Create an Intune Remediation Script to Detect Unauthorized Local Administrators

Create the remediation package in the Intune admin center

1. Sign in to the Microsoft Intune admin center at https://intune.microsoft.com with an Intune Administrator account.
2. In the left navigation, go to Devices › Manage devices › Scripts and remediations.
3. Select the Remediations tab, then click + Create.
4. On the Basics page enter:
   • Name: Detect Unauthorized Local Administrators
   • Description: Reports local accounts in the Administrators group that are not on the approved allowlist.
   • Publisher: your IT team name
   Click Next.
5. On the Settings page:
   • Detection script file: upload Detect-LocalAdmins.ps1 (provided below).
   • Remediation script file: leave blank for report-only, or upload a removal script if you are ready to auto-remediate.
   • Run this script using the logged-on credentials: No (must run as SYSTEM).
   • Enforce script signature check: No (unless you code-sign the script).
   • Run script in 64-bit PowerShell: Yes.
   Click Next.
6. On the Scope tags page, apply any scope tags required by your RBAC model, then Next.
7. On the Assignments page, assign to a pilot Azure AD device group first (for example, Intune-Pilot-Devices). Set the schedule to Daily at a low-impact hour.
8. Review the summary and click Create.

Review detection results

1. After the next check-in cycle (typically within a few hours), return to Devices › Scripts and remediations › Detect Unauthorized Local Administrators.
2. Open the Device status tab to see per-device results.
3. Add the column Pre-remediation detection output to see the list of abnormal accounts reported by each device.
4. Click Export to download a CSV of non-compliant devices for follow-up.

Create a deviceHealthScript via Microsoft Graph

Intune Remediations are exposed in Graph as deviceHealthScripts. The detection and remediation script bodies must be Base64-encoded UTF-8.

1. Encode the detection script

# In PowerShell
$detectionBytes = [System.IO.File]::ReadAllBytes("./Detect-LocalAdmins.ps1")
$detectionB64   = [System.Convert]::ToBase64String($detectionBytes)

2. POST the script definition

POST https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "displayName": "Detect Unauthorized Local Administrators",
  "description": "Reports local accounts in the Administrators group not on the allowlist.",
  "publisher": "IT Security",
  "runAsAccount": "system",
  "enforceSignatureCheck": false,
  "runAs32Bit": false,
  "detectionScriptContent": "<base64-of-Detect-LocalAdmins.ps1>",
  "remediationScriptContent": ""
}

3. Assign the script to a device group

POST https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts/{id}/assign

{
  "deviceHealthScriptAssignments": [
    {
      "target": {
        "@odata.type": "#microsoft.graph.groupAssignmentTarget",
        "groupId": "<pilot-device-group-objectId>"
      },
      "runRemediationScript": false,
      "runSchedule": {
        "@odata.type": "#microsoft.graph.deviceHealthScriptDailySchedule",
        "interval": 1,
        "time": "03:00:00",
        "useUtc": true
      }
    }
  ]
}

4. Retrieve per-device run results

GET https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts/{id}/deviceRunStates?$expand=managedDevice

The preRemediationDetectionScriptOutput property on each run state contains the list of abnormal account names reported by that device.

Using the detection script

The detection script below is what Intune runs on every targeted endpoint. It:

• Resolves the localized name of the built-in Administrators group via its well-known SID S-1-5-32-544 (required for non-English Windows installs).
• Enumerates the group using Get-LocalGroupMember.
• Filters to PrincipalSource -eq 'Local' so domain / Azure AD accounts are ignored.
• Compares remaining accounts against the $allowedAccounts allowlist.
• Exits 1 with a descriptive message when abnormal accounts exist (Intune reports Issue detected), or 0 when the device is clean.

Before deploying

1. Edit the $allowedAccounts array to reflect your approved accounts — typically the renamed built-in Administrator, your LAPS managed account, and any sanctioned break-glass accounts.
2. Test locally by running the script in an elevated PowerShell session on a reference device: powershell.exe -ExecutionPolicy Bypass -File .\Detect-LocalAdmins.ps1; echo $LASTEXITCODE
3. Confirm the exit code matches expectations (0 = clean, 1 = flagged).
4. Upload the validated script to the Intune Remediation package created above.

Extending to auto-remediation (phase 2)

Once your allowlist is proven accurate, pair the detection with a remediation script that calls Remove-LocalGroupMember -Group $groupName -Member $accountName for each flagged account. Deploy to a small ring first and review the Post-remediation detection output column before broadening.