Only the Primary user should be a local administrator

Question

Only the Primary user should be a local administrator

Mountain Pond 1,576

Hello,

I write at once what purpose I pursue. The computer is issued to a user with administrator rights, Autopilot is used. But it is necessary that no one except this user and the administrator be a local administrator, and this user is also not an administrator on other devices.

There are several ways that might work.

First way:

In the autopilot policy, allow all users logged in to be administrators by default.
Create a local group "Device Owners" using the Intune Configuration profile.
Create a script that will be executed on the computer, which will somehow be able to find out who the Primary user is on this device and add its ID to the local group ("Device Owners").

I don`t know how can I get Primary user on Device side, without access to Azure AD.

I can of course calculate by the date the profile was created. If the device is explicitly assigned to the user with autopilot, then he is the first who will enter the system. If he logs in first, I can find out who it is by analize when profile was created wih the same script. But I think it's very difficult.

Create a profile that allows local login and remote connection via RDP only for members of the "Device Owners" group

https://jannikreinhard.com/2021/09/24/how-to-restrict-the-login-to-dedicated-users-with-intune/

I can also additionally use Account protection, which will exclude all users from the local administrators group, except for "Device Owners".

Second way:

Make all users default in the Autopilot policy.
Use LAPS to reset the local administrator password and pass the password to the user if he needs privilege escalation
Use Account protection policy to kick out non-administrators if a user is created and add such a user

Third way:

Using Endpoint Privilege Management

How else can this be implemented?

In fact, only the Primary user should be a local administrator, but there are many devices and for each to make an Account protection policy or local login settings, it's too complicated. There will be many policies, this is not the best option.

Option 1 and 2 look the same ugly.

Thank you.

Accepted answer

4 additional answers

Your answer

Answer 1

Konstantinos Passadis 19,591 MVP

Hello @Denis Pasternak !

Do you like this :

User's image

I bet you do !

GO to this link

https://jannikreinhard.com/2022/11/13/intune-device-inventory-ui/

A great solution i believe fits your case! If you cannot make it work ping for assistance

Remember this solution is custom and not supported by MS! Use it in your own risk !

I hope this helps!

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards

Mountain Pond 1,576 Reputation points

2023-05-20T19:08:08.23+00:00

Thank you.

But how it can resolve the problem )

Answer 2

I did the script

Device added to Autopilot
The device will be assigned to a specific user. The first login will be expected from this user.
The device is bound to an autopilot profile that assigns default permissions to all users logging in to that device.
The user receives the device and logs in for the first time.
The device is configured, all policies are applied, and applications are installed.
After entering and further, the script is executed

6.1 The script finds entries in the registry about which user added the device to Intune.

6.2 Script, finds in the registry which SID refers to the name of this user

6.3 Script, adds this SID to the local Administrators group.

As a result, only the user to whom the device was issued will receive administrator rights, any subsequent user will have standard permissions.

And did other one.

chrome_lpQC486enf

Another way

1. Create an application.

Grant read device list privileges in Intune.
Read the list of users (to get the SID).

The script to execute the request will receive a list of devices and the current owner. Find out its SID and add it to the local administrators group.

This will allows admin to change the local administrator by assigning the owner of the device from Intune admin center.

Crystal-MSFT 53,991 Reputation points Microsoft External Staff

2023-05-23T02:02:05.7433333+00:00

@Denis Pasternak, Thanks for the information, It is very detailed and thanks for the sharing.
Martin Reinhard 0 Reputation points

2025-05-14T15:40:07.3266667+00:00

Really interesting approach! Would you mind sharing your script? Thanks

Answer 3

Konstantinos Passadis 19,591 MVP

Hello

What i can think of

Create Local Device Administrators

User's image

Create Scope Tags ( Now this is kind of overkill , cause the way you describe it you need one group for each User...)

https://learn.microsoft.com/en-us/mem/intune/fundamentals/scope-tags

Narrow down Intune Policy with Scope Tags

Another possible way is to use filters

https://learn.microsoft.com/en-us/mem/intune/fundamentals/filters

ALSO i found this

https://www.anoopcnair.com/manage-local-admins-using-intune-group-mgmt/

Maybe this is more close to your issue ?

Tell me what you think of this , and whether any of these fits your scenario!

I hope this helps!

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards

Mountain Pond 1,576 Reputation points

2025-05-14T18:25:56.5433333+00:00

Thanks, but I wrote a solution and it has been working for a long time :)

Answer 4

@Denis Pasternak, Thanks for posting in Q&A. Based as I know, when we assign Autopilot profile and configure the "User account type" as Administrator. The user who enrolls the device will be added into Local Administrators group. So you can ask the primary user you want to login the device during the enrollment. After the enrollment finished, other Azure AD user login will only be a standard user on the device.

https://learn.microsoft.com/en-us/mem/autopilot/profiles

Meanwhile, for Azure AD joined device, Global Administrator will be added into the local administrators as well by default.

