[SourApples]

Windows Hidden User Creator

Basic Information

This is a very basic batch file that creates a hidden user.

Download

[mothered]

This is a very basic batch file that creates a hidden user.

So once It's hidden, can the change be reversed?

[DrKrieger]

My 2 cents ...
Line 10 in the script seems to do the actual 'magic'
It adds the new user to a special list in the registry. So by removing the entry from the list the change can be reversed.

[ConcernedCitizen]

Cool, you're adding a registry key to "persist" a hidden user.
See how fast any NGAV like Falcon stops this.

So once It's hidden, can the change be reversed?

Yes.

1. Win+R, "cmd.exe" `net user <user> /delete`
2. Then Win+R, "regedit" & remove the user entry in the registry: "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" outlined in the batch script.

[mothered]

Yes.

1. Win+R, "cmd.exe" `net user <user> /delete`
2. Then Win+R, "regedit" & remove the user entry in the registry: "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" outlined in the batch script.

Nice one.

I assume a reboot will be required after removing the entry In the registry?

[radixtenshi]

interesting to apply as part of a more complex chain of modifications.

[mothered]

Further to my post above, I can confirm that a reboot will be required after the change Is reversed.