Global Admin No Longer Local Administrator On Devices

Question

Hello,

For the longest time, the person with the global admin role has been able to do what they needed, including running apps that require local admin privileges on our machines. However, they haven't been able to run programs that require admin privileges on our azure ad joined devices for about a week now. It is quite puzzling to us as they have been able to do so for many months now. Even though I am not a global admin, I am still able to run programs as admin. We are not sure why the global admin can't run admin programs but I can. I do have the azure ad local admin on azure ad devices role.

Is it possible that Intune could be the issue, or is this an azure issue?

Any help is greatly appreciated. Thank You,

Max Mulvihill

Answer 1

I found that when I got aggressive and removed all local admins (and what I though were orphaned SIDS) from a workstation, I broke this function and saw what you see

To fix:

1. On a newly Azure joined PC, get the local admins with this $administrators = @(

([ADSI]"WinNT://./Administrators").psbase.Invoke('Members') |

% { $.GetType().InvokeMember('AdsPath','GetProperty',$null,$($),$null) }

) -match '^WinNT';

2. then, write-host $administrators to find the SIDs to re-add. If it starts with S-1-12-1, it's a Azure group!
3. then, run Add-LocalGroupMember -group "administrators" -member "S-1-12-1-xxxx"

In my case, running via my RMM tool in the System context fixed this.