Looking to find specific user accounts that are in the local administrators group

Content Authoring
1

Trying to create and analysis that shows if there is a local administrator who account begins with say 200, but not list anyone else? I have written this, but the 200 could exist inside other accounts so I’m not getting just the ones that start with 200
This is what I have. I’m having trouble getting it written as starts with instead of contains.

exists member whose (it as string as lowercase contains “200”) of local group “Administrators”

2

the problem is the “starts with” will include the “machine name\200” so they all start with “M” you can see this if you plug it into the graphical view of hte QNA and click on the member section of the display and look at the results tab

3

To note @Pete_F’s correct statement about the machine name prefixing it…try just including the "" in the “contains” string. The backslash character is not valid in a user/group name, so the only backslashes present should delimit the scope (i.e. "domain", "workstation", "NT AUTHORITY", "BUILTIN", etc.)

exists members whose (it as string contains "\200") of local group "Administrators"
2 Likes