Sccm Ts Where Is Used Local Admin Download Both The

Note that initially there will be no data here until your clients have updated their policies, ran the configuration baseline, and ran the hardware inventory cycle.

If that user is a member of a group that has been added to the local administrators group, then it isnt immediately obvious whether they actually have administrator rights without also checking the membership of that group.

And what if there are further nested groups ie the user is a member of a group thats a member of a group thats a member of the local administrators group Obviously things can get complicated here, making reporting and compliance checking a challenge.

A Compliance item in SCCM is used as the delivery vehicle for the script and then RegKeyToMof is used to update the hardware inventory classes in SCCM to gather this information from the clients registry into the SCCM database, where we can query and report on it.

Since the script is running locally on the client computer, we will not use User Device Affinity.

But this class can contain multiple instances so you cant always determine the primary user that way.

This will give you the user account who has had the most interactive logons on the system and for the most part will indicate who the primary user is.

TopConsoleUser Get-WmiObject -Namespace ROOTcimv2sms -Class SMSSystemConsoleUsage -Property TopConsoleUser -ErrorAction Stop Select -ExpandProperty TopConsoleUser.

Instead we will create a WindowsIdentity object in.Net and run a method called HasClaim().

I describe this more in a previous blog, but using this method we can determine if the user has local administrator privilege whether through direct membership or through a nested group.

LocalAdminMembers GroupPrincipal.Members select -ExpandProperty SamAccountName Sort-Object.

Lets say that Group B is a member of Group A, which is a member of the local administrators group.

We will check the membership of both Groups B and A to see which ones the user is a member of, and therefore which groups is effectively giving the user administrator privilege.

We do this by querying the GroupPrincipal object created in the previous code.

The custom function will query nested membership up to 3 levels deep.

I use the following registry key, but you can change this in the script if you wish.

The actual groups that grant this right are listed in the NestedGroupMembership property.

Remember the Windows XP and Server 2003 may not have PowerShell installed.

Sccm Ts Where Is Used Local Admin Download Both The

You can download both the discovery and remediation scripts from my Github repo here.

Make sure Windows Powershell is selected as the script language.

This allows the script to run according to the schedule you define for it, ie once a day or once a week etc, to keep the information up-to-date in the registry.

Make sure to remediate noncompliance and select the collection you wish to target.

Open your default client settings and go to the Hardware Inventory page.