diff --git a/x-pack/auditbeat/module/system/user/user.go b/x-pack/auditbeat/module/system/user/user.go
index 652e9d62ce54..82e12a11d19e 100644
--- a/x-pack/auditbeat/module/system/user/user.go
+++ b/x-pack/auditbeat/module/system/user/user.go
@@ -2,6 +2,8 @@
 // or more contributor license agreements. Licensed under the Elastic License;
 // you may not use this file except in compliance with the Elastic License.
 
+// +build linux,cgo
+
 package user
 
 import (
diff --git a/x-pack/auditbeat/module/system/user/user_test.go b/x-pack/auditbeat/module/system/user/user_test.go
index d142b833c049..ccb606f4d24d 100644
--- a/x-pack/auditbeat/module/system/user/user_test.go
+++ b/x-pack/auditbeat/module/system/user/user_test.go
@@ -2,6 +2,8 @@
 // or more contributor license agreements. Licensed under the Elastic License;
 // you may not use this file except in compliance with the Elastic License.
 
+// +build linux,cgo
+
 package user
 
 import (
diff --git a/x-pack/auditbeat/module/system/user/users_other.go b/x-pack/auditbeat/module/system/user/users_other.go
index 8bc466989029..da9351dc9712 100644
--- a/x-pack/auditbeat/module/system/user/users_other.go
+++ b/x-pack/auditbeat/module/system/user/users_other.go
@@ -7,10 +7,23 @@
 package user
 
 import (
-	"github.com/pkg/errors"
+	"fmt"
+
+	"github.com/elastic/beats/metricbeat/mb"
+)
+
+const (
+	moduleName    = "system"
+	metricsetName = "user"
 )
 
-// GetUsers is not implemented on all systems.
-func GetUsers() (users []*User, err error) {
-	return nil, errors.New("not implemented")
+func init() {
+	mb.Registry.MustAddMetricSet(moduleName, metricsetName, New,
+		mb.DefaultMetricSet(),
+	)
+}
+
+// New returns an error.
+func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
+	return nil, fmt.Errorf("the %v/%v dataset is only supported on Linux", moduleName, metricsetName)
 }
diff --git a/x-pack/auditbeat/tests/system/test_metricsets.py b/x-pack/auditbeat/tests/system/test_metricsets.py
index 2cc220105bf5..d56310745368 100644
--- a/x-pack/auditbeat/tests/system/test_metricsets.py
+++ b/x-pack/auditbeat/tests/system/test_metricsets.py
@@ -60,6 +60,7 @@ def test_metricset_socket(self):
             if "network.type" not in str(e):
                 raise
 
+    @unittest.skipUnless(sys.platform == "linux2", "Only implemented for Linux")
     def test_metricset_user(self):
         """
         user metricset collects information about users on a server.