简体   繁体   中英

Revove local admin but NOT Domain admin

Using this script to remove all local admins from each computer however it also removes domain admins is there a way to do this without removing domain administrators?

$remove = net localgroup administrators |
          select -skip 6 |
          ? {$_ -and $_ -notmatch 'successfully|^administrator$'};
foreach ($user in $remove) {
    net localgroup administrators "`"$user`"" /delete
};

Another solution:

Get-LocalGroupMember administrators | 
   Where {$_.name -like "$($env:COMPUTERNAME)\*" -and $_.objectclass -eq "User"} | 
      Remove-LocalGroupMember -Group 'Administrators'

To make it more locale independent you could use SID S-1-5-32-544 instead of a group name.

Here is one option:

Get-LocalGroupMember -Group 'Administrators' | 
    Where-Object Name -notlike '*Domain Admins' |
        Remove-LocalGroupMember -Group 'Administrators'

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM