Forum Discussion

drivesafely's avatar
drivesafely
Brass Contributor
Jan 12, 2025

Intune - remove local admins

Hello All,  

In our workgroup environment, users currently have local admin rights. After performing Entra join and onboarding devices to Intune, how can we remove all users from the local administrators group, keeping only the default administrator account? Note that users will continue logging in with their local accounts, not Entra accounts.  

Additionally, is there a simpler way to update the IP addresses on these devices?  

Thanks!

    • drivesafely's avatar
      drivesafely
      Brass Contributor

      Hello tomwoodward 

      Thanks for useful the link shared.

      1, We want to remove standard accounts that are created locally in Windows devices from Administrators group.

      With the 'Account protection' option, we can do that by using the option 'Add (Replace)' for Administrators group and select any one of the Entra user? There is no option here add an account created locally.

      2. How about adding or keeping a common standard account which is created locally in the device to the Administrators group only? 

      Thanks

  • Salamat_Shah's avatar
    Salamat_Shah
    Iron Contributor

    Yes you can do it, To remove users from the local administrators group, Intune's Device Configuration profiles or a custom PowerShell script can be used.

    For updating IP addresses, leveraging Group Policies (if domain-connected) or deploying a PowerShell script via Intune is the most straightforward method.

  • Rachid007's avatar
    Rachid007
    Copper Contributor

    There are several ways to achieve this. If you use autopilot you have the option to set the user account type to Standard. If not you can take a look at this post from Rudy where he explains in detail how to resolve this by the use of powershell. https://call4cloud.nl/remove-all-local-admins/

Resources