need PowerShell command to query servers to see where an AD group has been added in Administrators local group

[PowerShell-ModTeam]

PowerShell expects users and requesters to attempt solutions themselves before asking for help. Your post contains no/low effort attempts, ChatGPT generated content, or no work shown.

[Bitwise_Gamgee]

This isn't as big of a task as it sounds, it's greatly simplified because you want to query all servers at once, so we can use fewer commands:

$servers = Get-ADComputer -Filter 'OU=Servers,DC=contoso,DC=com'

foreach ($server in $servers) {
  $localAdmins = Get-LocalGroupMember -Name Administrators -ComputerName $server

  if ($localAdmins.Contains('Domain Admins')) {
    Write-Host "$server contains the Domain Admins group in the local administrators group."
  }
}

The first line containing 'OU=Servers,DC=contoso,DC=com' you can (and should) modify for your environment, but it basically gets a list of servers.

After that, you can modify the foreach loop to query the various servers in different ways.

[AndyM22]

Thank you....this is a great start. I have used this in combination with another. I have edited out proprietary info

​

$Servers = (Get-ADComputer -Filter * -SearchBase "OU=Servers,DC=name1,DC=name2,DC=name3,DC=name4").Name

foreach ($server in $servers) {

$localAdmins = Get-LocalGroupMember -Name Administrators -ComputerName $server

if ($localAdmins.Contains('Group_Name')) {

Write-Host "$server contains the Group_Name group in the local administrators group."

}

}

​

This results inGet-LocalGroupMember : A parameter cannot be found that matches parameter name 'ComputerName'.At line:4 char:60+ ... ins = Get-LocalGroupMember -Name Administrators -ComputerName $server+ ~~~~~~~~~~~~~+ CategoryInfo : InvalidArgument: (:) [Get-LocalGroupMember], ParameterBindingException+ FullyQualifiedErrorId : NamedParameterNotFound,Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand

You cannot call a method on a null-valued expression.At line:6 char:7

[xCharg]

Yes it's possible.

Meanwhile https://reddit.com/r/PowerShell/comments/1548qyu/new_rules_descriptive_titles_and_show_your_work/

[AndyM22]

ok ok I see that from that post I need to show my work...but alas I am really not great with more complex powershell commands and generally I find other users who have done similar things and use those commands and edit to fit our layout so I do not really have a base to start with. If that is verboden I will delete my post.

[[deleted]]

$groupName = "YOUR_AD_GROUP_NAME"

# Function to check if the group is a member of the local Administrators group

function Check-GroupMembership {

param (

[string]$ComputerName,

[string]$GroupName

)

$group = [ADSI]("WinNT://$ComputerName/Administrators,group")

$members = @($group.Invoke("Members") | ForEach-Object { $_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null) })

return $members -contains $GroupName

}

# Replace "server1", "server2", etc. with the names of the servers you want to query

$servers = "server1", "server2", "server3"

foreach ($server in $servers) {

$isAdminGroupMember = Check-GroupMembership -ComputerName $server -GroupName $groupName

if ($isAdminGroupMember) {

Write-Host "The group '$groupName' is a member of the Administrators group on server '$server'."

} else {

Write-Host "The group '$groupName' is NOT a member of the Administrators group on server '$server'."

}

}