Local Admin Compliance Check Relevance

Content Authoring
1

Hello Everyone,

I need help on a relevance that I am using for a Custom Check to get machines have unauthorized local admin account, below is the relevance I am using for it:

(concatenation ";" of (elements of (set of (members of local group "administrators" as string) - set of ("Domain\Domain Admins";"Domain\Desktop Admin"; "Domain\Endpoint Admins";(hostname as string as uppercase) & "\abcadmin";(hostname as string as uppercase) & "\Administrator")))) != ""

It is giving the correct result but it is showing those machines also which have any user sids (which is already removed from AD) but there SID is appearing in local administrator group. Please give me the suggestion to update the above relevance to ignore the user ids like below which we can orphaned sids as they in real not exists.

image

2

Hi @mishravk23 , try to add a filter to members as in this example and see if this meets your needs:

(concatenation ";" of (elements of (set of (members whose (exists (account name of sid of it)) of local group "administrators" as string) - set of ("Domain\Domain Admins";"Domain\Desktop Admin"; "Domain\Endpoint Admins";(hostname as string as uppercase) & "\abcadmin";(hostname as string as uppercase) & "\Administrator")))) != ""

-Gus

1 Like