Problem overview
This script addresses the challenge of managing local administrator privileges in Windows environments, where it can be difficult to discern which accounts hold elevated rights and whether those accounts remain enabled. By providing a clear overview of current local admins, it empowers IT professionals and MSPs to comply with security best practices and avert potential unauthorized access.
<#
This resource is provided as a convenience for Level users. We cannot
guarantee it will work in all environments. Please test before deploying
to your production environment. We welcome contributions to our community
library
Level Library
https://level.io/library/script-windows-get-local-admins
#>
# Get all local admins that are enabled
$admins = Get-LocalGroupMember -Group "Administrators" |
Where-Object { $_.ObjectClass -eq 'User' -and (Get-LocalUser $_.SID).Enabled -eq $true } |
Select-Object -ExpandProperty Name
# Extract just the username by splitting on '\' and taking the last part
$admins = $admins | ForEach-Object { ($_ -split '\\')[-1] }
# Join the usernames into a single string separated by commas
$detectedAdmins = $admins -join ","
# Output for verification
Write-Output $detectedAdminsThe script examines the local Administrators group on a Windows system, filtering out only those accounts that are actively enabled. It then consolidates these account names into a comma-separated list, ensuring that you have a concise snapshot of all active admins. By returning an easy-to-read output, it streamlines privilege oversight and helps administrators rapidly identify any unexpected or unnecessary elevated privileges.
Because Level runs scripts with system-level permissions, no additional elevation is required. Once executed, you’ll have a swift and reliable means of auditing local administrative rights without complicated workarounds or manual checks.
Use cases
- Quickly auditing local admin privileges for compliance
- Identifying dormant but enabled admin accounts
- Spot-checking user elevations after onboarding or offboarding
- Monitoring unauthorized privilege assignments on critical systems
Recommendations
- Configure a script-based monitor in Level to run on demand whenever you suspect unauthorized changes in local admin privileges.
- For regular checks, create a Level automation with a schedule trigger to run this script automatically at set intervals.
- Always test the script in a non-production environment to confirm output accuracy.
- Review detected admins against known policies to ensure only appropriate users have elevated access.