Report on Local Administrators Group membership - updated

Update 5/1/2010: Although this routine outlined below will still work just fine, here's another, in my opinion better and more well-rounded way to gather up and report on the contents of every local group, including the members of the local Administrators group: http://myitforum.com/cs2/blogs/skissinger/archive/2010/04/25/report-on-all-members-of-all-local-groups.aspx

Original blog from June, 2008 follows:

Ward Lange's original mof edit works great for 2000 and xp; but for Windows 2003 servers and Vista, the "BUILTIN" needed to be replaced with the local computer's name.  Unfortunately, I have yet to hear of a way to use a dynamic variable in the MOF.

Mike Seely posted a script on the forum. With his permission I've used it to show a different method to gather the contents of the local Administrators group.

  • Edit inboxes\clifiles.src\hinv\sms_def.mof.  At the very bottom, add these lines.  These are identical to Ward Lange's mof edit, so if you've already implemented that one, no need to change anything.
    [ SMS_Report (TRUE),SMS_Group_Name ("LocalAdmins"),SMS_Class_ID ("MICROSOFT|LocalAdmins|1.0")]
    class Win32_LocalAdmins : SMS_Class_Template
    {
    [SMS_Report(TRUE), key] string AccountName;
    [SMS_Report(TRUE), key] string GroupName;
    };
  • Do not add anything to Configuration.mof.  If you've previously implemented Ward Lange's, remove the section from configuration.mof.  If you are on SMS2003 (not configMgr) and have already implemended Ward Lange's edit, you will want to remove the data section, leaving just the reporting section (the section above).
  • Attached is a .txt file; rename it to .vbs.  Place it in a Source folder, and create a package/program for it, to run whether or not user logged in. 
  • The Collection Query I suggest using for the advertisement is this, I'd set it to be recurring every few days so if a machine loses the WMI information somehow, it gets it back.

    select SMS_R_SYSTEM.ResourceID
    from SMS_R_System
    where
    SMS_R_System.ResourceId not in
     (select SMS_R_System.ResourceId
      from  SMS_R_System
      inner join SMS_G_System_LOCALADMINS on SMS_G_System_LOCALADMINS.ResourceID = SMS_R_System.ResourceId
      where SMS_G_System_LOCALADMINS.AccountName is not null)

So, what does this combination do?  The sms_def.mof edit will set your hardware inventory policy to report on local administrators group membership.  The vbscript advertisement will create the WMI data entry using the computer name.  It doesn't really matter if configuration.mof built it or something else built it--once it's there, Hardware Inventory policy will be able to use it.

A sample report to use once you have this data:

select distinct Name0 as 'Computer Name', substring(AccountName0,charindex('Domain=',Accountname0)+8,(charindex('Name=',Accountname0)-charindex('Domain=',Accountname0)-10)) as 'Domain Name', substring(AccountName0,len(AccountName0)-charindex('"',reverse(AccountName0),2)+2,charindex('"',reverse(AccountName0),2)-2) as 'User Name'
from v_GS_SYSTEM INNER JOIN v_GS_LocalAdmins ON v_GS_SYSTEM.ResourceID = v_GS_LocalAdmins.ResourceID where (AccountName0 not like '%Administrator%' AND AccountName0 not like '%Domain Admins%')

Note 1: The vbscript specifically looks for members of the 'Administrators' group.  If you have alternate groups you need to look for, like Administrateurs, or Administraten, modify the script.

Note 2: If the vbscript was run, and since then the computer has been renamed, the script will need to run again to update to the new name.

Original article (includes screenshots of what the sample report looks like): http://www.myitforum.com/articles/8/view.asp?id=9735

 

Attachment: LocalAdmin.txt
Published Sunday, June 08, 2008 7:11 PM by skissinger
Filed under: ,

Comments

# re: Report on Local Administrators Group membership - updated

It seems that the Collection Query isn't working for me. Everytime I try to create the Collection; the query comes back as invalid. Am I missing something?

