Windows Unauthorized Admins Script

<#
This resource is provided as a convenience for Level users. We cannot 
guarantee it will work in all environments. Please test before deploying 
to your production environment. We welcome contributions to our community 
library

Level Library
https://level.io/library/script-windows-unauthorized-admins
#>

$AuthorizedAdmins = "{{cf_authorized_admins}}"

# Get all local admins that are enabled
$admins = Get-LocalGroupMember -Group "Administrators" | 
          Where-Object { $_.ObjectClass -eq 'User' -and (Get-LocalUser $_.SID).Enabled -eq $true } | 
          Select-Object -ExpandProperty Name

# Extract just the username by splitting on '\' and taking the last part
$admins = $admins | ForEach-Object { ($_ -split '\\')[-1] }
$detectedAdmins = $admins -join ","

# Join the usernames into a single string separated by commas
$detectedArray = $detectedAdmins -split ',' | ForEach-Object { $_.Trim().ToLower() }
$authorizedArray = $AuthorizedAdmins -split ',' | ForEach-Object { $_.Trim().ToLower() }

# Find admins in detected list but not in authorized list
# Convert both to lowercase for case-insensitive comparison
$unauthorizedAdmins = $detectedArray | Where-Object { $authorizedArray -notcontains $_ }

# Output unauthorized admins separated by commas
$unauthorizedString = $unauthorizedAdmins -join ','

if ($unauthorizedAdmins.Count -gt 0) {
    Write-Output "Unauthorized Admins ALERT: $unauthorizedString"
    exit 1
} else {
    Write-Output "No unauthorized admins detected."
    exit 0
}