How to Get Local Administrators with or without PowerShell

Native Auditing

• Open the Powershell ISE → Create new script with the following code and run it, specifying the computer list and the path for export:

      invoke-command {
$members = net localgroup administrators |
where {$_ -AND $_ -notmatch "command completed successfully"} |
select -skip 4
New-Object PSObject -Property @{
Computername = $env:COMPUTERNAME
Group = "Administrators"
Members=$members
}
} -computer fs1,sp01,ncnad -HideComputerName |
Select * -ExcludeProperty RunspaceID | Export-CSV c:\data\local_admins.csv -NoTypeInformation
      

• Open the file produced by the script in MS Excel.
  Sample report:

Netwrix Auditor for Windows Server

• Run Netwrix Auditor → Navigate to "Reports" → Expand the "Windows Server" section → Go to "Windows Server ­– State-in-Time" → Select "Members of Local Administrators Group" → Click "View".
• To save the report, click the "Export" button → Choose a format from the dropdown menu → Click "Save".
• To get this report by email regularly, simply choose the "Subscribe" option and define the schedule and recipients.