Effective Strategies for Detecting and Removing Users from the Administrators Group

🔐 Intune Blog: Detecting & Removing Individual User Accounts from Administrators Group

📌 Why This Matters

Maintaining a secure environment means ensuring that only authorized accounts have administrative privileges. Individual user accounts in the Administrators group can pose a serious risk — they bypass standard security controls and increase the attack surface.

With Intune detection and remediation scripts, IT admins can automatically identify and remove such accounts, ensuring compliance across endpoints.

🕵️ Detection Script

The detection script checks for individual user accounts in the Administrators group (excluding the built-in Administrator). If found, it logs the details and marks the device as Non-Compliant.

powershell

# Create log folder if needed
$LogFolder = "C:\Logs"
$LogFile = "$LogFolder\Detection.txt"

if (!(Test-Path $LogFolder)) {
    New-Item -Path $LogFolder -ItemType Directory -Force | Out-Null
}

$DateTime = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

try {
    $Admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction Stop

    $IndividualUsers = $Admins | Where-Object {
        $_.ObjectClass -eq "User" -and
        $_.Name -notmatch "\\Administrator$"
    }

    if ($IndividualUsers) {
        $UserList = ($IndividualUsers.Name -join ", ")
        @"
[$DateTime] Non-Compliant
Individual user account(s) found in Administrators group:
$UserList
"@ | Out-File -FilePath $LogFile -Encoding UTF8
        Write-Output "Non-Compliant: $UserList"
        exit 1
    }
    else {
        @"
[$DateTime] Compliant
No individual user accounts found in Administrators group.
"@ | Out-File -FilePath $LogFile -Encoding UTF8
        Write-Output "Compliant"
        exit 0
    }
}
catch {
    "[$DateTime] ERROR: $_" | Out-File -FilePath $LogFile -Encoding UTF8
    exit 1
}

🛠️ Remediation Script

The remediation script removes any detected individual user accounts from the Administrators group and logs the action.

powershell

# Create log folder if needed
$LogFolder = "C:\Logs"
$LogFile = "$LogFolder\Remediation.txt"

if (!(Test-Path $LogFolder)) {
    New-Item -Path $LogFolder -ItemType Directory -Force | Out-Null
}

$DateTime = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

try {
    $Admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction Stop

    $IndividualUsers = $Admins | Where-Object {
        $_.ObjectClass -eq "User" -and
        $_.Name -notmatch "\\Administrator$"
    }

    if ($IndividualUsers) {
        foreach ($User in $IndividualUsers) {
            try {
                Remove-LocalGroupMember -Group "Administrators" -Member $User.Name -ErrorAction Stop
                Add-Content -Path $LogFile -Value "[$DateTime] Removed user: $($User.Name)"
            }
            catch {
                Add-Content -Path $LogFile -Value "[$DateTime] Failed removing user: $($User.Name) - $_"
            }
        }
        Write-Output "Remediation completed."
    }
    else {
        Add-Content -Path $LogFile -Value "[$DateTime] No individual user accounts found."
    }
    exit 0
}
catch {
    Add-Content -Path $LogFile -Value "[$DateTime] ERROR: $_"
    exit 1
}

⚠️ Important Note

These scripts are provided as a baseline. 👉 Always modify the script as per your organizational requirements — for example, to exclude specific service accounts or tailor logging paths.