Remove Local User Account in Windows

Objective

To explain how to successfully remove a local user account on 64-bit Windows operating systems using an Automox Worklet.

Problem / Issue

By default, the Automox Agent executes PowerShell scripts in a 32-bit process (x86). When attempting to manage or remove local user accounts using standard PowerShell cmdlets (like Remove-LocalUser), the script fails because the Microsoft.PowerShell.LocalAccounts module is only available in 64-bit PowerShell.

Solution

To resolve this issue, the Worklet script must bypass the 32-bit execution environment by calling native 64-bit PowerShell (sysnative) with flags to run non-interactively in the background, executing the commands within a scriptblock.

Worklet Code Snippet

Incorporate the following code into your Remediation Script:

# Define the 64-bit scriptblock
$scriptblock = {
    Import-Module Microsoft.PowerShell.LocalAccounts
    Import-Module Microsoft.PowerShell.Logging
    
    $username = 'localaccount'
    
    if (Get-LocalUser -Name $username -ErrorAction SilentlyContinue) {
        Write-Log "Attempting to remove local user account $username"
        Remove-LocalUser -Name $username
        Write-Log "Successfully removed local user account $username"
    } else {
        Write-Error "The local user account $username does not exist"
    }
}

# Execute the scriptblock using 64-bit PowerShell (Sysnative)
& "$env:SystemRoot\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -NonInteractive -Command $scriptblock

Key Notes & Considerations

• Target Username: Replace 'localaccount' in the $username variable with the specific local account name you intend to remove.

• Execution Parameters Breakdown:

  • -ExecutionPolicy Bypass: Allows the scriptblock to run regardless of the local machine policy.

  • -WindowStyle Hidden: Prevents a console window from popping up on the user's desktop.

  • -NoProfile: Prevents loading user profiles, making execution faster and avoiding profile-related errors.

  • -NonInteractive: Ensures the script will not wait or prompt for user interaction.

• Why Sysnative? Using $env:SystemRoot\sysnative instructs Windows WOW64 redirection to call the native 64-bit System32 binaries rather than defaulting to the 32-bit SysWOW64 path.