SCCM Query for local Admin

Question

Hello, I need assistance in generating report to show Local Admin users in our Windows 7 Windows 10, and Windows Servers environment. I need to compile these to place a security rules. The report should also show the name of the computer or the FQDN.

Any help is greatly appreciated, thanks.

We're using SCCM 2012.

Answer 1

Hi @Arni ,

We could use SCCM CMPivot Query to find local administrator accounts.

Use the below SCCM CMPivot query to find local administrator accounts. Enter the query and click Run Query.
Administrators | where Name !contains 'Administrator' and Name !contains 'Domain Admins'

For more information, please refer to Prajwal Desai's article:
Find Local Administrator Accounts with SCCM CMPivot Query
Note: Non-Microsoft link, just for the reference.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

in my opinion, at this point you aren't asking the question of "what can ECM do for me", you are asking the question of "I need to have a remote powershell script do this for me, presuming I have local Admin rights on all of the target devices", where the results will be spit out into a local xlsx or csv file, after remotely connecting across the network to a list of devices". CM would not "create a spreadsheet" like you are asking for.

If you really want ECM to "do this for you", at this point it isn't a pivot script, nor (in my opinion) a script within CM--but you could do that, I guess--that wouldn't be my first method that I would use, however.

I think what you "really want" (at the risk of guessing what you really want) is a way to inventory this information. This would be a custom inventory, where you would, most likely, deploy a Script (via a Configuration item), then import a CUSTOM inventory mof file (to create a custom table and view), and then, you can query your CM database for this information; after your devices have had a chance to run that Configuration Item, and subsequently do hardware inventory.

Answer 3

For testing... this would be a Script + Mof edit; to inventory using a powershell script the 'all members of all local groups", optionally log to a local log file on each client when the script runs. The script does also lookup when the member of a local group is a local user account, is that local user account Enabled True/False, and able to report on that.

https://tcsmug.org/blogs/sherry-kissinger/568-cm-all-members-of-all-local-groups-powershell

This has only been tested in a 2-device lab environment--aka... hardly tested at all. Do I think it works? probably. But more testing definitely would need to be done to confirm.

Answer 4

Hi, I follow all the steps here https://tcsmug.org/blogs/sherry-kissinger/568-cm-all-members-of-all-local-groups-powershell

And it almost works. :)

tha only thing that doesnt work is the 'enable' 'disable' flag that never been populate. what I miss?

thanks in advance,
P.

Answer 5

What does the log say, on a box where you KNOW there are test multiple local accounts, where one of those local accounts is enabled, and the other disabled?

Log Location, if run as SYSTEM, this will most likely be %windir%\temp
$LogFilePath = $env:TEMP + "\CMLocalGroupMembers.log"

There is a section in the script where when the script is trying to figure out if an account is local and disabled, it will write notes to the log file:

under this comment in the script:
Check if a Local user account is enabled or not. Make it $null to start with; just to be sure it's clean and empty.