Convert from Azure AD registered to Azure AD Joined without local admin rights

Question

Hello,

We have an issue with a large number of machines our client has inherited. Our client has absorbed a couple of companies and the machines that were associated with those users.

The issue is we can't get Intune to deploy to these machines since the users are signed into local account that do NOT have local admin rights to the machine. These machines are Azure AD Registered, but we need to get them to a Azure AD Joined or Hybrid state. We do not have the passwords for the local users that do have local admin rights on the machines, so we can't get any new software installed or provision our RMM tools.

Is there any way to get the devices moved to Azure AD Joined or grant local admin rights without resetting the device to factory and running through AutoPilot?

Answer 1

Is there any way to get the devices moved to Azure AD Joined or grant local admin rights without resetting the device to factory and running through AutoPilot?

No. Local admin permissions are required to join a device to a domain (AD or AAD doesn't matter) or enroll it into MDM. If this were not required, any bad actor, even unintelligent ones, would already have taken over all of your user's systems.

AAD Registration is just that, a simple registration of a device by the user, it doesn't endow or grant any sort of control over that device in any way.

Answer 2

Have you considered using provisioning package for joining into AAD and auto-enrollment?

Answer 3

@Daniel Monks Thanks for posting in our Q&A.

To clarify this issue, could you please tell us if the devices are already manged by intune? If yes, we can try to write a Powershell script to create a local admin user and deploy this script via intune.

I have done the test in my lab. I will share you some screen shots:
Script:

Settings of script policy in intune portal:
https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension#create-a-script-policy-and-assign-it

Results:
I can see the new admin user in the Administrator group.

Now we can disconnect the account in Settings > Accounts > Access work or school. Then we can follow the steps under "To join an already configured Windows 10 device" in the following link to make the device Azure AD joined.
https://support.microsoft.com/en-us/account-billing/join-your-work-device-to-your-work-or-school-network-ef4d6adb-5095-4e51-829e-5457430f3973

Hope it will help.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.