Local Admin/User Audit - Windows - superseded
| 0 Votes |
Versioning - This is an older version.
| 1 | Local Admin/User Audit - Windows | 11/29/2012 10:30:12 AM |
| 2 | Local Admin/User Audit - Windows | 7/10/2013 10:54:45 AM |
Description
Property Details
Properties
Number of Local Admins
Period
2 days
| * Results in a "string"/number |
number of members whose (it as string contains computer name) of local group "Administrators" as string
Local Admins
Period
2 days
| * Results in a "string"/number |
concatenation ", " of (members whose (it as string contains computer name) of local group "Administrators" as string)
Local Users
Period
1 day
| * Results in a "string"/number |
concatenation ", " of (members whose (it as string contains computer name) of local group "Users" as string)
Relevance
(name of it = "WinXP" OR name of it = "WinXP-2003" OR (name of it = "WinVista" AND product type of it = nt workstation product type AND NOT x64 of it) OR (name of it = "WinVista" AND product type of it = nt workstation product type AND x64 of it) OR (name of it = "Win7" AND NOT x64 of it) OR (name of it = "Win7" AND x64 of it)) of operating system
Sharing
| Social Media: |
Comments
 |
|
| (if it as lowercase starts with computer name as lowercase & "\" then ".\" & following text of first "\" of it else it) of (it as string) of sids of members of local groups whose (component string of sid of it = "S-1-5-32-544") | |
|
|
| A bit late, but I stumbled across this while answering another question. I've posted a method at https://forum.bigfix.com/t/local-admin-users-query/45134/2 to avoid hardcoding the 'Administrators' group name as well as including Domain members, and normalizing all "COMPUTERNAME\member" values into ".\member" for easier filtering across computer names. My final relevance is ` q: (if it as lowercase starts with computer name as lowercase & "\" then ".\" & following text of first "\" of it else it) of (it as string) of sids of members of local groups whose (component string of sid of it = "S-1-5-32-544") ` A: .\Administrator A: .\Jason A: .\admin3 A: D\Domain Admins | |
 |
|
| I'm guessing this does not show domain users who are added to the local admin? Initial run of this is only showing local users that are added.... | |
 |
|
| There might be a way to generalize this relevance to not hardcode the OS language name for the group. I should look into that someday. | |
 |
|
| love this - satisfied an immediate need in no time at all - thank you - looking forward to adding some other fields of interest. | |
 |
|
| rmoe - just substitute "administrator" with the local language equivalent. For instance in French I would have to replace it with "administrateur" | |
|
|
| I'm not certain how the relevance would work for other OS languages. I'm not sure if it handles that automatically, or if you would have to adjust the code for every different language. | |
 |
|
| I wondering how is the relevance for other OS languages? As for the Polish or German OS for example, the local group is not called "Administrators". | |
