This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
When setting up a Windows device, the user who does so becomes local Admin. These same users are now enrolled within Intune however they still hold 'local admin' rights and therefore have sufficient credentials to download software etc without admin credentials required. How do we revoke this 'local admin' access on these users/devices to stop them from doing this? If it's a Powershell script that is needed, dows anyone have a working one? Many thanks
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 30%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
@Anonymous , Hope things are going well. I am writing to see if the following suggestions can help. if there's still anything else we can help, feel free to let us know.
Check out this new capability we added in January (of this year): https://techcommunity.microsoft.com/t5/intune-customer-success/new-settings-available-to-configure-local-user-group-membership/ba-p/3093207
You can remove the local admin rights by going into computer management > users and groups > administrators
However this will not stop it from happening in future on new devices.
Thanks for the quick response Barley, We would like to achieve this via Intune and not have to physically change this within each device. Is this possible at all?