Intune - Local Admin Removal

Question

Dear All,

I have Azure AD joined devices in which all end-users are local admin now. I would like to remove the end-user from local admin role

Could you please suggest or share the steps to execute the same

Answer 1

I have some good news, MEM team today announced they add a new feature call Account protection it is under Endpoint security which you could do exactly what you asked.
Take a look at:
https://techcommunity.microsoft.com/t5/intune-customer-success/new-settings-available-to-configure-local-user-group-membership/ba-p/3093207

Answer 2

Currently , there is no out of the box policy to do it in Microsoft Intune, either you have to create a PowerShell script to do it or use custom setting , to create a custom setting , take a look at:
https://learn.microsoft.com/en-us/mem/intune/configuration/custom-settings-windows-10
In this case you may use RestrictedGroups policies , take a look at:
https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-restrictedgroups#restrictedgroups-configuregroupmembership

Answer 3

Thanks Reza, as of now the account protection is supported for Windows 10 20H2. But i will give a try

Answer 4

Dear All,

Account protection is not working for version 1809/1909 as stated it is supported from 20H2. I tried the below XML and deployed custom profile as stated in below blog

https://www.jeffgilb.com/managing-local-administrators-with-azure-ad-and-intune/

My XML is below

<groupmembership>
<accessgroup desc = "Administrators">
<member name = "Administrator"/>
<member name = "S-1-12-1-XXXX"/>
<member name = "S-1-12-1-XXXX"/>
<member name = "AzureAD\XXXX@X .com"/>
</accessgroup>
</groupmembership>

I am getting the below error in end-user PC, any thoughts on how to fix it wud be appreciated