Remove Local Administrators
🪟PowerShell🪟Windows🍻Script Share
function Get-LocalAdmins {
[CmdletBinding()]
$GroupSID='S-1-5-32-544'
[string]$Groupname = (get-localgroup -SID $GroupSID)[0].Name
$group = [ADSI]"WinNT://$env:COMPUTERNAME/$Groupname"
$admins = $group.Invoke('Members') | ForEach-Object {
$path = ([adsi]$_).path
$memberSID = $(Split-Path $path -Leaf)
[pscustomobject]@{
Computer = $env:COMPUTERNAME
Domain = $(Split-Path (Split-Path $path) -Leaf)
User = $(Split-Path $path -Leaf)
}
}
return $admins
}
#Put local Admins in array blow
$allowedAdmins = @("Administrator", "WLapsAdmin")
$adminGroup = Get-LocalGroup -Name "Administrators"
$admins = Get-localAdmins
foreach($admin in $admins){
if(($admin.Domain -ne "WinNT:\") -and ($admin.User -notin $allowedAdmins)) {
try {
# If the user is a member of the Administrators group and not in the allowed list
# Remove the user from the group
Write-Output "Removing $($admin.Domain)\$($admin.user) from Local Administrators"
#Remove-LocalGroupMember -Group $adminGroup -Member $user.Name -ErrorAction Stop
} catch {
Write-Warning "Failed to process user '$($user.Name)': $_"
}
}
}function Get-LocalAdmins {
[CmdletBinding()]
$GroupSID='S-1-5-32-544'
[string]$Groupname = (get-localgroup -SID $GroupSID)[0].Name
$group = [ADSI]"WinNT://$env:COMPUTERNAME/$Groupname"
$admins = $group.Invoke('Members') | ForEach-Object {
$path = ([adsi]$_).path
$memberSID = $(Split-Path $path -Leaf)
[pscustomobject]@{
Computer = $env:COMPUTERNAME
Domain = $(Split-Path (Split-Path $path) -Leaf)
User = $(Split-Path $path -Leaf)
}
}
return $admins
}
#Put local Admins in array blow
$allowedAdmins = @("Administrator", "WLapsAdmin")
$adminGroup = Get-LocalGroup -Name "Administrators"
$admins = Get-localAdmins
foreach($admin in $admins){
if(($admin.Domain -ne "WinNT:\") -and ($admin.User -notin $allowedAdmins)) {
try {
# If the user is a member of the Administrators group and not in the allowed list
# Remove the user from the group
Write-Output "Removing $($admin.Domain)\$($admin.user) from Local Administrators"
#Remove-LocalGroupMember -Group $adminGroup -Member $user.Name -ErrorAction Stop
} catch {
Write-Warning "Failed to process user '$($user.Name)': $_"
}
}
}
