Remediation Script to Detect & Delete IT Admin Account
Updated: Jan 12
If you want to create a Remediation Script for detecting and removing an account with Microsoft Intune, you can proceed by following these instructions:
Sign in to the Microsoft Endpoint Manager admin center:
Go to https://endpoint.microsoft.com and sign in with your admin credentials.
Navigate to Endpoint security:
In the Microsoft Endpoint Manager admin center, go to "Devices" > "Scripts & Remediations" > "+ Create.
3. Basics:
Enter the Policy Name and click Next.
4. Settings:
Follow the below steps.
Select detection script file.
Select remediation script file.
Run this script using the logged-on credentials: Yes
Enforce script signature check: No
Run script in 64-bit PowerShell: Yes
Click next.
5. Assign the policy:
After configuring the policy, proceed to assign it to the appropriate groups within your organization.
You can choose to assign it to all devices, specific groups, or all users based on your organizational needs.
6. Review and create:
Review the settings you've configured to ensure they align with your organization's security policies.
Once you're satisfied, click "Create" to create the Remediation policy.
7. Monitor and troubleshoot:
After the policy is created and assigned, monitor its deployment to ensure its effectively giving you the results as needed.
If any issues arise, use the Intune console to troubleshoot and make necessary adjustments to the policy.
Script for Remediation to Identify and Remove Local IT Account.
1. Script to Detect Local IT Account
$userName = "ITS"
$Userexist = (Get-LocalUser).Name -Contains $userName
if ($userexist) {
Write-Host "$userName exist"
Exit 1
}
Else {
Write-Host "$userName does not exist"
Exit 0
}
2. Script to Delete Local IT Account
$userName = "ITS"
$userexist = (Get-LocalUser).Name -Contains $userName
if($userexist) {
try{
Remove-LocalUser -Name $username
Exit 0
}
Catch {
Write-error $_
Exit 1
}
}
Comments