{"id":4874,"date":"2023-09-12T08:04:39","date_gmt":"2023-09-12T15:04:39","guid":{"rendered":"https:\/\/SUMMALAI.COM\/?p=4874"},"modified":"2023-09-12T08:04:42","modified_gmt":"2023-09-12T15:04:42","slug":"removing-device-primary-user-from-local-administrator-group-by-using-intune-profiles","status":"publish","type":"post","link":"https:\/\/SUMMALAI.COM\/?p=4874","title":{"rendered":"Removing Device Primary User from Local Administrator Group by Using Intune Profiles"},"content":{"rendered":"\n<p>First off, if you are still pondering the age old question \u201cShould my users be local admin or not\u201d I\u2019m gonna help you right here: No, No, a Thousand Times No\u3002 The only good reason I can think of for letting your users be local administrators is if you have too much money &amp; time on your hands and could use a ransomware or two this year to slow down production. I\u2019m not gonna spend more time on it here but if you want more input\u00a0Sami Laiho\u00a0has some really great posts and talks about the subject that really removes all doubt. So now that we\u2019ve resolved the question on local admin or not, the next questions comes to how we go about doing this in Intune\/Endpoint Manager. Intune provides a great way of doing so using Autopilot, but since autopilot is easier said than done for a lot of people &amp; situations there might be a lot of devices with users ending up as local admin<\/p>\n\n\n\n<p>Note: This is for Azure AD Only \/ Cloud Only Devices<\/p>\n\n\n\n<p>P.S There will be some discussions on LAPS \/ One time passwords at the last chapter<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Solution<\/h2>\n\n\n\n<p>So let\u2019s head on to the how\u2019s about removing local admin rights, and it\u2019s really not magical or revolutionary. So as some of you may have noted Intune does provide a profile that allows you to modify the local admin group, but it\u2019s not super easy to get around to understand and since I\u2019ve noted some people get errors even when creating the profile and others get tons of errors in the Intune Portal<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/usercontent.one\/wp\/www.smthwentright.com\/wp-content\/uploads\/2022\/07\/intune_errors.png?media=1646692602\"><img decoding=\"async\" src=\"https:\/\/usercontent.one\/wp\/www.smthwentright.com\/wp-content\/uploads\/2022\/07\/intune_errors-947x1024.png?media=1646692602\" alt=\"\" class=\"wp-image-238\"\/><\/a><figcaption>Common view of the Intune Profile (No lackluster Visio this time but some sweet Intune errors to make up for it)<\/figcaption><\/figure>\n\n\n\n<p>The reason for the policy generating errors or generally not yielding the results people wants has been varying, but one of the most common one\u2019s has to do with the OS language being different on different machines, and to this my colleague came up with a simple and brilliant solution<\/p>\n\n\n\n<p>So the goal of today is to create a policy that removes any user from the local administrator group that works on all devices without generating any errors (in as few steps as possible), and to do this we\u2019re going to do this without scripts only using Intune profiles<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">What we need<\/h4>\n\n\n\n<ul class=\"wp-block-list\"><li>An Azure AD joined device<ul><li>To view the contents of the local administrator group<\/li><\/ul><\/li><li>2 Intune Profiles<ul><li>1 profile that dictates the contents of the local administrator group<\/li><li>1 profile that renames the local administrator account<\/li><\/ul><\/li><\/ul>\n\n\n\n<p>Thats it! Only a few steps to get this to work<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Azure AD joined device<\/h4>\n\n\n\n<p>Okey, to start this off we\u2019re gonna take a look at the contents of the local administrators group on an Azure AD joined device. You can access the local administrators group with the shortcut&nbsp;<strong>lusrmgr.msc<\/strong><\/p>\n\n\n\n<p>Make sure you have local administrative access to the device<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Hit the Windows Button and search for&nbsp;<strong>lusrmgr.msc<\/strong>, right click&nbsp;<strong>Run as administrator<\/strong><\/li><li>Open&nbsp;<strong>Groups<\/strong><\/li><li>Open&nbsp;<strong>Administrators&nbsp;<\/strong>group (Different name in depending on OS