The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in mid-October 2026. We hope you enjoy the updated experience.

Press CTRL+K to open search

iUser command

  • Published on Sep 14, 2026
  • 1 minute(s) read
Prev Next

The iUser command returns information about users on a system.

Note

Exploit Prevention is not supported in the ARM architecture.

Syntax

iUser param
                     
                  

Parameters

Parameter

Returns

username

"1" if the user exists on the system, otherwise "0".

list

List of all users on the system.

groups username

List of the groups a user belongs to.

For more Expert Rules examples, visit the Trellix Github repository.

Related articles
  • iUser command
    Endpoint Security (ENS) > Trellix Endpoint Security (ENS) 26.x Product Guide - Windows > Using Expert Rules > Learn Expert Rules for files, processes, and registry > Commands to query system state
  • iSystem command
    Endpoint Security (ENS) > Trellix Endpoint Security (ENS) 26.x Product Guide - Windows > Using Expert Rules > Learn Expert Rules for files, processes, and registry > Commands to query system state
  • iSystem command
    Endpoint Security (ENS) > Trellix Endpoint Security (ENS) 10.7.x Product Guide - Windows > Using Expert Rules > Learn Expert Rules for files, processes, and registry > Commands to query system state