. If you've been going in circles looking for a checkbox that Home simply doesn't have, hopefully this saves you the rest of that afternoon.