Powershell script to remove local admin users except listed users

Question

I need to create a script that I can run (through a RMM scripting system we use) that will scan a computer, create a list of local admin accounts, then check to see if they are in a pre-defined list (e.g. <> ("Administrator" and <> "GoodAdmin" and <> "AnotherGoodAdmin") then delete from group. This is for Windows 10 desktop OS.

Ideally we would like to be able to have that "good admin" list be a variable we can get from our RMM software (the system we user lets us package the script into a component with coder defined variables (e.g GoodAdminList) so we can use this with multiple clients.

I envision something like:
$GoodList = $Env:GoodAdminList
$CurrentAdmins = Get-ListOfLocalAdmins (I don't know the actual commands so just bear with the example for the premise)
For each i in $CurrentAdmins
(if i not in $GoodList then delete i
next

Something like that is what I"m looking to accomplish. Is this a difficult process?

Answer 1

If you plan on running the script LOCALLY then this should work (assuming you're looking to clean up the local Administrators group):

$GroupName = "Administrators"  
$GoodList = \\ShareName\GoodList.txt  
$GoodAdmins = Get-Content $Goodlist  
  
Get-LocalGroupMember $GroupName |  
    ForEach-Object{  
        if ($_.ObjectClass -eq 'User'){  
            if ($GoodAdmins -contains $_.Name){     # ignore groups in the administrators group  
            }  
            else{  
                Remove-LocalGroupMember -Group $GroupName -Member $_.Name -WHATIF  
            }  
        }  
    }  

Remove the "-WHATIF" when you're satisfied the script isn't removing something it shouldn't be!

If you're going to be doing this on remote machines you can make the script into a script block and use Invoke-Command.

EDIT: Removed the "Continue" -- that only works when it's not working with pipelined data.

Answer 2

Hi, i try both methods:
LocalAdmin1,LocalAdmin1 and
LocalAdmin1
LocalAdmin2

and also
LocalAdmin1, LocalAdmin1, LocalAdmin1

but script removes every account.