Manage accounts and credentials on Windows VMs

Windows

By default, Windows virtual machine (VM) instances authenticate by using ausername and a password instead of by using SSH. If you don'tenable SSH for Windows, you must generatenew credentials before connecting to the VM. This document describes how togenerate credentials and manage accounts on Windows VMs.

You can also use this process to generate new credentials if you no longer havethe original credentials. If you use this process to generate new credentialsfor existing users, any data that is encrypted with the current credentials,such as encrypted files or stored passwords, might not be retained.

Caution: If the VM is running an Active Directory domain controller, generatingnew credentials can cause the password of an existing domain user to be reset ora new domain user to be created. To prevent credential generation,disable the account manager.

Accounts disabled by default

The following accounts are built-in to Windows Server and are disabled bydefault:

  • Administrator
  • Guest
  • DefaultAccount
  • WDAGUtilityAccount

For these accounts, the Windows guest agent can reset the credentials. Resettingthe credentials won't do the following:

  • Enable a disabled built-in account
  • Set additional policies so that the user can sign in to the VM

The built-in accounts are not guaranteed to have the default names because thelocal security policy, which is used by many organizations, can rename theaccounts. If the accounts were renamed, you can use the original names.

Caution: For credential management features to work correctly, you must useEnglish for key account and group names, such asAdministrator andAdministrators. The system relies on these specific English names to identifyand manage credentials. Using non-English names for these accounts or groups cancause actions such as generating or resetting passwords to fail.

Before you begin

Required roles

To get the permissions that you need to generate credentials for Windows Server VMs, ask your administrator to grant you the following IAM roles:

For more information about granting roles, seeManage access to projects, folders, and organizations.

You might also be able to get the required permissions throughcustom roles or otherpredefined roles.

Generate credentials

Generate credentials for Windows Server VMs by using the Google Cloud console or theGoogle Cloud CLI.

Note: Before you can generate credentials for VMs that you imported toCompute Engine, you mustenable the COM4 port in the Windows Device Manager.

Console

  1. Go to theVM instances page.

    Go to VM instances

  2. Click the Windows Server VM to change the password on.

  3. On theVM instance details page, inRemote access, clickSetWindows password.

  4. In theUsername field, enter the username to change the password for,or enter a new username to create a new user.

  5. ClickSet.

gcloud

  1. Run the followinggcloud compute reset-windows-password command:

    gcloud compute reset-windows-passwordVM_NAME

    ReplaceVM_NAME with the name of the VM to change thepassword for.

  2. Review the information in the confirmation prompt:

    This command creates an account and sets an initial password for theuser [username] if the account does not already exist.If the account already exists, resetting the password can cause theLOSS OF ENCRYPTED DATA secured with the current password, includingfiles and stored passwords.For more information, see:https://cloud.google.com/compute/docs/operating-systems/windows#resetWould you like to set or reset the password for [username] (Y/n)?

  3. After confirming the previous prompt, review the confirmation of newcredentials, which appears as follows:

    Resetting and retrieving password for [username] on [instance-name]Updated [https://www.googleapis.com/compute/v1/projects/project-name/zones/zone/instances/instance-name].ip_address:ip-addresspassword:passwordusername:username

  4. You can nowconnect to the instanceby using the new credentials.

Change your password

After youconnect to your Windows ServerVM, you can use the WindowsCommand Prompt or the Windows user interface to change your password.

Command Prompt

Use thenet usercommand to change the password.

Windows Server 2016

  1. After the desktop finishes loading, click theStart menu icon.

  2. ClickControl Panel.

  3. Under theUser Accounts icon, click eitherChange Account Type orAdd or remove user accounts.

  4. Select the account that you want to modify.

  5. ClickChange the password.

  6. Enter your current password and your new password.

  7. ClickChange password to save your changes.

Windows Server 2019

  1. After the desktop finishes loading, click theStart menu icon.

  2. ClickSettings.

  3. ClickAccounts.

  4. ClickSign-in options.

  5. UnderPassword, clickChange.

  6. Enter your current password and clickNext.

  7. Enter your new password in theNew password field and enter it againin theRe-enter password field.

  8. Enter aPassword hint, and clickNext.

  9. ClickFinish.

Windows Server 2022

  1. After the desktop finishes loading, click theStart menu icon.

  2. ClickSettings.

  3. ClickAccounts.

  4. ClickSign-in options.

  5. ClickPassword and clickChange.

  6. Enter your current password and clickNext.

  7. Enter your new password in theNew password field and enter it againin theConfirm password field.

  8. Enter aPassword hint, and clickNext.

  9. ClickFinish.

Create a local user account

Command Prompt

Use thenet userto create a new user.

Example:

   net userUSERNAMEPASSWORD /add

ReplaceUSERNAME with your username andPASSWORD with your password of choice.

Windows Server 2016

  1. After the desktop finishes loading, click theStart menu icon.

  2. ClickControl Panel.

  3. Under theUser Accounts icon, click eitherChange Account Type orAdd or remove user accounts.

  4. ClickAdd a user account.

  5. Set the username, password and password hint, then clickNext.

  6. After an account is created clickFinish.

Windows Server 2019

  1. After the desktop finishes loading, click theStart menu icon.

  2. ClickSettings.

  3. ClickAccounts.

  4. ClickOther users, thenAdd someone else on this PC.

  5. Skip all the Microsoft account related steps and clickAdd a user without a Microsoft account.

  6. Set the username, password and password hint, then clickNext.

Windows Server 2022

  1. After the desktop finishes loading, click theStart menu icon.

  2. ClickSettings.

  3. ClickAccounts.

  4. ClickOther users, thenAdd someone else on this PC.

  5. Skip all the Microsoft account related steps and clickAdd a user without a Microsoft account.

  6. Set the username, password and password hint, then clickNext.

Grant local users Administrator privileges

Adding a local account to the Administrator group will give you administrativeprivileges on your Windows VM. See more information onLocal Accounts.

Caution: For credential management features to work correctly, you must useEnglish for key account and group names, such asAdministrator andAdministrators. The system relies on these specific English names to identifyand manage credentials. Using non-English names for these accounts or groups cancause actions such as generating or resetting passwords to fail.

Command Prompt

Use thenet localgroupto add a user to the Administrator group.

Example:

   net localgroup administratorsUSERNAME /add

ReplaceUSERNAME with the username of choice.

Note: Replace/add with/delete if you want to remove a user from thelocal administrator group.

Windows Server 2016

  1. After the desktop finishes loading, click theStart menu icon.

  2. ClickControl Panel.

  3. Under theUser Accounts icon, click eitherChange Account Type orAdd or remove user accounts.

  4. Select the account that you want to change.

  5. ClickChange the account type.

  6. SelectAdministrator and confirm by clickingChange Account Type.

Windows Server 2019

  1. After the desktop finishes loading, click theStart menu icon.

  2. ClickSettings.

  3. ClickAccounts.

  4. ClickOther users then click the account that you want to change.

  5. ClickChange account type.

  6. From the drop-down, select theAdministrator account type and clickOK.

Windows Server 2022

  1. After the desktop finishes loading, click theStart menu icon.

  2. ClickSettings.

  3. ClickAccounts.

  4. ClickOther users then click the account that you want to change.

  5. ClickChange account type.

  6. From the drop-down, select theAdministrator account type and clickOK.

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-12-15 UTC.