language)<\/li><\/ol>\n\n\n\n<p>When we open the group its gonna look like this:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/usercontent.one\/wp\/www.smthwentright.com\/wp-content\/uploads\/2022\/07\/Local-Admin-Group.png?media=1646692602\"><img decoding=\"async\" src=\"https:\/\/usercontent.one\/wp\/www.smthwentright.com\/wp-content\/uploads\/2022\/07\/Local-Admin-Group.png?media=1646692602\" alt=\"\" class=\"wp-image-243\"\/><\/a><figcaption>Contents of the local administrators group<\/figcaption><\/figure>\n\n\n\n<p>There\u2019s going to be the local administrators account, the User Account that is current local administrator and 2 long SID\u2019s<\/p>\n\n\n\n<p>First off, the local administrator account needs to be there, we cannot remove it from the Administrators group but as this is an Intune \/ Azure AD joined device its disabled by default and has no password<\/p>\n\n\n\n<p>Then we have the User Account that has enrolled the device, which if its not an Autopilot device will automatically become local administrator<\/p>\n\n\n\n<p>Then we have the 2 longs SID\u2019s that will be on all Azure AD joined devices per default,<\/p>\n\n\n\n<p>One of them is the Azure AD Role group for \u201cGlobal Administrator\u201d and the other one is the Azure AD Role group for \u201cLocal device administrators\u201d. So if we want Global administrators and the group for Local device administrators to continue to work, we need to keep them in the local administrators group<\/p>\n\n\n\n<p>We can view the users in the local device administrators role group in Azure AD<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Open&nbsp;<strong>Azure AD<\/strong><\/li><li>Navigate to the&nbsp;<strong>Devices&nbsp;<\/strong>blade<\/li><li>Navigate to&nbsp;<strong>Device settings<\/strong><\/li><li>Click on&nbsp;<strong>Manage Additional local administrators on all Azure AD joined devices<\/strong>&nbsp;at the bottom of the page<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/usercontent.one\/wp\/www.smthwentright.com\/wp-content\/uploads\/2022\/07\/Manage-additional-local-administrators-1.png?media=1646692602\"><img decoding=\"async\" src=\"https:\/\/usercontent.one\/wp\/www.smthwentright.com\/wp-content\/uploads\/2022\/07\/Manage-additional-local-administrators-1-1024x624.png?media=1646692602\" alt=\"\" class=\"wp-image-255\"\/><\/a><figcaption>How to view the role for local administrators<\/figcaption><\/figure>\n\n\n\n<p>Depending of if you used this Group up until now or not this maybe empty or populated with the correct administrators for your devices<\/p>\n\n\n\n<p>So if we wanna keep both of these groups as local administrators we can just copy them from our Azure AD joined device. But to find out which is which we will need to resort to our lord and savior; PowerShell<\/p>\n\n\n\n<p>Before we open PowerShell make sure to add at least one User to the&nbsp;<strong>Additional local administrators on all Azure AD joined devices<\/strong>&nbsp;page, if not it won\u2019t show up<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Open PowerShell<\/li><li>Make sure you have the Module AzureAD installed<ol><li>If you need to install the PowerShell module make sure PowerShell is started as Administrator<\/li><li>Type&nbsp;<strong>Install-Module AzureAD<\/strong><\/li><li>Accept the install<\/li><\/ol><\/li><li>Type&nbsp;<strong>Connect-AzureAD<\/strong><\/li><li>Sign in with an account with privilege\u2019s to read the AzureAD Directory<\/li><li>Type&nbsp;<strong>Get-AzureADDirectoryRole<\/strong>&nbsp;(More information on the command and on the module can be found on the&nbsp;<a rel=\"noreferrer noopener\" href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/azuread\/get-azureaddirectoryrole?view=azureadps-2.0\" target=\"_blank\">Microsoft Docs<\/a>)<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/usercontent.one\/wp\/www.smthwentright.com\/wp-content\/uploads\/2022\/07\/Get-AzureADRoles.png?media=1646692602\"><img decoding=\"async\" src=\"https:\/\/usercontent.one\/wp\/www.smthwentright.com\/wp-content\/uploads\/2022\/07\/Get-AzureADRoles.png?media=1646692602\" alt=\"\" class=\"wp-image-244\"\/><\/a><figcaption>Azure AD Roles with Objective ID column returned<\/figcaption><\/figure>\n\n\n\n<p>Now we\u2019re going to convert those object ID\u2019s to SID\u2019s using a awesome function that&nbsp;<a rel=\"noreferrer noopener\" href=\"https:\/\/oliverkieselbach.com\/2020\/05\/13\/powershell-helpers-to-convert-azure-ad-object-ids-and-sids\/\" target=\"_blank\">Oliver Kieselbach<\/a>&nbsp;made a while back.