SCCM Query for local Admin

Question

Hello, I need assistance in generating report to show Local Admin users in our Windows 7 Windows 10, and Windows Servers environment. I need to compile these to place a security rules. The report should also show the name of the computer or the FQDN.

Any help is greatly appreciated, thanks.

We're using SCCM 2012.

Answer 1

Hi @Arni ,

We could use SCCM CMPivot Query to find local administrator accounts.

Use the below SCCM CMPivot query to find local administrator accounts. Enter the query and click Run Query.
Administrators | where Name !contains 'Administrator' and Name !contains 'Domain Admins'

For more information, please refer to Prajwal Desai's article:
Find Local Administrator Accounts with SCCM CMPivot Query
Note: Non-Microsoft link, just for the reference.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Thanks for testing! I've added a note to the original blog entry with your findings, and your work around. Perhaps I can craft a localization-agnostic method for determining a local user account enabled/disabled... Some global companies may have dozens or more localizations to consider; the script might get really messy with multiple -or statements for different possible localizations.

But I'm glad you found the cause, and a workaround for your environment.

Answer 3

Yes it was localization.

Change that lines in:
#Check if a Local user account is enabled or not. Make it $null to start with; just to be sure it's clean and empty.
$Enabled = $null
if ( ($ReturnedValues.PrincipalSource -eq 'Local') -and (($ReturnedValues.ObjectClass -eq 'User') -or ($ReturnedValues.ObjectClass -eq 'Utente'))) {

Answer 4

It seems that it never goes though the part where you check for Enable or disable
if ( ($ReturnedValues.PrincipalSource -eq 'Local') -and ($ReturnedValues.ObjectClass -eq 'User')) {
ecc ecc

perhaps because of language?
'User'->'Utente'

in CMLocalGroupMembers.log
I found everything but enable/disable

part of log:

<![LOG[Type: Local
]LOG]!><time="09:47:27.040704" date="12-1-2021" component="ff33ae1c-b473-4ffe-8267-b73bd39c9735.ps1" context="NT AUTHORITY\SYSTEM" type="1" thread="8" file="">
<![LOG[Group: Administrators
]LOG]!><time="09:47:27.122001" date="12-1-2021" component="ff33ae1c-b473-4ffe-8267-b73bd39c9735.ps1" context="NT AUTHORITY\SYSTEM" type="1" thread="8" file="">
<![LOG[Account or nested group Inside: myname
]LOG]!><time="09:47:27.163759" date="12-1-2021" component="ff33ae1c-b473-4ffe-8267-b73bd39c9735.ps1" context="NT AUTHORITY\SYSTEM" type="1" thread="8" file="">
<![LOG[Domain: PC-NAME
]LOG]!><time="09:47:27.185128" date="12-1-2021" component="ff33ae1c-b473-4ffe-8267-b73bd39c9735.ps1" context="NT AUTHORITY\SYSTEM" type="1" thread="8" file="">
<![LOG[Category: Utente

]LOG]!><time="09:47:27.232527" date="12-1-2021" component="ff33ae1c-b473-4ffe-8267-b73bd39c9735.ps1" context="NT AUTHORITY\SYSTEM" type="1" thread="8" file="">

Answer 5

What does the log say, on a box where you KNOW there are test multiple local accounts, where one of those local accounts is enabled, and the other disabled?

Log Location, if run as SYSTEM, this will most likely be %windir%\temp
$LogFilePath = $env:TEMP + "\CMLocalGroupMembers.log"

There is a section in the script where when the script is trying to figure out if an account is local and disabled, it will write notes to the log file:

under this comment in the script:
Check if a Local user account is enabled or not. Make it $null to start with; just to be sure it's clean and empty.