Report of Local Administrators on Windows 2008 - 2016

Reporting
1

Howdy,
Do any folks out there know how to use BigFix to generate a csv or excel report of the members of the local administrators group on Windows Server 2008 - 2016? I have searched online extensively and tried many things in BigFix with no luck at all.

Is this type of report something that is not commonly done with BigFix?

I can do this with a PowerShell script now but the issue that I run into is that we have multiple domains and standalone servers so trying to query them all in 1 script doesn’t work.

With BigFix I can query all of the servers in each domain as well as the standalone servers and the dmz servers.

I’ve had no luck at all with getting anything useable. I came up with one thing in excel which I now forget how I stumbled across it, but that only gave me the machine name in the 1st column and 1st row, then in the 2nd column and 2nd row, it listed all of the members, whether they were groups or users in a single cell, though they were separated by a comma. The issue is that I have to provide this to mgmt, so they want 1 column where the server name is listed, the next column to be the domain the server is in, then the next to be the type of account - such as local group, domain user, domain group, local user, then they want the account or group name. I’ve found no way to get the formatted easily in excel or get these other columns either,
Can anyone assist?

2

You can always try something simple like the local groups inspector: https://developer.bigfix.com/relevance/reference/local-group.html#member-of-local-group-local-group-member

Example:

members of local groups “Administrators”

Note that this is character sensitive, so if for some reason your Administrators group has been renamed you’d need to update the query with the correct string. I think you can use SIDs as well, but I’ve never experimented with that.

I would gather that data in a property, then give your management access to Web Reports where you have the columns you want, like Computer Name, Domain, Administrator Members, and so on.

The beauty of members of local groups is that it’ll tell you directly if it’s a local or domain account, so no need for additional inspections.

For example, on one of my test machines I get
Computername\Administrator
Domain1\Domain Admins
Domain2\Domain Admins
Domain2\PrivilegedAccountManagementAdmins