<\/p>\n\n\n\n<p>Automation Account Script<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>12345678910111213141516171819202122232425262728<\/td><td>Function Convert-AzureAdObjectIdToSid {&nbsp;&nbsp;&nbsp;&nbsp;&lt;#&nbsp;&nbsp;&nbsp;&nbsp;.SYNOPSIS&nbsp;&nbsp;&nbsp;&nbsp;Convert an Azure AD Object ID to SID&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;.DESCRIPTION&nbsp;&nbsp;&nbsp;&nbsp;Converts an Azure AD Object ID to a SID.&nbsp;&nbsp;&nbsp;&nbsp;Author: Oliver Kieselbach (oliverkieselbach.com)&nbsp;&nbsp;&nbsp;&nbsp;The script is provided &#8220;AS IS&#8221; with no warranties.&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;.PARAMETER ObjectID&nbsp;&nbsp;&nbsp;&nbsp;The Object ID to convert&nbsp;&nbsp;&nbsp;&nbsp;#&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;param([String] $ObjectId)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$bytes = [Guid]::Parse($ObjectId).ToByteArray()&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$array = New-Object &#8216;UInt32[]&#8217; 4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[Buffer]::BlockCopy($bytes, 0, $array, 0, 16)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$sid = &#8220;S-1-12-1-$array&#8221;.Replace(&#8216; &#8216;, &#8216;-&#8216;)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return $sid&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;$objectId = &#8220;INSERT OJBECT ID FROM AZURE HERE&#8221;$SID = Convert-AzureAdObjectIdToSid -ObjectId $objectIdWrite-Output $SID<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<ol class=\"wp-block-list\"><li>Copy the code to a PowerShell ISE Window (or ISE or IDE of your choice)<\/li><li>Edit the Object ID on Line 26 to the Object ID returned in the previous steps for&nbsp;<strong>Azure AD Joined Device Local Administrator<\/strong>&nbsp;and&nbsp;<strong>Global Administrator<\/strong>&nbsp;(one at the time)<\/li><li>Run the Script and the same SID\u2019s we saw in the local administrators group should be returned!<\/li><\/ol>\n\n\n\n<h4 class=\"wp-block-heading\">Intune Profiles<\/h4>\n\n\n\n<p>Now that we have all the information from the local administrators group, let\u2019s head on to Intune to create our 2 profiles<\/p>\n\n\n\n<p>As I mentioned before, we\u2019re gonna try to get this done without errors and with multiple language support. So one of our issues we\u2019re gonna run into later is when we create the profile that dictates the content of the local administrator group, we\u2019re gonna need to know the name of the local administrators account, because as mentioned windows requires the local admin account to be in the local admin group. So first off we\u2019re gonna create a policy that renames the local admin account so its the same on all devices<\/p>\n\n\n\n<p>In Intune:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Navigate to&nbsp;<strong>Devices<\/strong><\/li><li>Navigate to&nbsp;<strong>Windows<\/strong><\/li><li>Navigate to&nbsp;<strong>Configuration profiles<\/strong><\/li><li>Chose&nbsp;<strong>Create profile<\/strong><\/li><li>Platform:&nbsp;<strong>Windows 10 and later<\/strong>&nbsp;Profile Type:&nbsp;<strong>Settings catalog<\/strong><\/li><li>Chose a Fitting name for your profile, I chose \u201cRename Local Administrator Account\u201d but it doesn\u2019t matter<\/li><li>Chose&nbsp;<strong>Add Settings<\/strong><\/li><li>Search for&nbsp;<strong>Local Policies Security Options<\/strong><\/li><li>Chose&nbsp;<strong>Local Policies Security Options<\/strong><\/li><li>When the list appears chose&nbsp;<strong>Accounts Rename Administrator Account<\/strong><\/li><li>Then rename it to whatever you want it called, I chose \u201cAdministrator\u201d but it doesn\u2019t matter<\/li><li>Chose&nbsp;<strong>Next<\/strong><\/li><li>Assign it<\/li><\/ol>\n\n\n\n<p>Okey, now we have a the same name of the local administrator on all devices, lets move on to creating the Users and Groups profile<\/p>\n\n\n\n<p>In Intune:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Navigate to&nbsp;<strong>Endpoint Security<\/strong><\/li><li>Navigate to Account protection<\/li><li>Chose&nbsp;<strong>Create profile<\/strong><\/li><li>Platform:&nbsp;<strong>Windows 