WIN-005 · Script

Local Administrator Audit

Lists members of the local Administrators group and flags anyone not on your approved list.

Version 1.0.0Language PowerShellUpdated November 2026Report only, changes nothing

What it does

Finds the local Administrators group by its well-known SID, so it works on any Windows language. Uses the built-in local accounts module, and falls back to a directory query when that module cannot resolve cloud or orphaned members. Read-only; it never adds or removes anyone.

Requirements

Windows PowerShell 5.1+, run as SYSTEM or local admin

How to run it

Run as: SYSTEM or a local administrator
Run from: any RMM or MDM, Intune, a Group Policy startup script, a scheduled task, or an elevated PowerShell window
Script type: PowerShell, 64-bit
User interaction: none; the script never prompts
Timeout: 10 minutes (30 for Windows Update installs)

Settings

Name	What it does	Options	Default
AllowedMembers	Names that are expected in the group, for example "Administrators", "CONTOSO\Domain Admins", or "ITAdmin". Matching is by the end of the name, so "ITAdmin" matches "PC01\ITAdmin". The built-in Administrator account is always allowed.		Domain Admins

Exit codes

0 = only approved members, 1 = unapproved members found, 2 = script error

Testing steps

Run it on one test device and check the output and log.
Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
Roll out to a small group next, then everyone.

Rollback steps

Report only. Nothing is changed, so nothing needs to be rolled back.

Version and change log

Version	Date	Changes
1.0.0	November 2026	First release.