See Your Current Windows Logon Groups

Updated 7 November 2026 · Standard formula, shown below

This guide shows you how to list the security groups your current Windows logon session belongs to. You’ll see both the groups assigned directly to your user account and those inherited through domain or local group membership. No administrative rights are required for the basic methods, though some details (like nested groups) may need elevated access.

What You’ll Need

A Windows PC (Windows 10 or 11 recommended, but works on older versions).
Your user account must be logged on (you’re already using it).
For domain accounts: access to a domain-joined computer or the ability to run a command with your domain credentials.
Optional: PowerShell or Command Prompt (both come with Windows).

Step-by-Step

Open Command Prompt or PowerShell.
- Press Win + R, type cmd or powershell, and press Enter.
- Or search for “Command Prompt” or “PowerShell” in the Start menu and click it.
Run the whoami /groups command.
- Type whoami /groups and press Enter.
- You’ll see a table with columns: Group Name, SID, Attributes, and (if applicable) a “Mandatory” label.
- The “Group Name” column lists all groups your current token includes, such as Everyone, BUILTIN\Users, and your domain groups.
Interpret the output.
- Groups with “Mandatory” in the Attributes column are always present (e.g., Everyone).
- Groups with “Enabled by default” are active.
- Groups with “Enabled group” are active but not necessarily used for access checks (e.g., Everyone).
- Groups with “Group used for deny only” are used only to deny access.
For a cleaner list (optional).
- If you want just the group names, use: whoami /groups | findstr /i "group" (in cmd) or whoami /groups | Select-String -Pattern "Group" (in PowerShell).
- This filters out the header and SID columns.
Check your user account’s group memberships (alternative).
- Open Command Prompt as your normal user and type: net user %username%.
- Look for the “Local Group Memberships” and “Global Group memberships” lines. These show groups assigned directly to your account, but not inherited groups.
- This method is less complete than whoami /groups because it doesn’t show groups from the local computer’s built-in groups or domain groups that are applied via “Domain Users” etc.
Use PowerShell’s Get-ADPrincipalGroupMembership (domain accounts only).
- If your computer is domain-joined and you have the Active Directory module, run: Get-ADPrincipalGroupMembership $env:USERNAME | Select-Object Name.
- This lists all groups the account belongs to in Active Directory, but requires the RSAT tools or AD module installed. It also doesn’t include local groups.
- If the module isn’t available, you can use: net user %username% /domain to see domain group memberships.
Check the GUI (optional).
- Open Computer Management (right-click Start > Computer Management).
- Go to System Tools > Local Users and Groups > Groups.
- Double-click a group to see its members. This shows who is in each local group, but you have to check each group manually—it’s not a quick list of your groups.
- For your own account, you can also go to Local Users and Groups > Users, double-click your account, and go to the Member Of tab. This shows only the groups directly assigned, not inherited ones.

Common Mistakes

Using net user and thinking it shows all groups. It only shows groups directly assigned to the account, not groups the account inherits via domain or local built-in groups (e.g., Everyone is never listed).
Running whoami /groups in an elevated prompt and expecting the same result as a normal prompt. If you run as Administrator, your token includes additional groups (like BUILTIN\Administrators) that are not present in a normal session. Always run the command in the same context you want to check.
Forgetting that group membership changes require a new logon. If you were just added to a group, your current session won’t show it until you log off and on again.
Misreading “Enabled” vs “Enabled by default”. “Enabled” means the group is active in the token, but “Enabled by default” is just the default state; it doesn’t mean the group is actually used for access checks—some groups are enabled but not used unless specifically referenced.

Tips

Use whoami /groups /fo list to see the output in a list format that might be easier to read.
If you need to see the SID of a group (e.g., for scripting), the SID column in whoami /groups is there.
For a quick check in PowerShell, you can also use: ([System.Security.Principal.WindowsIdentity]::GetCurrent()).Groups | ForEach-Object { $_.Translate([System.Security.Principal.NTAccount]).Value } to get group names in a cleaner list.
Remember that group membership is evaluated at logon. If you want to test a new group without logging off, you can use runas /user:domain\user cmd and then run whoami /groups in that new window—but that requires you to know the password.

Troubleshooting

“whoami” is not recognized as an internal or external command. This is rare, but if it happens, you’re likely not in a command prompt. Make sure you’re typing in Command Prompt or PowerShell, not in a file dialog.
The output is empty or only shows “Everyone”. This can happen if your user profile is corrupted or if you’re running in a restricted environment (like a PE boot). Try logging off and on, or run whoami /all to see if more details appear.
You don’t see domain groups even though you’re on a domain. Make sure you’re logged on with a domain account, not a local account. Check with whoami; if it shows computername\username, it’s a local account. Switch to a domain account.
You get an “Access denied” error when using net user /domain. That command requires domain admin privileges or at least permission to read user information. Use whoami /groups instead—it works without special rights.
PowerShell says Get-ADPrincipalGroupMembership is not recognized. The Active Directory module isn’t installed. Install RSAT (Remote Server Administration Tools) from Windows Features, or use the net user or whoami methods instead.

Frequently Asked Questions

Why does whoami /groups show more groups than net user?
Because whoami /groups shows the actual token of your current logon session, which includes all groups the system has added based on your account, local groups, and domain groups. net user only lists the groups explicitly assigned to your user object, not the inherited ones.
Can I see groups for another user?
Yes, but you need administrative rights. You can use net user username /domain for domain accounts (if you have permission), or open Computer Management and look at the user’s properties. For a full token view of another user, you’d need to run a command as that user (e.g., runas) or use advanced tools like Sysinternals’ PsExec with the -u flag.
Why do I see “Mandatory” groups like Everyone?
These are well-known SIDs that Windows adds to every token. They are used for security checks and are not actual “groups” you can manage.
I was added to a group, but whoami /groups doesn’t show it. Why?
Group membership is determined at logon. You need to log off and log back on (or restart the computer) for the new group to appear in your token. If you’re using a domain account, the group must be applied to your account in Active Directory and then you must refresh your token.
Does whoami /groups show nested groups?
Yes, it shows all groups that are effective in your token, including groups you are a member of through nesting (e.g., if you’re in Group A, which is in Group B, both A and B appear). However, it does not show the nesting hierarchy—just the final list.
Can I use this on Windows Server?
Yes, the same commands work on Windows Server editions. The GUI steps (Computer Management) also work, but the “Local Users and Groups” snap-in is not available on Server Core installations.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.