Create a list of local administrators with PowerShell

• Author
• Recent Posts

Sitaram Pamarthi

Sitaram Pamarthi is working as a Windows Engineer and his special fields of interest are PowerShell, Active Directory, Exchange, and virtualization.

Latest posts by Sitaram Pamarthi (see all)

• Add a domain user or group to local administrators with PowerShell - Wed, Mar 19 2014
• Create a list of local administrators with PowerShell - Wed, Mar 5 2014
• Remotely query user profile information with PowerShell - Tue, Nov 26 2013

Systems admins are frequently asked to generate a list of the users/groups who are in the local administrators group. Whereas some people use the net localgroup command to query the members, others use little VB scripts. Since this is a frequent activity for a Windows Administrator, I came up with a PowerShell script that can serve the purpose in an easy way.

The script that I am going to describe helps you query a given number of servers and generate a report in CSV format. This script handles conditions such as server offline and query failures, which it also includes in the CSV. Along with the Group member name, the script also informs you what kind of object it is (user or group) and whether it is a domain object or a local object. For domain objects, the script can also tell which domain (NetBIOS name) the object belongs to.

Script description

The good thing with this script is that it can query any local group on a remote computer. By default, it queries the Administrators group; however, if you want to generate a report for the Remote Desktop Users group, you can do that by passing the group name to the LocalGroupNameparameter of the script.

The code below is the key for the script. As you can see, I am using ADSI WinNT provider to query the group membership of a local group on a remote computer. Using the object returned from the query, I invoke a method that returns the members of the queried group.

$group = [ADSI]"WinNT://$Computer/$LocalGroupName"
$members = @($group.Invoke("Members"))

After I retrieve the list of members in the group, I loop through each member and query their details, such as name, class information, and ADS path. Below is the code that queries this information.

$MemberName = $member.GetType().Invokemember("Name","GetProperty",$null,$member,$null)
$MemberType = $member.GetType().Invokemember("Class","GetProperty",$null,$member,$null)
$MemberPath = $member.GetType().Invokemember("ADSPath","GetProperty",$null,$member,$null)

I used a few regex statements against the ADS path to retrieve domain information for each object. Based on the regex output, the report shows whether each returned object is a domain-level object or a local object. If you want to learn more about regular expressions in PowerShell, several resources are available on the Internet. I referred to the PowerShell cook book to build the regex I used in the script.

The remaining code part of the script is mostly straightforward. Throughout the script, I used Add-Content cmdlets to write the data into a CSV file with comma (,) separation. I feel that is the best way to format the data if you want to import it into Excel to format it further.

PowerShell script

<#
        .Synopsis 
            Gets membership information of local groups in remote computer

        .Description
            This script by default queries the membership details of local administrators group on remote computers. 
			It has a provision to query any local group in remote server, not just administrators group.

        .Parameter ComputerName
            Computer Name(s) which you want to query for local group information

		.Parameter LocalGroupName
			Name of the local group which you want to query for membership information. It queries 'Administrators' group when
			this parameter is not specified

		.Parameter OutputDir
			Name of the folder where you want to place the output file. It creates the output file in c:\temp folder
			this parameter is not used.

        .Example
            Get-LocalGroupMembers.ps1 -ComputerName srvmem1, srvmem2

            Queries the local administrators group membership and writes the details to c:\temp\localGroupMembers.CSV

        .Example
			Get-LocalGroupMembers.ps1 -ComputerName (get-content c:\temp\servers.txt)

		.Example
			Get-LocalGroupMembers.ps1 -ComputerName srvmem1, srvmem2

        .Notes
			Author : Sitaram Pamarthi
			WebSite: http://techibee.com

#>
[CmdletBinding()]
Param(
	[Parameter(	ValueFromPipeline=$true,
				ValueFromPipelineByPropertyName=$true
				)]
	[string[]]
	$ComputerName = $env:ComputerName,

	[Parameter()]
	[string]
	$LocalGroupName = "Administrators",

	[Parameter()]
	[string]
	$OutputDir = "c:\temp"
)

Begin {

	$OutputFile = Join-Path $OutputDir "LocalGroupMembers.csv"
	Write-Verbose "Script will write the output to $OutputFile folder"
	Add-Content -Path $OutPutFile -Value "ComputerName, LocalGroupName, Status, MemberType, MemberDomain, MemberName"
}

Process {
	ForEach($Computer in $ComputerName) {
		Write-host "Working on $Computer"
		If(!(Test-Connection -ComputerName $Computer -Count 1 -Quiet)) {
			Write-Verbose "$Computer is offline. Proceeding with next computer"
			Add-Content -Path $OutputFile -Value "$Computer,$LocalGroupName,Offline"
			Continue
		} else {
			Write-Verbose "Working on $computer"
			try {
				$group = [ADSI]"WinNT://$Computer/$LocalGroupName"
				$members = @($group.Invoke("Members"))
				Write-Verbose "Successfully queries the members of $computer"
				if(!$members) {
					Add-Content -Path $OutputFile -Value "$Computer,$LocalGroupName,NoMembersFound"
					Write-Verbose "No members found in the group"
					continue
				}
			}		
			catch {
				Write-Verbose "Failed to query the members of $computer"
				Add-Content -Path $OutputFile -Value "$Computer,,FailedToQuery"
				Continue
			}
			foreach($member in $members) {
				try {
					$MemberName = $member.GetType().Invokemember("Name","GetProperty",$null,$member,$null)
					$MemberType = $member.GetType().Invokemember("Class","GetProperty",$null,$member,$null)
					$MemberPath = $member.GetType().Invokemember("ADSPath","GetProperty",$null,$member,$null)
					$MemberDomain = $null
					if($MemberPath -match "^Winnt\:\/\/(?<domainName>\S+)\/(?<CompName>\S+)\/") {
						if($MemberType -eq "User") {
							$MemberType = "LocalUser"
						} elseif($MemberType -eq "Group"){
							$MemberType = "LocalGroup"
						}
						$MemberDomain = $matches["CompName"]

					} elseif($MemberPath -match "^WinNT\:\/\/(?<domainname>\S+)/") {
						if($MemberType -eq "User") {
							$MemberType = "DomainUser"
						} elseif($MemberType -eq "Group"){
							$MemberType = "DomainGroup"
						}
						$MemberDomain = $matches["domainname"]

					} else {
						$MemberType = "Unknown"
						$MemberDomain = "Unknown"
					}
				Add-Content -Path $OutPutFile -Value "$Computer, $LocalGroupName, SUCCESS, $MemberType, $MemberDomain, $MemberName"
				} catch {
					Write-Verbose "failed to query details of a member. Details $_"
					Add-Content -Path $OutputFile -Value "$Computer,,FailedQueryMember"
				}

			} 
		}

	}

}
End {}

Script usage

Get local administrator group details for a remote server/desktop and generate output in the c:\temp folder:

Get-LocalGroupMembers.ps1 -ComputerName SRVMEM1

Get local administrator group details for a list of computers in a text file and save the output in the c:\local folder:

Get-LocalGroupMembers.ps1 -ComputerName (Get-Content c:\temp\servers.txt) -OutputDir c:\local

Get Remote Desktop Users group membership details for a list of computers:

Get-LocalGroupMembers.ps1 -ComputerName (Get-Content c:\temp\servers.txt) -LocalGroupName “Remote Desktop Users”

Script output

When you run the script, the output will be similar to the following.

Console output of the PowerShell script

And below is the output CSV report in Excel generated from the above execution. In this output, AD is the NetBIOS name of my test domain.

List of the local administrators in Excel