Moorfox
PowerShell: list local administrators on a machine
Run Get-LocalGroupMember -Group Administrators. Anything beyond the built-in Administrator, your management account, and expected admin groups deserves a question, especially plain user accounts added "temporarily" during an install and never removed.
Get-LocalGroupMember -Group Administrators |
Select-Object Name, ObjectClass, PrincipalSource |
Format-Table -AutoSizeNotes before you run it
- On some builds the cmdlet fails with an unhelpful error when the group contains an orphaned SID from a deleted account. The fallback is
net localgroup administrators, which prints them anyway; the orphaned entries show as bare SIDs worth removing. ObjectClass Grouprows hide the real membership: a nested domain group can make fifty people admins while this list shows one line.- Remove an entry with
Remove-LocalGroupMember -Group Administrators -Member '<name>'.
What PrincipalSource is telling you
The PrincipalSource column identifies where the account lives. Local means the account exists only on this machine. ActiveDirectory indicates a domain account or group. AzureAD is an Entra ID account, which appears on Intune-joined machines. MicrosoftAccount is a personal Microsoft account, which on a business machine usually means someone is signing in with their own account rather than a managed one.
A blank or Unknown source means the SID no longer resolves. This is the same orphaned entry that breaks the cmdlet.
Expanding nested groups
A single ObjectClass Group row can represent any number of people. On a domain machine the row is often DOMAIN\Domain Admins or a delegated workstation-admin group. Expand it from a machine with the RSAT ActiveDirectory module:
Get-ADGroupMember -Identity "Workstation Admins" -Recursive | Select-Object name, objectClass
-Recursive is the important part, because these groups are routinely nested several levels deep and only the recursive form returns actual user accounts. Without RSAT, net group "Workstation Admins" /domain lists direct members only.
Running it across many machines
Invoke-Command -ComputerName SERVER1,SERVER2 -ScriptBlock { Get-LocalGroupMember -Group Administrators } runs it remotely and tags each result with PSComputerName. This needs WinRM enabled and reachable, which is the usual reason it fails in a workgroup.
The WMI equivalent works where WinRM does not and resolves nested entries as flat paths:
Get-CimInstance Win32_GroupUser | Where-Object { $_.GroupComponent -match 'Administrators' }
It is slower and its output is harder to read, so it is a fallback rather than a first choice.
Finding out who added someone
Windows logs Security event ID 4732 when a member is added to a security-enabled local group, and 4733 when one is removed. The event records who performed the change, not just who was added. It only exists if the "Audit Security Group Management" policy is enabled, which is not on by default on workstations, and it only covers the period still in the log.
Query it with
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732} -MaxEvents 50
Turning that audit policy on across the fleet before you need it is the difference between answering the question and guessing.
Frequently asked questions
Why does Get-LocalGroupMember return an error about comparing elements in an array?
The Administrators group contains a SID that no longer resolves to an account, usually from a deleted domain user, and the cmdlet fails rather than skipping it. net localgroup administrators prints the membership anyway and shows the broken entries as bare SIDs, which can then be removed.
Does this work on a domain controller?
No. Domain controllers have no local groups, because promotion moves them into the directory. On a domain controller, query the built-in Administrators group in Active Directory with Get-ADGroupMember -Identity Administrators instead.
How do I list local administrators on a remote computer?
Wrap the cmdlet in Invoke-Command -ComputerName <name>, which needs WinRM. Where WinRM is not available, Get-CimInstance Win32_GroupUser reaches the same information over WMI.
What is the difference between the Administrators group and the Administrator account?
The Administrators group is the set of accounts holding administrative rights on the machine. Administrator is one built-in account inside that group, disabled by default on modern Windows. Removing accounts from the group is what reduces risk; the built-in account being present is expected.
Run it on every machine, not one at a time.
Save any of these as a command in Moorfox and run it on a machine in one click, output and exit code captured, with no PSRemoting or WinRM setup. The agent runs it locally and reports back, even over the internet.