Prajwal Desai

SCCM | ConfigMgr | Intune | Windows 11 | Azure

  • Home
  • Cloud
    • Autopilot
    • Azure
    • Endpoint Analytics
    • Intune
    • PowerShell
    • Teams
    • Windows 365
  • Microsoft
    • Active Directory
    • Group Policy
    • SCCM
    • SCOM
    • Windows 10
    • Windows 11
    • Windows Server
    • WSUS
  • Software
  • Forums
  • Newsletter
  • Contact
Notification Show More
Latest News
Fix Windows Autopilot Reset Error 0x80070032
Fix Windows Autopilot Reset Error 0x80070032
Autopilot Intune
Windows activation error 0xc004c020
Fix: Windows Activation Error 0xC004C020 with 2 Easy Methods
Windows 11 Windows 10
Find the Package ID of SCCM Application
3 Best Ways to Find the Package ID of SCCM Application
SCCM
SCCM Updates Install Error 0x800b0109 0x8024b303
Fix: SCCM Updates Install Error 0x800b0109 | 0x8024b303
SCCM
Disable Windows Hello for Business using Intune ftimg
Disable Windows Hello for Business using Intune – Comprehensive Guide
Intune Autopilot
Aa

Prajwal Desai

SCCM | ConfigMgr | Intune | Windows 11 | Azure

Aa
Search
  • Home
  • Cloud
    • Autopilot
    • Azure
    • Endpoint Analytics
    • Intune
    • PowerShell
    • Teams
    • Windows 365
  • Microsoft
    • Active Directory
    • Group Policy
    • SCCM
    • SCOM
    • Windows 10
    • Windows 11
    • Windows Server
    • WSUS
  • Software
  • Forums
  • Newsletter
  • Contact
Follow US

Home » Intune » Add User or Groups to Local Admin in Intune

Intune

Add User or Groups to Local Admin in Intune

By Prajwal Desai 1 View 12 comments January 23, 2021 3 Min Read

In this post I will show you how to add user or groups to local admin in Intune. The machine could be a domain joined or without domain.

To manage a Windows device, you need to be a member of the local administrators group. Read this article to know more about managing local administrators on Azure AD joined devices.

Many people assume when you add a user in the first time with Autopilot, user becomes local admin. This happens if you leave the Profile Autopilot settings by default as Administrator.

Autopilot Standard User
Autopilot Standard User

But if you configure the OOBE profile to Standard, there will be no local admin, even local administrator is disabled. Furthermore there is no option that allows you to change it.

- Advertisement -
Ad image

Add User or Groups to Local Admin in Intune

We will now look at the steps to add user or groups to local admin in Intune. First lets create a new text file and rename it add_localadmin.ps1.

You can edit this file either with PowerShell ISE or Notepad++. Paste the following command inside the file

Net localgroup administrators "AzureAD\yourgroups@domain.xx" /add

Replace “AzureAd\xxxx” with email account of your groups or user.

Tip – Don’t use the PowerShell command add-Localgroup because it creates an error, and doesn’t work on remote computer.

Intune Add User or Groups to Local Admin
Intune Add User or Groups to Local Admin

After you have made the changes, save your ps1 script. Return to Intune portal. In the portal, create a new script.

Create Script in Intune Portal
Create Script in Intune Portal

Add a Powershell script. Specify script name and add a description.

Add PowerShell Script
Add PowerShell Script

Import the add_localadmin.ps1 script. Leave the other settings to default.

Configure Script Settings
Configure Script Settings

Select groups that you wish to assign your script. Don’t forget the script will be assigned to computer groups, or by default select all devices. Click Next.

Script Assignments
Script Assignments

Finally review the settings and click Create.

Intune Add User or Groups to Local Admin
Intune Add User or Groups to Local Admin

Take a look at the script and ensure the Assigned value is set to Yes.

Verify the Assigned Field
Verify the Assigned Field

After you have applied the script, wait for few minutes or manually trigger the sync.

Trigger Intune Sync
Trigger Intune Sync

The script has done the changes. We see the users are now part of local administrator group. Do not forget to logoff and logon to see the results.

