# Manage local accounts and groups

_Peios / Using Peios / Manage local accounts and groups_

> Create and maintain local users and groups, choose credential policy, and inspect the privileges assigned by this machine.

Local accounts and groups are held by `lpsd`, the local principal source.
Use [Principals Manager](/peios/using-peios/managing-local-principals/principals-manager.md)
on the desktop or the [lps command](/peios/using-peios/managing-local-principals/lps-command.md)
in a terminal to manage them. The guides distinguish changes you can make to
your own account from administrator operations.

## Choose a task

- **Create an account:** [Creating accounts](/peios/using-peios/managing-local-principals/creating-accounts.md)
  covers credentials, membership and the different first-account provisioning
  routes. The desktop equivalent is [Making a user](/peios/using-peios/managing-local-principals/principals-manager.md#making-a-user).
- **Change an account or its sign-in policy:** [Changing a user](/peios/using-peios/managing-local-principals/principals-manager.md#changing-a-user)
  or the [lps reference](/peios/using-peios/managing-local-principals/lps-command.md).
  A password being set does not by itself require that password at sign-in.
- **Create a group or change membership:** [Groups in Principals Manager](/peios/using-peios/managing-local-principals/principals-manager.md#groups)
  or [Grouping people together](/peios/using-peios/managing-local-principals/creating-accounts.md#grouping-people-together).
- **Inspect or change privileges and integrity policy:** [Assigning privileges](/peios/using-peios/managing-local-principals/assigning-privileges.md).
  This is the machine's local policy, separate from the account's identity.
  A policy change affects newly minted sign-in tokens, not existing tokens.
- **Change your own password, SSH keys or display name:** [Sign in](/peios/using-peios/signing-in/overview.md#manage-your-own-account)
  links the self-service procedures.

## Keep a usable administrator route

Before changing an administrator's credentials, membership or sign-in access,
keep a working administrator session and verify the replacement route. The
[last-administrator guard](/peios/using-peios/managing-local-principals/creating-accounts.md#the-last-administrator-guard)
checks account state; it does not prove that you can actually sign in through a
usable route. SSH configuration changes can end every SSH session, so follow
the [separate-access precautions](/peios/using-peios/signing-in/signing-in-over-ssh.md) there.

Read [Disabling rather than deleting](/peios/using-peios/managing-local-principals/creating-accounts.md#disabling-rather-than-deleting)
before removing an account. Recreating a name does not restore the old SID or
the access granted to it.

## Understand the model when needed

Security Fundamentals explains [authorities and principal sources](/peios/security-fundamentals/authentication/principal-sources.md),
[local identity storage](/peios/security-fundamentals/authentication/the-local-store.md),
[name resolution](/peios/security-fundamentals/authentication/resolving-names.md) and
[privileges](/peios/security-fundamentals/privileges/overview.md). Tool authors and administrators
investigating a refused request can consult the
[local principal interfaces](/peios/advanced-peios/local-principal-interfaces/the-admin-socket.md)
in the technical reference.

Related content:

- [Principals Manager](/peios/using-peios/managing-local-principals/principals-manager.md)
- [Creating accounts](/peios/using-peios/managing-local-principals/creating-accounts.md)
- [The lps command](/peios/using-peios/managing-local-principals/lps-command.md)
- [Assigning privileges](/peios/using-peios/managing-local-principals/assigning-privileges.md)
- [Sign in](/peios/using-peios/signing-in/overview.md)
- [Authorities and principal sources](/peios/security-fundamentals/authentication/principal-sources.md)