Monday, June 09, 2008 11:16 AM by mhughes2

# re: Report on Local Administrators Group membership - updated

If you haven't yet implemented this on at least 1 computer, the SMS_G_System_LOCALADMINS table may not yet be there.  You may need to run the vbscript manually on a test box, then a Hardware Inventory action.  Wait until you see the table in your SQL database; and then the Collection Query should work.  Alternatively, the table for me ended up being sms_g_system_localadmins... but depending upon different variables in your environment it may have been called sms_g_system_localadmins0 .  Check your DB tables, and see if it's called something different.

Monday, June 09, 2008 7:06 PM by skissinger

# re: Report on Local Administrators Group membership - updated

Is there an easy way to report on all local group and members? I am trying to retrieve all local group information such as the following:

Group names

Group Description

Member Name

Member Domain

Thanking you in advance...

Monday, August 11, 2008 9:01 PM by jkovarik

# re: Report on Local Administrators Group membership - updated

I don't know about Group Description, but if you know the group name already, you can use this script (with modifications) to gather Membername/domain.  For example, replace "Administrators" with "Power Users"

Wednesday, August 13, 2008 8:14 AM by skissinger

# re: Report on Local Administrators Group membership - updated

I've updated the script to get non English Administrators.  See www.myitforum.com/.../tm.htm

Thursday, November 26, 2009 6:36 AM by Tom_Watson

# re: Report on Local Administrators Group membership - updated

I have amended the MOF file on the SMS server with

[ SMS_Report (TRUE),SMS_Group_Name ("LocalAdmins"),SMS_Class_ID ("MICROSOFT|LocalAdmins|1.0")]

class Win32_LocalAdmins : SMS_Class_Template

{

[SMS_Report(TRUE), key] string AccountName;

[SMS_Report(TRUE), key] string GroupName;

};

and it has automatically compiled OK, I then compiled it on my local test machine (XP), ran the VBS script and a hardware inventory on the XP machine.

I still cannot find the SMS_G_System_LOCALADMINS table in the SMS database yet.

Have I done anything wrong???

thanks for your help

Wednesday, December 02, 2009 9:51 AM by diaz101

# re: Report on Local Administrators Group membership - updated

In reply to diaz101, we're working through this in this thread: social.technet.microsoft.com/.../f153939b-88ac-4047-b50f-c0aa50537a17

Thursday, December 03, 2009 12:21 PM by skissinger

# re: Report on Local Administrators Group membership - updated

I have followed the instructions to the letter but the database view or table does not seem to be created. I am running SCCM 2007 R2 SP2.

When I run the report I get the following error, please help because I am really stuck and I'm not sure what else to try.

An error occurred when the report was run. The details are as follows:

Invalid object name 'v_GS_LocalAdmins'.

Error Number: -2147217865

Source: Microsoft OLE DB Provider for SQL Server

Native Error: 208

Sunday, January 24, 2010 6:33 PM by neil.frawley

# re: Report on Local Administrators Group membership - updated

Neil: have you confirmed the data in inventoryagent.log, and see it in Resource Explorer on a test client?  If not, then there's a disconnect.  If you do, then it could be as simple as your environment didn't call the custom view v_gs_localAdmins, but instead called it v_gs_localadmins0, or v_gs_localadmins00.  Try that, or launch SQL Management Studio and look at the views of your database, and see what it might be called.  If that wasn't it, please post in the forums, I'll catch you there.

Monday, January 25, 2010 9:58 AM by skissinger

# re: Report on Local Administrators Group membership - updated

Sherry,

I've added the correct lines to sms_def.mof but when I look at the views I can't find anything that begins with dbo.v_GS_localAdmins.

The steps I took are, I first added the few lines to sms_def.mof, then I tried to make the collection query but it gave me an error just as neil.frawley has.

I also executed the Localadmin.vbs on 2 clients to see if they give the correct data but I can't see any change.

Can you please advise on this?

Thanks ;-)

Friday, February 26, 2010 3:31 AM by kingskawn