Local Admin Password expiration

[ksclifton]

Hello,

I am working on trying to run a script to change the local admin password to not expire. In the early stages of Intune, I setup a local admin account and failed to set the password to expire, now when they are coming back I have to change the password. I know there is a work around to login to the device as myself and run the script $Set-LocalUser -Name admin -PasswordNeverExpires 1 . I have attempted to run the same script through Endpoint as a test and receiving failed as it's status. Is this a possible script to run, and what needs to be added to the script if so.

Thank you

[#2]

I am new to this and just now found that I need enable Microsoft Intune PowerShell. I will work on this first.

[#3]

Hi

You indeed need PowerShell... but normally powershell is installed by default on the device :)

get-localuser | Set-localUser -PasswordNeverExpires:$True

https://call4cloud.nl/2020/03/remove-all-local-admins/

[#4]

I don't mean the normal PowerShell, yes that is installed on both devices, while reviewing the learn MEM book, it talks about enabling Microsoft Intune PowerShell, that doesn't seem to be an option, when I ran the powershell-intune-samples-master off github, my credentials were not high enough in other areas of Azure for it to work. My question is, do I have to somehow enable Microsoft Intune Powershell, to run powershell scripts in Intune. When I took the course it was never covered that any special steps were needed to run scripts on devices through Endpoint.

[#5]

Powershell has modules that can be installed so you can managed Microsoft Intune with it. As example you can use powershell to deploy device configurations and conditional access to your tenant.
When using proactive remediations it doesn't need it...(or your powershell script needs that module for some specific operations) but the example I gave you it doesn't need anything special....

[#6]

@Rudy_Ooms_MVP 

Thank you for the replay, I took the script you gave and put it into PowerShell ISE and saved the .ps1 file.

Added to scrips in Endpoint.

When the script would run, I received

I am assuming, I missed something. The local "admin" account password is still not set to not expire.

I test the PowerShell on the test device and it ran correctly. 

[#7]

@ksclifton 

did you test it with a new enrolled device or an existing device ?

[#8]

The device is an existing device.

[#9 · Accepted solution]

You need to check the "Run script in 64-bit PowerShell Host" as the localgroup*/localuser* cmdlets are only available on a 64-bit PowerShell, otherwise it will fail. :thumbs_up:

[#10]

Thank you! Someone before gave me incorrect information when they said that putting it in 64-bit mode was unnecessary.

[#11]

For future reference: Reviewing this thread. The original script proposed is the correct script. Set-LocalUser -Name admin -PasswordNeverExpires 1. Remove the "$" and it will work fine. The second script will set ALL accounts to not expire on the machine; get-localuser | Set-localUser -PasswordNeverExpires:$True. Otherwise, as stated set to 64 bit and call it a day.