PowerShell: list local administrators on a machine
The script
Run Get-LocalGroupMember -Group Administrators. Anything beyond the built-in Administrator, your management account, and expected admin groups deserves a question, especially plain user accounts added "temporarily" during an install and never removed.
Get-LocalGroupMember -Group Administrators |
Select-Object Name, ObjectClass, PrincipalSource |
Format-Table -AutoSizeNotes before you run it
- On some builds the cmdlet fails with an unhelpful error when the group contains an orphaned SID from a deleted account. The fallback is
net localgroup administrators, which prints them anyway; the orphaned entries show as bare SIDs worth removing. ObjectClass Grouprows hide the real membership: a nested domain group can make fifty people admins while this list shows one line.- Remove an entry with
Remove-LocalGroupMember -Group Administrators -Member '<name>'.
Run it on every machine, not one at a time.
Save any of these as a command in Moorfox and run it on a machine in one click, output and exit code captured, with no PSRemoting or WinRM setup. The agent runs it locally and reports back, even over the internet.