Effective Strategies for Detecting and Removing Users from the Administrators Group

Aug 24

4 min read

📌 Why This Matters

Maintaining a secure environment means ensuring that only authorized accounts have administrative privileges. Individual user accounts in the Administrators group can pose a serious risk — they bypass standard security controls and increase the attack surface.

With Intune detection and remediation scripts, IT admins can automatically identify and remove such accounts, ensuring compliance across endpoints.

🕵️ Detection Script

The detection script checks for individual user accounts in the Administrators group (excluding the built-in Administrator). If found, it logs the details and marks the device as Non-Compliant.

# Create log folder if needed

$LogFolder = "C:\Logs"

$LogFile = "$LogFolder\Detection.txt"

if (!(Test-Path $LogFolder)) {

New-Item -Path $LogFolder -ItemType Directory -Force | Out-Null

}

$DateTime = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

try {

$Admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction Stop

$IndividualUsers = $Admins | Where-Object {

$_.ObjectClass -eq "User" -and

$_.Name -notmatch "\\Administrator$"

}

if ($IndividualUsers) {

$UserList = ($IndividualUsers.Name -join ", ")

[$DateTime] Non-Compliant

Individual user account(s) found in Administrators group:

$UserList

"@ | Out-File -FilePath $LogFile -Encoding UTF8

Write-Output "Non-Compliant: $UserList"

exit 1

}

else {

[$DateTime] Compliant

No individual user accounts found in Administrators group.

"@ | Out-File -FilePath $LogFile -Encoding UTF8

Write-Output "Compliant"

exit 0

}

catch {

"[$DateTime] ERROR: $_" | Out-File -FilePath $LogFile -Encoding UTF8

exit 1

}

🛠️ Remediation Script

The remediation script removes any detected individual user accounts from the Administrators group and logs the action.

# Create log folder if needed

$LogFolder = "C:\Logs"

$LogFile = "$LogFolder\Remediation.txt"

if (!(Test-Path $LogFolder)) {

New-Item -Path $LogFolder -ItemType Directory -Force | Out-Null

}

$DateTime = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

try {

$Admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction Stop

$IndividualUsers = $Admins | Where-Object {

$_.ObjectClass -eq "User" -and

$_.Name -notmatch "\\Administrator$"

}

if ($IndividualUsers) {

foreach ($User in $IndividualUsers) {

try {

Remove-LocalGroupMember -Group "Administrators" -Member $User.Name -ErrorAction Stop

Add-Content -Path $LogFile -Value "[$DateTime] Removed user: $($User.Name)"

}

catch {

Add-Content -Path $LogFile -Value "[$DateTime] Failed removing user: $($User.Name) - $_"

}

Write-Output "Remediation completed."

}

else {

Add-Content -Path $LogFile -Value "[$DateTime] No individual user accounts found."

}

exit 0

}

catch {

Add-Content -Path $LogFile -Value "[$DateTime] ERROR: $_"

exit 1

}

Today

Create a Intune blog which lighlights of any deleting individual user account from administrators group with the help of below detection and remediation powershell script. Also add a note stating modify the script as your requirement. Detection. # Create log folder if needed $LogFolder = "C:\Logs" $LogFile = "$LogFolder\Detection.txt" if (!(Test-Path $LogFolder)) { New-Item -Path $LogFolder -ItemType Directory -Force | Out-Null } $DateTime = Get-Date -Format "yyyy-MM-dd HH:mm:ss" try { $Admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction Stop $IndividualUsers = $Admins | Where-Object { $_.ObjectClass -eq "User" -and $_.Name -notmatch "\\Administrator$" } if ($IndividualUsers) { $UserList = ($IndividualUsers.Name -join ", ") @" [$DateTime] Non-Compliant Individual user account(s) found in Administrators group: $UserList "@ | Out-File -FilePath $LogFile -Encoding UTF8 Write-Output "Non-Compliant: $UserList" exit 1 } else { @" [$DateTime] Compliant No individual user accounts found in Administrators group. "@ | Out-File -FilePath $LogFile -Encoding UTF8 Write-Output "Compliant" exit 0 } } catch { "[$DateTime] ERROR: $_" | Out-File -FilePath $LogFile -Encoding UTF8 exit 1 } Remediation # Create log folder if needed $LogFolder = "C:\Logs" $LogFile = "$LogFolder\Remediation.txt" if (!(Test-Path $LogFolder)) { New-Item -Path $LogFolder -ItemType Directory -Force | Out-Null } $DateTime = Get-Date -Format "yyyy-MM-dd HH:mm:ss" try { $Admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction Stop $IndividualUsers = $Admins | Where-Object { $_.ObjectClass -eq "User" -and $_.Name -notmatch "\\Administrator$" } if ($IndividualUsers) { foreach ($User in $IndividualUsers) { try { Remove-LocalGroupMember ` -Group "Administrators" ` -Member $User.Name ` -ErrorAction Stop Add-Content -Path $LogFile ` -Value "[$DateTime] Removed user: $($User.Name)" } catch { Add-Content -Path $LogFile ` -Value "[$DateTime] Failed removing user: $($User.Name) - $_" } } Write-Output "Remediation completed." } else { Add-Content -Path $LogFile ` -Value "[$DateTime] No individual user accounts found." } exit 0 } catch { Add-Content -Path $LogFile ` -Value "[$DateTime] ERROR: $_" exit 1 }

