Howdy
I am trying to create a couple of reports and I have no idea where to start. I need a report that lists all local administrator accounts as the first of 3 reports. I need the name of the account, the “full name” of the account, last login, disabled status (true or false), and expiration status (if expired or not).
I setup an analysis that gets all local accounts, but I do not know how to create a report based on that analysis that has this data in it.
Can anyone provide guidance?
The above post is partly a duplicate of this one: Local accounts analysis with details
Always check BigFix.Me for related items.
These don’t have the full answer, but they are a start.
You should be able to get more info using the inspectors, but you may also need to use the registry or filesystem or WMI to get all of it you desire.
I did read these and I get the local admins, but I do not see any method of getting the last login date?
@jgstew, how we can get only built-in administrator account name in custom property or analysis ? Please help me.
Don’t limit yourself, ask everyone!
names of users whose (following text of last "-" of component string of sid of it = "500")
edit: I should add that this works because the built-in administrator always has a well-known SID ending in “-500” (the first part of the SID being unique to the computer).
Thanks Jason for your help. Its working for me.