10 and later<\/strong>&nbsp;Profile Type:&nbsp;<strong>Local user group membership<\/strong><\/li><li>Chose a Fitting name for your profile, I chose \u201cLocal Administrator Group Membership\u201d but it doesn\u2019t matter<\/li><li>For Local Group: Select&nbsp;<strong>Administrators<\/strong><\/li><li>Then for Group and user action we have 3 alternatives, before we move on lets explain them<ol><li>Add (Update) \u2013 Choosing this option will just add whatever user you chose to the group you chose, simple<\/li><li>Remove (Update) \u2013 This will remove the users you chose, but you have to specify exactly which one, so we cant use this to remove our users from local administrator<\/li><li>Add (Replace) \u2013 This will remove all users in the group you specify and add the users \/ groups you specify<\/li><\/ol><\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/usercontent.one\/wp\/www.smthwentright.com\/wp-content\/uploads\/2022\/07\/Local-users-and-grousp-profile.png?media=1646692602\"><img decoding=\"async\" src=\"https:\/\/usercontent.one\/wp\/www.smthwentright.com\/wp-content\/uploads\/2022\/07\/Local-users-and-grousp-profile.png?media=1646692602\" alt=\"\" class=\"wp-image-249\"\/><\/a><figcaption>Add, Remove, Replace<\/figcaption><\/figure>\n\n\n\n<ol class=\"wp-block-list\" start=\"8\"><li>Chose&nbsp;<strong>Add (Replace)<\/strong>&nbsp;as we already have our full list of users\/groups we want, and what we are trying trying to achieve is to make sure nothing else is in the Local Administrators group this fits us perfectly<\/li><li>User selection type:&nbsp;<strong>Manual<\/strong><\/li><li>Click&nbsp;<strong>Add users<\/strong><\/li><li>Add the 2 SID\u2019s we extracted earlier and the username of the Local Administrators account we decided on in the previous profile<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/usercontent.one\/wp\/www.smthwentright.com\/wp-content\/uploads\/2022\/07\/Local-users-and-grousp-profile2.png?media=1646692602\"><img decoding=\"async\" src=\"https:\/\/usercontent.one\/wp\/www.smthwentright.com\/wp-content\/uploads\/2022\/07\/Local-users-and-grousp-profile2-1024x183.png?media=1646692602\" alt=\"\" class=\"wp-image-250\"\/><\/a><\/figure>\n\n\n\n<ol class=\"wp-block-list\" start=\"12\"><li>Chose&nbsp;<strong>OK<\/strong>&nbsp;then&nbsp;<strong>Next<\/strong><\/li><li>Assign it<\/li><\/ol>\n\n\n\n<p>Done!<\/p>\n\n\n\n<p>I recommend assigning it to a test device and making sure that you end up with your local admin account, the group SID\u2019s but no end user.<\/p>\n\n\n\n<p>Ref: <a href=\"https:\/\/www.smthwentright.com\/2022\/07\/27\/removing-registered-device-owner-from-local-administrator-group-using-intune-profiles-without-errors-hopefully-multiple-language-support\/\">Removing registered device owner from local administrator group using Intune Profiles \u2013 Without Errors (Hopefully) (Multiple Language support) \u2013 Something went right (smthwentright.com)<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>First off, if you are still pondering the age old question \u201cShould my users be local admin or not\u201d I\u2019m gonna help you right here: No, No, a Thousand Times No\u3002 The only good reason I can think of for letting your users be local administrators is if you have too much money &amp; time <a class=\"read-more\" href=\"https:\/\/SUMMALAI.COM\/?p=4874\">Read More<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[1185,10,14],"tags":[1679,1678],"class_list":["post-4874","post","type-post","status-publish","format-standard","hentry","category-autopilot-intune","category-microsoft","category-windows-7-8-10","tag-removing-device-primary-user-from-local-administrator-group","tag-removing-device-primary-user-from-local-administrator-group-by-using-intune-profiles"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/4874","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4874"}],"version-history":[{"count":1,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/4874\/revisions"}],"predecessor-version":[{"id":4875,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/4874\/revisions\/4875"}],"wp:attachment":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4874"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4874"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4874"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}