Add users to local admin
Add users to local admin

Sign Up For Weekly Newsletter

Get the most recent information on Configuration Manager, Intune, Windows 11, Windows 365, Autopilot, Azure, Software Reviews, and much more by subscribing to the newsletter.
By signing up, you agree and acknowledge the data practices in our Privacy Policy. You may unsubscribe at any time.
Share this Article
Facebook Twitter Copy Link Print
Avatar photo
By Prajwal Desai
Follow:
Prajwal Desai is a Microsoft MVP in Enterprise Mobility. He writes articles on SCCM, Intune, Configuration Manager, Microsoft Intune, Azure, Windows Server, Windows 11, WordPress and other topics, with the goal of providing people with useful information.
Previous Article SCCM 2006 Hotfix Rollup KB4578605 Install SCCM 2006 Hotfix KB4578605 | ConfigMgr 2206 Update
Next Article SCCM Client Upgrade Options SCCM Client Upgrade Options | Perform Automatic Client Upgrade
12 Comments 12 Comments
  • Avatar photo Nathaniel Banks says:
    July 2, 2022 at 2:19 am

    The net localgroup /add command doesn’t work 100% of the time with Azure AD; we tried using it and got the error, “there is no such global user or group: user@domain” – and others have reported the issue as well.

    Reply
  • Avatar photo Markus Kugler says:
    March 25, 2022 at 1:36 pm

    Hello Prajwal,
    thanks for your great website, which I follow since the early sccm days!

    One question: I have all my autopilot devices rolled out with the user account type “standard” in the OOBE.
    How can I get now all the primary users each to have local admin rights on their very device afterwards?

    Reply
    • Avatar photo Karl Degraa says:
      August 30, 2022 at 7:08 am

      Set the user to administrator in the deployment profile. The first user logging into Windows will be an administrative user.

      I don’t know how to make every user an administrative user besides perhaps using the Powershell command Prajwal has given on this page and then adding all the users who need to be administrators. This would be a clumsy way to do it though.

      Reply
  • Avatar photo Zahin says:
    January 8, 2022 at 11:09 pm

    There is no Email account for Azure AD group. How do we add that group?

    Reply
    • Avatar photo Noob23 says:
      February 9, 2022 at 1:33 pm

      Did you figured that out? 🙂

      Reply
  • Avatar photo Dave S says:
    December 21, 2021 at 7:55 pm

    If referencing a Microsoft 365 group, does this just add the specific logged on user to the Administrators group or does it add everyone in the 365 group to the Administrators group. I need to add the logged on user only to his or her specific machine.

    Reply
  • Avatar photo Eric says:
    January 22, 2021 at 8:56 am

    Can you remove this user from the local administrator group just as easily as by removing the computer from the group?

    Reply
    • Avatar photo Noob23 says:
      February 9, 2022 at 1:31 pm

      Probably yes. Ill check that

      Reply
      • Avatar photo Noob23 says:
        February 10, 2022 at 1:48 pm

        Okay, I checked that and unfortunately its not possible, by removing Users from the group they remain with local admin rights. I’m searching for a solution, but isn’t that easy..

        Reply
        • Avatar photo Denis says:
          February 13, 2022 at 5:09 am

          Suggest you add an Azure AD group instead, that way you can manage the membership by editing the group – better than assigning individual users.

          Reply
          • Avatar photo Kasper says:
            April 8, 2022 at 7:54 pm

            Hey Denis,

            What do I write if I want to add an Azure AD group?

            Net localgroup administrators “AzureAD\yourgroups@domain.xx” /add ?

            Reply
            • Avatar photo Soutumi says:
              June 9, 2022 at 2:27 pm

              Hello Denis,

              Did you find any answer of this?

              Reply

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recast Sponsored AD
Ad image
Patch My PC Sponsored AD
Ad image

Latest Articles

Fix Windows Autopilot Reset Error 0x80070032
Fix Windows Autopilot Reset Error 0x80070032
Autopilot Intune
Windows activation error 0xc004c020
Fix: Windows Activation Error 0xC004C020 with 2 Easy Methods
Windows 11 Windows 10
Find the Package ID of SCCM Application
3 Best Ways to Find the Package ID of SCCM Application
SCCM
SCCM Updates Install Error 0x800b0109 0x8024b303
Fix: SCCM Updates Install Error 0x800b0109 | 0x8024b303
SCCM
Subscribe to Our Newsletter

Subscribe to our newsletter to get our newest articles instantly!

You Might Also Like

Fix Windows Autopilot Reset Error 0x80070032
AutopilotIntune

Fix Windows Autopilot Reset Error 0x80070032

By Prajwal Desai
Disable Windows Hello for Business using Intune ftimg
IntuneAutopilot

Disable Windows Hello for Business using Intune – Comprehensive Guide

By Prajwal Desai
Windows Autopilot MDM Logs Collection Error 0x800700a1
AutopilotIntune

Fix: MDM Logs Collection Error 0x800700a1 | Windows Autopilot

By Prajwal Desai

Removed from reading list

Undo
Welcome Back!

Sign in to your account

Lost your password?