Why our users are getting local admin access on devices when the device runs through Autopilot profile and Azure AD joined devices even after we have selected Standard user in the Autopilot profile?

What enrollment method are you using ? Even if you create an Autopilot Profile, if you use autoenrollment your users will always end up Local Admin. You can check the enrollment method by it's profile assignment in the device once it is enrolled... (look at the Enrollment blade in the device details).Another solution would be to setup a "Local user group membership" profile in your Endpoint Security blade (Account Protection) to make sure that only the default groups have local administrative privileges.

999 of the 1000 times its just that those devices didn't got the Autopilot profile 🙂 Can you confirm if those newly wiped enrolled devices do have applied the device name template?Besides that autopilot profile, its always a smart thing to do to have a backup solution in place for when the user would still be admin..https://call4cloud.nl/2021/04/dude-wheres-my-admin/ (which also has a link to this one)https://call4cloud.nl/2020/03/remove-all-local-admins/ But again... first make sure they did receive the profile 🙂

Harm_Veenstra Thanks for your reply on this @Harm_VeenstraYou mean this settings in Entra ID below It does shows "All" This is what I am seeing so seems this is the one responsible for this but I am not sure.

Yep… thats why i mentioned it… autopilot is just nothing more than streamlining thr enrollment… (a bit more but to make it clear) the device needs to go through the oobe to enroll with autopilot … at that point the autopilot profile will be downloaded and applied . This will not happen with a regular entra join

If you enroll a device without using Autopilot and just using join entra on an existing device or when the autopilot profile did not downloaded (because of reasons) , you need to have some additional stuff in place to remove those users from the admin group.As mentioned before.. we are making sure, there is a powershell script or task in place to remove those additional admins from the group... https://call4cloud.nl/2021/04/dude-wheres-my-admin/ (which also has a link to this one)https://call4cloud.nl/2020/03/remove-all-local-admins/For a lot of small customers that don't have proactive remediation in place we use our own rmm tool (which could pretty much do the same but a lot quicker) so each 5 minutes it checks who is a member and ditches the additional ones

Why our users are getting local admin access on devices when the device runs through Autopilot profi

J-D
Copper Contributor
Nov 01, 2023
What enrollment method are you using ? Even if you create an Autopilot Profile, if you use autoenrollment your users will always end up Local Admin. You can check the enrollment method by it's profile assignment in the device once it is enrolled... (look at the Enrollment blade in the device details).

Another solution would be to setup a "Local user group membership" profile in your Endpoint Security blade (Account Protection) to make sure that only the default groups have local administrative privileges.
Rudy_Ooms_MVP
MVP
Nov 01, 2023
999 of the 1000 times its just that those devices didn't got the Autopilot profile 🙂
Can you confirm if those newly wiped enrolled devices do have applied the device name template?

Besides that autopilot profile, its always a smart thing to do to have a backup solution in place for when the user would still be admin..
https://call4cloud.nl/2021/04/dude-wheres-my-admin/ (which also has a link to this one)
https://call4cloud.nl/2020/03/remove-all-local-admins/

But again... first make sure they did receive the profile 🙂
- VinodS2020
  Brass Contributor
  Nov 01, 2023
  Rudy_Ooms_MVP
  
  Where I can check whether it has the template assigned on it as I have seen devices being enrolled via Autopilot profile and added in all the locations like Intune, Autopilot, Entra ID and Defender as well but this is what happening.
  - Rudy_Ooms_MVP
    MVP
    Nov 01, 2023
    1. Check if the profile is assigned to the devices
    https://learn.microsoft.com/en-us/autopilot/profiles
    
    If the device is enrolled and the user isn't a regular user but admin... check if the device also has the same naming template you configured in the same autopilot profile. If the device didn't got the autopilot profile (due a lot of possible reasons) the user isn't admin and the device still has the old name
- VinodS2020
  Brass Contributor
  Nov 01, 2023
  Rudy_Ooms_MVP
  
  Thanks for your answer on this. i will check on this.
Harm_Veenstra
MVP
Oct 31, 2023
Are your users members of the local administrators group after deployment? Or did someone make them Device Administrator in Entra ID, perhaps?
- VinodS2020
  Brass Contributor
  Nov 01, 2023
  Harm_Veenstra
  
  Thanks for your reply on this @Harm_Veenstra
  You mean this settings in Entra ID below
  
  It does shows "All"
  
  This is what I am seeing so seems this is the one responsible for this but I am not sure.
  - Harm_Veenstra
    MVP
    Nov 01, 2023
    Yes, so this is not happening because someone added a group there. But Rudy is on the right path with this issue 🙂

Forum Discussion

Why our users are getting local admin access on devices when the device runs through Autopilot profi

Share

Resources