The PowerShell script described in this post creates a member list of the local administrator group and export the information to a CSV file.

Sitaram Pamarthi

Sitaram Pamarthi is working as a Windows Engineer and his special fields of interest are PowerShell, Active Directory, Exchange, and virtualization.

Systems admins are frequently asked to generate a list of the users/groups who are in the local administrators group. Whereas some people use the net localgroup command to query the members, others use little VB scripts. Since this is a frequent activity for a Windows Administrator, I came up with a PowerShell script that can serve the purpose in an easy way.

The script that I am going to describe helps you query a given number of servers and generate a report in CSV format. This script handles conditions such as server offline and query failures, which it also includes in the CSV. Along with the Group member name, the script also informs you what kind of object it is (user or group) and whether it is a domain object or a local object. For domain objects, the script can also tell which domain (NetBIOS name) the object belongs to.

Script description ^

The good thing with this script is that it can query any local group on a remote computer. By default, it queries the Administrators group; however, if you want to generate a report for the Remote Desktop Users group, you can do that by passing the group name to the LocalGroupNameparameter of the script.

The code below is the key for the script. As you can see, I am using ADSI WinNT provider to query the group membership of a local group on a remote computer. Using the object returned from the query, I invoke a method that returns the members of the queried group.

After I retrieve the list of members in the group, I loop through each member and query their details, such as name, class information, and ADS path. Below is the code that queries this information.

I used a few regex statements against the ADS path to retrieve domain information for each object. Based on the regex output, the report shows whether each returned object is a domain-level object or a local object. If you want to learn more about regular expressions in PowerShell, several resources are available on the Internet. I referred to the PowerShell cook book to build the regex I used in the script.

The remaining code part of the script is mostly straightforward. Throughout the script, I used Add-Content cmdlets to write the data into a CSV file with comma (,) separation. I feel that is the best way to format the data if you want to import it into Excel to format it further.

PowerShell script ^

Script usage ^

Get local administrator group details for a remote server/desktop and generate output in the c:\temp folder:

Get local administrator group details for a list of computers in a text file and save the output in the c:\local folder:

Get Remote Desktop Users group membership details for a list of computers:

Script output ^

When you run the script, the output will be similar to the following.

Console output of the PowerShell script

Console output of the PowerShell script

And below is the output CSV report in Excel generated from the above execution. In this output, AD is the NetBIOS name of my test domain.

List of the local administrators in Excel

List of the local administrators in Excel

Win the monthly 4sysops member prize for IT pros

Share
0

Related Posts

36 Comments
  1. MuuKaan 3 years ago

    Excellent post, thanks

    0

  2. Avioza 3 years ago

    This has been most helpful. Thank you for sharing!

    0

  3. Brett 3 years ago

    Is ther a way to modify this to include remote desktop users by default?

    0

  4. Tony Scotti 3 years ago

    This was extremely useful and easy to use. Exactly what I need! Thank you!

    0

  5. Abdu Alhatmi 3 years ago

    Dear Sitaram Pamarthi

    Really it's very helpful, Thanx.
    a question: How can i modify it to list just the local administrator?

    0

  6. SCSQL 3 years ago

    Hello...Sitaram..
    This was very helpful. Is there a way I can pass credentials to this script?

    Appreciate your help!

    0

  7. Oded 3 years ago

    This was perfect.

    0

  8. Tom 3 years ago

    Hello Sitaram,

    I've successfully deployed this script with:
    Get-LocalGroupMembers.ps1 -ComputerName Desktop1 and with a comma delimiter with multiple entries. However, when I link the PS file to a text file with the Get-Content command all the entries appear 'Offline' inside the csv file. Within the text file I tried different delimiters but received the same results.
    Any suggestions are welcome. Thank you.

    0

  9. Erik Curtis 3 years ago

    I agree with Tom. I would like to run this script and user Active Directory as the source for Computers. In addition, it would be helpful to have the ability to exclude certain names from the list such as Domain Admins.

    0

  10. Rachna 3 years ago

    Hi Sitaram,

    Could you please suggest if we can get the date of user created on domain as well local system.

    0

  11. Jason 3 years ago

    Awesome script! Can I get the display name for the "local" accounts, and also add some other domain account properties like Office Location, Manager name, Title?

    0

  12. rino 2 years ago

    excellent post! works out of the box.

    however, the headers keep getting duplicated for each run. using the same filename 🙂

    0

  13. Ishant 2 years ago

    Very Useful, Excellent Script and explanation.

    Please share me the link to other scripts you have shared.

    0

  14. Charles 2 years ago

    your hard work does not go un-noticed. Thank you for sharing. Well executed and thought out. Great Script!

    0

  15. Liam 2 years ago

    Great script and such valuable output as well

    0

  16. Fer 2 years ago

    This is majestic. I love you. I freaking love you man.

    0

  17. Reggie 2 years ago

    That's Great. I try to input the record one by one is fine.

    But I try to use .txt file or more than one record it will show error. Any idea?

