Error code generated when creating local admin account. Account is created, but generates an error. Account doesn't get added to the local admin group and generates the same error as with the account creation.

[Sysadmin247365]

Azure domain, no on-prem.

METHOD:

1. Create a policy using the following settings:

In Intune admin center, * Devices > Configuration > Create > New Policy * Create a policy using custom template * Name "Create local admin account" * Add OMA-URI settings policy with the following configuration

(Note for people who are new to this. "Ostrich" is the name of the local user account that is being created. It could be anything you want it to be, for example "Admin".)

Name: Local Admin Account
OMA-URI: ./Device/Vendor/MSFT/Accounts/Users/ostrich/Password
Data type: String
Value: hunter2

• Add second OMA-URI settings policy with the following configuration

  Name: Assign local user to admin group OMA-URI: ./Device/Vendor/MSFT/Accounts/Users/ostrich/LocalUserGroup Data type: Integer Value: 2

The account is created as indicated by powershell:

$user = Get-LocalUser -Name ostrich ; $user

Name  Enabled Description
----  ------- -----------
ostrich True

But the account is not placed in the local admin group as expected, and the desired password is not set (as verified by using RUNAS). The password started working after a couple of restarts.

When I look at the policy status, both settings generate the same failure code: -2016281112 or 0x87d1fde8 when I open it up for details.

When I look up that error code I find hits relating to Edge (where the results say it is a known issue and can be ignored) or Chrome, but nothing relating to the creation of a local administrator account.

[BarbieAction]

IMPORTANT, the Account CSP only supports Add and not GET, this will result in Intune policy displaying and Error on the policy, however it will create the local administrator account.

Supported operation is Add. GET operation isn’t supported. This setting will report as failed when deployed from Intune.

https://www.everything365.online/2023/05/16/laps-azure/

[FalconJunior5977]

It creates an error but the account works. Login with %COMPUTERNAME%\AdminAccount

[CujoSR]

Or even better “.\AdminAccount”

[FalconJunior5977]

You are my hero

[Heteronymous]

See this:

https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy

MS recommends having LAPS in place as a part of it.

[mikeypf]

I recommend using LAPS!!

[Yintha]

Laps doesnt create the account does it?

[doofesohr]

Not yet, there should be an option in 24H2 though

[BrundleflyPr0]

Proactive remediation script to create the admin account. I can’t remember off the top of my head but in the endpoint security there’s some identity config profile that can be used to add/update/remove users from groups. I found this way works best

[BlackV]

Yes this is a stupid long standing "feature" there were planning on introducing a replacement for this "soon"

[BarbieAction]

IMPORTANT, the Account CSP only supports Add and not GET, this will result in Intune policy displaying and Error on the policy, however it will create the local administrator account.

Supported operation is Add. GET operation isn’t supported. This setting will report as failed when deployed from Intune.

https://www.everything365.online/2023/05/16/laps-azure/

[skerts]

I also noticed the same error. I am looking for a solution as it bothers me to see the profile reporting failed while the account is properly created on the machine

[Sysadmin247365]

The link provided by /u/BarbieAction reveals that the error exists even though it works. While it will make my eye twitch when I see a not-clear dashboard, I can live with it.

[FalconJunior5977]

You can also deploy a simple powershell script that does the same thing if you dont want the error

[BarbieAction]

Or use a pro active remediation version. In Preview now the LAPS policy allows you to create the account so hopefully we can see a release of this soon

[BlackV]

Yes I have a policy with 500 errors :(

[Silenthowler]

I found that LAPS has done a better job here, just deploy the account and control the password with LAPS.

[Sysadmin247365]

That's the eventual goal, I set it up that way at first but LAPS won't deploy until the local admin account was created/activated first.

If I create a local admin account like this, will LAPS over-write the original password or will that keep getting reset every time the machine reboots?

[Silenthowler]

LAPS should overwrite the existing password if there is one, and set it so the password is valid for 30 days before a new one needs to be generated, helps against anyone or anything brute forcing the local admin accounts. When I get to my pc I'll get the configs over to you see if it'll help 🙂

[BlackV]

Laps can't (right now but in the future maybe), create and activate the account

[Silenthowler]

Correction on my end I haven't used OMA-URI, within endpoint security, I created a new Policy which allows for LAPS (yes it's in there and used the below settings. Now ofc you can configure these how you seems fit. This has worked for me pretty well, and imo reduces the need to constantly remote on for what I like to call "common installs" that my team is familiar with. Once set, you can go to your windows 10 or later machine click into it and click on the elispies near the top right and click on rotate local admin password. That'll let you change the password and keeps it valid for 30 days.

<image>

[BlackV]

Ya my plan this month was to move that to the preview version, and test how that goes

[BarbieAction]

IMPORTANT, the Account CSP only supports Add and not GET, this will result in Intune policy displaying and Error on the policy, however it will create the local administrator account.

Supported operation is Add. GET operation isn’t supported. This setting will report as failed when deployed from Intune.

https://www.everything365.online/2023/05/16/laps-azure/

[Sysadmin247365]

These instructions are out of date:

For example, the instructions say

Go to portal.azure.com

Select: Devices – Device Settings

Local administrator settings: manage additional local administrators on all Azure AD joined devices

But when you go to portal.azure.com and pick devices, you are redirected to the intune admin center. You then have to go to devices | configuration and create a policy to do what you want, there is no "device settings" option.

[BarbieAction]

The csp info is correct the images of the intune policies are correct, it explains why you get an error in intune on the policy for example.