diff --git a/monkey/infection_monkey/post_breach/account_discovery/windows_account_discovery.py b/monkey/infection_monkey/post_breach/account_discovery/windows_account_discovery.py
index 325f7ad43..a37054c35 100644
--- a/monkey/infection_monkey/post_breach/account_discovery/windows_account_discovery.py
+++ b/monkey/infection_monkey/post_breach/account_discovery/windows_account_discovery.py
@@ -1,4 +1,2 @@
 def get_windows_commands_to_discover_accounts():
-    return [
-        "net user"
-    ]
+    return "powershell Get-LocalUser"
diff --git a/monkey/infection_monkey/post_breach/actions/discover_accounts.py b/monkey/infection_monkey/post_breach/actions/discover_accounts.py
index 960966b1e..8eaab9e38 100644
--- a/monkey/infection_monkey/post_breach/actions/discover_accounts.py
+++ b/monkey/infection_monkey/post_breach/actions/discover_accounts.py
@@ -9,4 +9,4 @@ class AccountDiscovery(PBA):
         linux_cmds, windows_cmds = get_commands_to_discover_accounts()
         super().__init__(POST_BREACH_ACCOUNT_DISCOVERY,
                          linux_cmd=' '.join(linux_cmds),
-                         windows_cmd=' '.join(windows_cmds))
+                         windows_cmd=windows_cmds)