    A positional parameter cannot be found that accepts argument 'rd0028'

    ParentContainsErrorRecordException

    0

  18. Norm 2 years ago

    Totally useful script!  Thanks so much for making and posting it 🙂

    0

  19. Dave 1 year ago

    not working for remoting - error:

     

    PS C:\Windows\system32> [ADSI]"WinNT://$Computer/$LocalGroupName"
    format-default : The following exception occurred while retrieving member "distinguishedName": "The group name could not be found.
    "
    + CategoryInfo          : NotSpecified: (:) [format-default], ExtendedTypeSystemException
    + FullyQualifiedErrorId : CatchFromBaseGetMember,Microsoft.PowerShell.Commands.FormatDefaultCommand

    0

  20. Dave 1 year ago

    Found the problem: remote computer's OS was in french, so localgroupname should be adapted

    $LocalGroupName = "Administrateurs",

     

    0

  21. Kedar Kulkarni 1 year ago

    Hi Sitaram

    First of all thank you very much for your great efforts.  I copied the script and tested on 3 different types of remote computers.

    Windows XP Professional

    Windows 10 Enterprise

    Windows 2012 Server R2

    However, in all my attempts I get the name of the groups that are added as local administrators in above mentioned computers however the script fails to retrieve the list of users and error "FailedQueryMember" is shown in the csv.  Appreciate if you could kindly extend your help to troubleshoot this error.

     

     

    2+

    • OLLIVIER Arthur 1 year ago

      Hello
      Kedar Kulkarni
      I also have windows 10 and I find the same error as you in the "csv" it is written "FailedQueryMember"!
      Did you find a solution?

      Thanks for avence

      0

  22. Filipe 1 year ago

    Thanks for the script. Worked flawless for me.

    0

  23. Suja 1 year ago

    Thank you for the script. Worked with out any issues!

    0

  24. Jared 1 year ago

    I am having the same issue as Kedar Kulkarni above.  I get the error [FailedQueryMember] for each device.  I have tried the computer name, FQDN, IP...everything gives me that error.  I am running the .ps1 as an admin account.  Any ideas?

    0

  25. Ole Toxværd 1 year ago

    SUPER script 🙂

    0

    • Dan 1 year ago

      Ole, I see you got it working so I am hoping you can help me. I can run the script as is and it lists what I need for MY computer, but I have a CSV file I want to use, but cannot figure out what to put where in the script.

      Can you tell me what to put and where in the existing code? For this example assume I have c:\list\computers.csv

      Thank you in advance

      0

  26. Derek 1 year ago

    I was having issues getting the script to read a list of computer names from a text file, inspired by Erik's complaint above I came up with a way to read the computer objects from AD directly into the script.  This also allowed the script to work properly for me!

    Get-ADComputer -filter * | select-object Name | Foreach-Object {.\Get-LocalGroupMembers.ps1 -ComputerName $_.Name}

    Thanks to Sitaram, hope my variant here helps someone else as well.

    0

  27. Althaf 1 year ago

    EXTRACT GROUP MEMBERS DETAILS USING POWERSHELL

    =============================

    To get from Same domain

    Get-ADGroupMember "domain admins.contoso.com" | select-object name >>groupdetails.csv

    Get-ADGroupMember "domain admins" | select-object name >>groupdetails.csv

     

    To Get from another trusted domain

    Get-ADGroupMember "Remote Admin" -Server "eu.contoso.com" | select-object name,objectclass >>groupdetails1.csv

    0

  28. Dan 1 year ago

    I left for Ole, but if anyone can assist I would greatly appreciate it. I will post the same here so sorry for duplicate:

    I see you got it working so I am hoping you can help me. I can run the script as is and it lists what I need for MY computer, but I have a CSV file I want to use, but cannot figure out what to put where in the script.

    Can you tell me what to put and where in the existing code? For this example assume I have c:\list\computers.csv and it looks like

    computer1

    computer2

     

    Thank you in advance

    0

  29. Thajudeen 12 months ago

    It is working good. Thanks a lot

    0

    • ArthurOLL 12 months ago

      Hello Thajudeen,

      The script does not find my pc administrator accounts and makes me an empty file.
      can you give me the script that you used with your Setup?

       

      Thanks .

      0

  30. Rupesh 11 months ago

    Excellent post. it worked for me what i need.

    0

  31. Don 10 months ago

    Hi Sitaram!

    Thanks for this very helpful post.

    However, when I run the below script on powershell, it only gets the local group accounts on the server itself.

    The output that I'm trying to get is all local administrator accounts of all servers or computer s connected to a domain controller. Which will be recorded to "localGroupMembers.CSV" file. Is this possible to retrieve?

    Hoping for your prompt response.

    Thanks in advance.

    0

  32. ITGal 8 months ago

    This was exactly what I was looking for and worked perfectly. However, does anyone know how to get the status of the account (i.e. enabled, disabled)?

     

    0

  33. Kit 1 month ago

    0

Leave a reply

Your email address will not be published. Required fields are marked *

*

CONTACT US

Please ask IT administration questions in the forum. Any other messages are welcome.

Sending
© 4sysops 2006 - 2017

Log in with your credentials

or    

Forgot your details?

Create Account