Getting local admins from all PCs

ianicepi 

Hi, Iani.

With respect to testing for if a logged-on (aka interactive) user has local administration rights, you can use .NET's [Security.Principal.WindowsIdentity] class.

This will tell you if they have local administration rights independent of whether they are currently elevated or not.

Example

$Identity = [Security.Principal.WindowsIdentity]::GetCurrent();

[PSCustomObject] @{
    device = [string]::Concat([System.Environment]::MachineName.ToLower(), ".", [System.DirectoryServices.ActiveDirectory.Domain]::GetComputerDomain().Name);
    user = $Identity.Name;
    isAdmin = $Identity.UserClaims.Value -contains "S-1-5-32-544";
}

Output

For a user that's not a local administrator:

For a user that's a local administrator but not currently running an elevated session:

For a user that's a local administrator and is running an elevated session:

Cheers,

Lain