Trying to remove SIDs from Local Adminstrator Group

raamatam · 2021-09-16T15:41:42.000Z

I need to remove specific SIDs

Pseudo Code:

#Test if the SID exists

Get-LocalUser -S-1-12-1-3598938502-1280727568-3632501898-3897530764
Get-LocalUser -S-1-12-1-61017865-1125260692-820944550-834916098

#If SID exists, execute the following
if
( -eq $true)
{
Remove-LocalGroupMember -Group “Administrators” -Member “S-1-12-1-3598938502-1280727568-3632501898-3897530764”
Remove-LocalGroupMember -Group “Administrators” -Member “S-1-12-1-61017865-1125260692-820944550-834916098”
}
#If SID doesn’t exist, write error message
Else
{
Write-Host “not found” | Write-Error
Exit
}

Write-Host “Configuration complete” -ForegroundColor Blue

Any suggestions greatly appreciated…

Neally · 2021-09-16T15:47:04.000Z

Welcome

If you post code, please use the ‘Insert Code’ button. Please and thank you!

I understand it’s pseudo code, where are you stuck with this though?

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don't say "Need help" or "PowerShell Help", actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy, past…

192033ab-bb8f-4032-88a5-8e2313af0344-codebutton_small.png

Neally Bot

titusovermyer · 2021-09-16T16:34:42.000Z

You might be able to do something like this (Untested)

$SIDS = 'S-1-12-1-3598938502-1280727568-3632501898-3897530764', 'S-1-12-1-61017865-1125260692-820944550-834916098'
foreach ($SID in $SIDS) {
if
((Get-LocalUser -SID $SID) -ne $Null)
{
Get-LocalUser -SID $SID | Remove-LocalGroupMember -Group "Administrators" -Member $SID
}
#If SID doesn't exist, write error message
Else
{
    Write-Host "not found" | Write-Error
    Exit
}
}

Neally · 2021-09-16T16:38:42.000Z

((Get-LocalUser -SID $SID) -ne $Null)

When comparing to $null, $null should be on the left

rencore.com

PowerShell – Null comparison demystified

I have been working recently on the guidance for PowerShell rules. Rule research requires a lot of research and digging into how a programming language […]

DoctorDNS · 2021-09-16T16:39:19.000Z

A coupl of things, to get hte user you need to use the -SID property, like this:

PS C:\Foo> Get-LocalUser -sid S-1-5-21-1486327418-947460526-2637705183-1004

Name  Enabled Description
----  ------- -----------
Bobby True    Local admin

So something like this:

$U= Get-LocalUser -SID S-1-12-1-3598938502-1280727568-3632501898-3897530764
If ($U) {
  $U | Remove-Localgoupmember -Group Administrators
}

raamatam · 2021-09-16T17:38:54.000Z

tnks!

raamatam · 2021-09-16T17:41:01.000Z

Wow! Thank you!

raamatam · 2021-09-16T18:04:35.000Z

Thank you. Got that! I think w/ what I got from here I will be able to make progress. I have to run this from Intune MDM as PS running against all Post- AutoPilot W10 devices or EP Analytics but then I have to break out the Detection & Remediation (I would rather just do it as one script to log the output)

$SIDS = 'S-1-12-1-3598938502-1280727568-3632501898-3897530764', 'S-1-12-1-61017865-1125260692-820944550-834916098'
foreach ($SID in $SIDS) {
if
((Get-LocalUser -SID $SID) -ne $Null)
{
Get-LocalUser -SID $SID | Remove-LocalGroupMember -Group "Administrators" -Member $SID
}
#If SID doesn't exist, write error message
Else
{
    Write-Host "not found" | Write-Error
    Exit
}
}