NERR_UserLogon (0X000008B7): Can't Delete User With Active Session

Quick answer

Run logoff <sessionID> /server:<computername> as admin for each active user session, then delete the user via net user <username> /delete.

What's actually happening here

Error 0X000008B7 — hex for decimal 2231 — maps to NERR_UserLogon. The underlying cause is simple: Windows won't let you delete an account while that user holds an active session. This isn't a permission issue (you're admin) or a corruption problem. It's a safety guard. The OS doesn't want you to yank the rug out from under a running user profile — open files, running processes, registry hives, all attached to that SID. Deleting the user mid-session would orphan those resources and potentially crash services or corrupt data.

You'll hit this most often on domain controllers, remote desktop servers, or shared workstations where users leave their sessions idle. You might also see it on Windows Server 2016/2019/2022 when trying to clean up stale accounts via the GUI or PowerShell.

The fix — step by step

1. Identify the sessions
   Open Command Prompt as Administrator. Run:
   query session /server:localhost
   Replace localhost with the target machine's name if remote. Look for rows with an ID (like 1, 2, 3) and the username you want to delete. Note the session ID.
2. Force logoff the user
   Run:
   logoff <sessionID> /server:localhost
   For example, logoff 3 /server:localhost.
   The reason step 2 works: logoff terminates the session cleanly — it sends a close signal to all user processes, then unloads the user profile and registry hive. After that, the user handle is released from the SAM database, and deletion becomes possible.
3. Verify the user is gone
   Run query session /server:localhost again. The user should no longer appear.
4. Delete the user account
   Now run:
   net user <username> /delete
   Or from PowerShell: Remove-LocalUser -Name "<username>"

Alternative fixes if the main one fails

• Use Computer Management
  Go to Computer Management → System Tools → Shared Folders → Sessions. Right-click the user's session and select Close Session. Then delete the user via Local Users and Groups.
• Use PowerShell to force disconnect
  Get-WmiObject -Class Win32_Session -Filter "UserName='<username>'" | ForEach-Object { $_.Terminate() }
  This calls the same underlying Win32 API as logoff but works from PowerShell scripts.
• Reboot the machine
  If the user's session is hung or won't respond to logoff, a restart clears all sessions. Not elegant, but it works. After reboot, delete immediately.
• Disconnect the user via Remote Desktop Services Manager (if on a server)
  Launch tsadmin.msc, find the user's session, right-click, choose Disconnect or Logoff.

Prevention tip

Before deleting any user on a shared system, always run query session first. Make it a habit. On Remote Desktop servers, set idle session timeouts via Group Policy under Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Session Time Limits. Set End session when time limits are reached to Enabled. This forces stale sessions to disconnect automatically, so you won't hit this error when cleaning up accounts later.

What about domain users?

If you're on a domain controller, the same principle applies — but you delete the user from Active Directory Users and Computers (dsa.msc). You'll get the same error if the user is signed in locally on the DC (which they shouldn't be, unless it's a small setup). Use qwinsta (older name for query session) to find them, then logoff. After that, AD deletion works fine.