Windows Tip: Enumerating local admin group membership

October 12, 2007 —

Send your Windows question to Mitch today! | See other Windows tips

Awhile back I wrote a series of introductory articles about WMI scripting. In one article, I posted the following question: "How can you list any local administrator accounts on a remote machine?" The solution I offered used the Windows Management Instrumentation Command-line (WMIC), a command interpreter that let's you query WMI information directly from the command line instead of doing it from within a WMI script. The command I suggested using was wmic path win32_groupuser where (groupcomponent="win32_group.name=\"administrators\",domain=\"%computername%\"") and this command produces the Administrator account list for the specified computer.

Recently, reader Gene Cox contacted me with this follow-up question: "How can I leverage this for multiple machines?" I asked Gene what the scenario was that he was trying to address, and he replied that he wanted to "Verify all Administrators group on each machine in the domain contain the [minimum] number of authorized users ... Laptop users by nature and by usage need to be local administrators to their corporate machines can add other users to the Admin group. LAN Admins by nature and by usage need to be administrators to all corporate machines in their regions can add other users to the Admin group ... you see where this is going. This is a gauge of abuse or variation from the normal standards. It can easily [be] changed for "other" groups, such as Power Users, etc."

In response to Gene's needs, I suggested taking the above WMIC command and parsing it using a "FOR /F" CMD statement and passing it a parameter to WMIC as follows:

for /f %i in (MyComputerList.txt) do wmic /Node:%i path win32_groupuser where
 (groupcomponent="win32_group.name=\"administrators\",domain=\" %i\"")

Gene replied afterward and told me that this solution "works well" and I was gratified to hear this. Being a Microsoft Most Valuable Professional (MVP), I believe that part of my mandate as an IT professional is to spend a good chunk of my free time helping other IT pros whenever I can with their technical problems. So feel free to send me your own Windows-related technical questions and I'll try and see if I can answer them, and if I can't, then at the least I'll try to point you in the direction of some other experts who might be able to help.

ITworld.com