PowerShell: Windows – Discover Local Admins Across Every Workstation

.\Find-UnapprovedLocalAdmins.ps1 -ComputerName WKS-0142, WKS-0198, WKS-0203

$workstations = Get-ADComputer -Filter 'Enabled -eq $true' -SearchBase "OU=Workstations,DC=corp,DC=example,DC=com" |
    Select-Object -ExpandProperty Name

.\Find-UnapprovedLocalAdmins.ps1 -ComputerName $workstations -ExpectedAdmins "Administrator", "Domain Admins", "CORP\Workstation Admins", "lapsadmin"

Checking 3 computer(s) with a throttle limit of 32 ...
WKS-0142: 1 unapproved member(s) found
WKS-0198: no unapproved members (net.exe fallback)
WARNING: Failed WKS-0203: Connecting to remote server WKS-0203 failed with the following error message : WinRM cannot complete the operation...
Flagged members written to .\unapproved-local-admins.csv
WARNING: Unreachable or failed computers: WKS-0203

"ComputerName","Name","SID","ObjectClass","PrincipalSource","Method"
"WKS-0142","CORP\jsmith","S-1-5-21-<domain>-4127","User","ActiveDirectory","Get-LocalGroupMember"

<#
.SYNOPSIS
    Enumerates the local Administrators group on a list of Windows computers and
    flags members that are not on an approved allowlist.
.DESCRIPTION
    Over PowerShell remoting, reads the members of the built-in Administrators group
    by its well-known SID (S-1-5-32-544) so it works on localized builds. If
    Get-LocalGroupMember throws (for example on the orphaned-SID bug, "Failed to
    compare two elements in the array"), falls back to net.exe localgroup on that
    computer. Compares each member with -ExpectedAdmins and writes unapproved members
    to a CSV.
.PARAMETER ComputerName
    One or more computer names to check.
.PARAMETER ComputerListPath
    Path to a text file with one computer name per line, used when -ComputerName
    is not supplied.
.PARAMETER ExpectedAdmins
    Approved members as short names, DOMAIN\name, or SIDs.
.PARAMETER OutputPath
    Path to the CSV of flagged members. Defaults to .\unapproved-local-admins.csv.
.PARAMETER ThrottleLimit
    Maximum number of concurrent remote connections. Defaults to 32.
.EXAMPLE
    .\Find-UnapprovedLocalAdmins.ps1 -ComputerListPath C:\Lists\workstations.txt -ExpectedAdmins "Administrator", "Domain Admins"
.NOTES
    Author  : Thomas Lasswell (https://www.techcolumnist.com)
    Version : 1.0 (2025-10-08)
    Requires: PowerShell remoting on targets; Windows 10 / Server 2016+ for Get-LocalGroupMember
#>
[CmdletBinding()]
param(
    [string[]]$ComputerName,

    [string]$ComputerListPath,

    [string[]]$ExpectedAdmins = @("Administrator", "Domain Admins"),

    [string]$OutputPath = ".\unapproved-local-admins.csv",

    [int]$ThrottleLimit = 32
)

if (-not $ComputerName) {
    if (-not $ComputerListPath -or -not (Test-Path -Path $ComputerListPath)) {
        throw "Supply -ComputerName or a valid -ComputerListPath."
    }

    $ComputerName = Get-Content -Path $ComputerListPath | Where-Object { $_.Trim() -ne "" } | ForEach-Object { $_.Trim() }
}

$ComputerName = @($ComputerName | Sort-Object -Unique)
Write-Host "Checking $($ComputerName.Count) computer(s) with a throttle limit of $ThrottleLimit ..."

# The script block that runs on each remote computer.
$membershipScript = {
    $adminSid = "S-1-5-32-544"

    try {
        Get-LocalGroupMember -SID $adminSid -ErrorAction Stop | ForEach-Object {
            [pscustomobject]@{
                ComputerName    = $env:COMPUTERNAME
                Name            = $_.Name
                SID             = $_.SID.Value
                ObjectClass     = $_.ObjectClass
                PrincipalSource = "$($_.PrincipalSource)"
                Method          = "Get-LocalGroupMember"
            }
        }
    } catch {
        # Fallback: resolve the localized group name from the SID and parse net.exe output.
        $sidObject = New-Object System.Security.Principal.SecurityIdentifier($adminSid)
        $groupName = ($sidObject.Translate([System.Security.Principal.NTAccount]).Value -split "\\")[-1]
        $output = @(& net.exe localgroup "$groupName")

        $dashIndex = -1
        for ($i = 0; $i -lt $output.Count; $i++) {
            if ($output[$i] -match "^-{5,}") {
                $dashIndex = $i
                break
            }
        }

        if ($dashIndex -ge 0) {
            # Members follow the dashed line; the last non-empty line is the completion message.
            $output[($dashIndex + 1)..($output.Count - 1)] |
                Where-Object { $_.Trim() -ne "" } |
                Select-Object -SkipLast 1 |
                ForEach-Object {
                    [pscustomobject]@{
                        ComputerName    = $env:COMPUTERNAME
                        Name            = $_.Trim()
                        SID             = $null
                        ObjectClass     = $null
                        PrincipalSource = $null
                        Method          = "net.exe"
                    }
                }
        }
    }
}

# Return $true when a member matches any allowlist entry by SID, full name or short name.
function Test-Approved {
    param (
        $Member,
        [string[]]$Allowlist
    )

    $shortName = ($Member.Name -split "\\")[-1]

    foreach ($entry in $Allowlist) {
        if ($Member.SID -and $entry -eq $Member.SID) { return $true }
        if ($entry -eq $Member.Name) { return $true }
        if ($entry -notlike "*\*" -and $entry -eq $shortName) { return $true }
    }

    return $false
}

$parentJob = Invoke-Command -ComputerName $ComputerName -ScriptBlock $membershipScript -AsJob -ThrottleLimit $ThrottleLimit
$parentJob | Wait-Job | Out-Null

$flagged = New-Object System.Collections.Generic.List[object]
$failures = New-Object System.Collections.Generic.List[string]

foreach ($child in $parentJob.ChildJobs) {
    $target = $child.Location

    if ($child.State -eq "Failed") {
        $failures.Add($target)
        Write-Warning "Failed $target`: $($child.JobStateInfo.Reason.Message)"
        continue
    }

    $members = @(Receive-Job -Job $child -ErrorAction SilentlyContinue |
        Select-Object -Property ComputerName, Name, SID, ObjectClass, PrincipalSource, Method)
    $unapproved = @($members | Where-Object { -not (Test-Approved -Member $_ -Allowlist $ExpectedAdmins) })
    $note = if ($members.Count -gt 0 -and $members[0].Method -eq "net.exe") { " (net.exe fallback)" } else { "" }

    if ($unapproved.Count -gt 0) {
        $flagged.AddRange([object[]]$unapproved)
        Write-Host "$target`: $($unapproved.Count) unapproved member(s) found$note"
    } else {
        Write-Host "$target`: no unapproved members$note"
    }
}

Remove-Job -Job $parentJob -Force

$flagged | Export-Csv -Path $OutputPath -NoTypeInformation
Write-Host "Flagged members written to $OutputPath"

if ($failures.Count -gt 0) {
    Write-Warning "Unreachable or failed computers: $($failures -join ', ')"
}