What It Does
Local administrator rights get handed out in a hurry, for one install, on a Friday, and almost nobody takes them back. This script reads the local Administrators group and writes one object per member: the name, what kind of principal it is, where it came from, its SID, and whether it is one you expected.
It finds the group by its well-known SID rather than by the name Administrators, so it returns the right group on a machine installed in any language. You give it the members you expect with -Expected, and everything else is flagged.
A member whose SID no longer resolves, because the domain account was deleted or the machine moved between domains, makes the built-in Get-LocalGroupMember throw. Those are the members most worth finding, so the script falls back to reading the group through ADSI and reports them instead of failing. It changes nothing: no account is added, removed, renamed or disabled, and no file is written.
Before You Run It
- Run it as an administrator. As a standard user it returns an access-denied error rather than a short list.
- Decide what belongs in -Expected before the first run, or every machine reports the same handful of names as unexpected.
- Remember that a nested group hides its members: a domain group in the local Administrators group appears as one line.
- This one reads. Anything you decide to remove afterwards is a separate, deliberate change, on a machine you can reach again.