Hope it can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 5

Mountain Pond 1,576

I did the script

Device added to Autopilot
The device will be assigned to a specific user. The first login will be expected from this user.
The device is bound to an autopilot profile that assigns default permissions to all users logging in to that device.
The user receives the device and logs in for the first time.
The device is configured, all policies are applied, and applications are installed.
After entering and further, the script is executed

6.1 The script finds entries in the registry about which user added the device to Intune.

6.2 Script, finds in the registry which SID refers to the name of this user

6.3 Script, adds this SID to the local Administrators group.

As a result, only the user to whom the device was issued will receive administrator rights, any subsequent user will have standard permissions.

And did other one.

chrome_aCyU1Geygs

Another way

1. Create an application.

Grant read device list privileges in Intune.
Read the list of users (to get the SID).

The script to execute the request will receive a list of devices and the current owner. Find out its SID and add it to the local administrators group.

This will allows admin to change the local administrator by assigning the owner of the device from Intune admin center.

Martin Reinhard 0 Reputation points

2025-05-15T06:34:33.3533333+00:00

@Mountain Pond Really interesting approach! Would you mind sharing your script? Thanks

Mountain Pond 1,576

@Martin Reinhard

Hi, sure.

but I would rework it to use invoke-restmethod instead of loading modules.

Start-Transcript C:\Windows\Temp\intune-manage-local-admins-using-graph-api.log

Set-ExecutionPolicy Bypass -Scope Process -Confirm:$false

Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted
Install-Module Microsoft.Graph -Confirm:$false -ErrorAction SilentlyContinue

Import-Module Microsoft.Graph.Identity.DirectoryManagement -Verbose -ErrorAction Stop

$appid = 'AAA'
$tenantid = 'BBB'
$secret = 'CCCC'
 
$body =  @{
    Grant_Type    = "client_credentials"
    Scope         = "https://graph.microsoft.com/.default"
    Client_Id     = $appid
    Client_Secret = $secret
}
 
$connection = Invoke-RestMethod `
    -Uri https://login.microsoftonline.com/$tenantid/oauth2/v2.0/token `
    -Method POST `
    -Body $body `
    -UseBasicParsing
 
$token = $connection.access_token


$targetParameter = (Get-Command Connect-MgGraph).Parameters['AccessToken']

if ($targetParameter.ParameterType -eq [securestring]){
  Connect-MgGraph -AccessToken ($token |ConvertTo-SecureString -AsPlainText -Force)
}
else {
  Connect-MgGraph -AccessToken $token
}


$AADDeviceIDs = (Get-MgDevice -Search "displayName:$env:COMPUTERNAME" -CountVariable CountVar -ConsistencyLevel eventual | Where-Object {$_.TrustType -eq 'AzureAd'}).Id
Write-Host "DeviceID: $AADDeviceID"

if ($AADDeviceIDs){

    $AADDeviceOwners = @()
    FOREACH ($AADDeviceID in $AADDeviceIDs){
   
        $AADDeviceOwners += ((Get-MgDeviceRegisteredOwner -DeviceId $AADDeviceID).AdditionalProperties).userPrincipalName
        Write-Host "DeviceOWNER: $AADDeviceOwner"

    }

    $AADDeviceOwners = $AADDeviceOwners | Sort-Object | Get-Unique

    if ($AADDeviceOwners){
   
        FOREACH ($AADDeviceOwner in $AADDeviceOwners){
    
                $AADUserID = (Get-MgUser -Search "userPrincipalName:$AADDeviceOwner" -CountVariable CountVar -ConsistencyLevel eventual).Id
                Write-Host "DeviceUSERID: $AADUserID"
        
                $bytes = [Guid]::Parse($($AADUserID)).ToByteArray()
                $array = New-Object 'UInt32[]' 4
                [Buffer]::BlockCopy($bytes, 0, $array, 0, 16)
                $sid = "S-1-12-1-$array".Replace(' ', '-')
                Write-Host "DeviceUSERSID: $SID"

                Get-LocalGroupMember -Name 'Administrators' | Where-Object {$_.PrincipalSource -eq 'AzureAD' -and $_.ObjectClass -eq 'User'} | %{Remove-LocalGroupMember -Name 'Administrators' -Member $_} -Verbose
                Add-LocalGroupMember -Name 'Administrators' -Member $SID -Verbose
        
            } 

        } else {
            
            Write-Error "Device owner is not specified" -ErrorAction Stop
            
            }

} else {

    Write-Error "Could not find device by display name." -ErrorAction Stop

}

Disconnect-Graph -Verbose

Stop-Transcript

Share via

Only the Primary user should be a local administrator

4 additional answers

Your answer