Local accounts analysis with details

I am trying to get an analysis which I can then use to create a web report. I need the analysis to provide a list of all “local” accounts on all windows servers.

I also need to get the last login time, disabled status of the account, login name, full name, expiration date if any exists for the accounts.

Can anyone help me with this? I thought it would be so much easier to find a way to do this but I’ve searched everywhere and there’s nothing.

I read the “Local Administrators Dashboard” might be helpful from the BigFix Labs, but I can’t find that and it seems like that’s an “old/outdated” add-on.

How about something like:

(name of it, last logon of it as string | “n/a”, account disabled flag of it, full name of it | “n/a”, account expiration of it as string | “n/a”) of users

For reference, please see the following for the ‘user’ inspector:

https://developer.bigfix.com/relevance/reference/user.html

Note that the analysis should likely have applicability relevance to exclude Domain Controllers:

product type of it != nt domain controller product type

This post is partially a duplicate of this one: Report of local accounts on windows servers with details

3 posts were merged into an existing topic: Analysis - local admins with last login date

TY Al! I was able to use the query and get what I need. I see the report in the web reports as well, The only issue I have now is filtering out the domain controllers.

I tried setting a relevance that excludes an AD path and specified the OU of the Domain Controllers, but then I added the group for “all server” under these exclusions, but that fails. Any ideas?

Then I want to just get all local account instead of administrators, and I think I just take out the “administrators” part of the query, but it doesn’t seem like that’s working, can anyone help?

Which query do you mean?

I tried setting a relevance that excludes an AD path and specified the OU of the Domain Controllers, but then I added the group for “all server” under these exclusions, but that fails. Any ideas?

Then I want to just get all local account instead of administrators, and I think I just take out the “administrators” part of the query, but it doesn’t seem like that’s working, can anyone help?

Post the fixlet or web report relevance here on the forum and folks can maybe help you out here!

I am using the Excel connector and the query is not showing as expected.

Query I am using is:

(names of it, last logon of it, password age of it, (if (exists  full name of it) then full name of it else "n\a"), (if (exists  comment of it) then comment of it else "n\a")) of users whose (admin privilege of it=true)

But the output is:

jsmith, ( Tue, 07 May 2013 14:09:39 -0500 ), False, n/a, n/a
steve, n/a, True, n/a, n/a
Bob, n/a, False, Bob P, n/a

I need to gather all local accounts and list the group they are in if possible, but I am not sure why there are so many “N/A” comments?