Here’s a polished Intune blog draft that highlights how administrators can detect and remediate individual user accounts mistakenly added to the local Administrators group using PowerShell.

🔐 Intune Blog: Detecting & Removing Individual User Accounts from Administrators Group

📌 Why This Matters

With Intune detection and remediation scripts, IT admins can automatically identify and remove such accounts, ensuring compliance across endpoints.

🕵️ Detection Script

powershell

# Create log folder if needed
$LogFolder = "C:\Logs"
$LogFile = "$LogFolder\Detection.txt"

if (!(Test-Path $LogFolder)) {
    New-Item -Path $LogFolder -ItemType Directory -Force | Out-Null
}

$DateTime = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

try {
    $Admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction Stop

    $IndividualUsers = $Admins | Where-Object {
        $_.ObjectClass -eq "User" -and
        $_.Name -notmatch "\\Administrator$"
    }

    if ($IndividualUsers) {
        $UserList = ($IndividualUsers.Name -join ", ")
        @"
[$DateTime] Non-Compliant
Individual user account(s) found in Administrators group:
$UserList
"@ | Out-File -FilePath $LogFile -Encoding UTF8
        Write-Output "Non-Compliant: $UserList"
        exit 1
    }
    else {
        @"
[$DateTime] Compliant
No individual user accounts found in Administrators group.
"@ | Out-File -FilePath $LogFile -Encoding UTF8
        Write-Output "Compliant"
        exit 0
    }
}
catch {
    "[$DateTime] ERROR: $_" | Out-File -FilePath $LogFile -Encoding UTF8
    exit 1
}

🛠️ Remediation Script

The remediation script removes any detected individual user accounts from the Administrators group and logs the action.

powershell

# Create log folder if needed
$LogFolder = "C:\Logs"
$LogFile = "$LogFolder\Remediation.txt"

if (!(Test-Path $LogFolder)) {
    New-Item -Path $LogFolder -ItemType Directory -Force | Out-Null
}

$DateTime = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

try {
    $Admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction Stop

    $IndividualUsers = $Admins | Where-Object {
        $_.ObjectClass -eq "User" -and
        $_.Name -notmatch "\\Administrator$"
    }

    if ($IndividualUsers) {
        foreach ($User in $IndividualUsers) {
            try {
                Remove-LocalGroupMember -Group "Administrators" -Member $User.Name -ErrorAction Stop
                Add-Content -Path $LogFile -Value "[$DateTime] Removed user: $($User.Name)"
            }
            catch {
                Add-Content -Path $LogFile -Value "[$DateTime] Failed removing user: $($User.Name) - $_"
            }
        }
        Write-Output "Remediation completed."
    }
    else {
        Add-Content -Path $LogFile -Value "[$DateTime] No individual user accounts found."
    }
    exit 0
}
catch {
    Add-Content -Path $LogFile -Value "[$DateTime] ERROR: $_"
    exit 1
}

⚠️ Important Note

These scripts are provided as a baseline. 👉 Always modify the script as per your organizational requirements — for example, to exclude specific service accounts or tailor logging paths.