Join Log in
Score:0
sataranights avatar Server

How to know in my network which computers have the local administrator account active

jp flag
sataranights

As the title says: How do I know in my network which computers have the local administrator account active? Because, as per security consultant request, we have to know, and if possible, disable, every local administrator account on every of the 300+ notebook/desktops on the network.

There's a net use or wmi command to address it? Can it be set recursively to ask every computer on the network? We have a domain controller if it helps, but there are always a few groups with computers not joined to the domain.

39
0 + 0
Score:0
avatar Server
ae flag
Auge

I see a few problems here.

  1. On non domain joined computers there must be an administratror account active even if it's not the Account named Administrator.
  2. On non domain joined computers you'd need an account to run your query
  3. In general you can only run a query when the computer is online, so you'd need to schedule your queries to run regularly and even then you couldn't be garantueed to get them all because you can't garantuee the PCs will be online in the timeframe you run your query.

That being said

On a Windows 10 PC you can run the following to get the account named Administrator and wether it's enabled:

Get-LocalUser -Name Administrator | Select-Object Name, Enabled

You could use this command in a script like the following one to get the status of a computer.

[pscustomobject]@{
    Computername = $env:Computername
    AdminEnabled = Get-LocalUser -Name "Administrator" | Select-Object -ExpandProperty Enabled
} | Export-CSV -Path "\\a\share\where\you\can\put\this\$($env:Computername).csv"

You could then run the above command as a startup script in the domain (Be aware that the shared folded would need to be writable for the "Domain Computers" group)

On PCs outside of the domain you're a bit out of luck. If you have an account which can log on remotely on a number of systems you could use something like this:

$APSCredentialWhichHasTheRightsToDoThis = Get-Credential
Invoke-Command -Computername "RemotePC" -ScriptBlock {Get-LocalUser -Name "Administrator"} -Credential $APSCredentialWhichHasTheRightsToDoThis

to get the status of the remote computer.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.