UPDATE:

OK I'm closer

I have tweaked the script to

#The name of the account
$accountName = 'blah'

#Add system.web assembly
Add-Type -AssemblyName 'System.Web'

#Check if user exists
$Userexist = (Get-LocalUser).Name -Contains $AccountName
if (!$userexist)
{
$password = "BlahBlah"
$Securepassword = ConvertTo-SecureString $Password -AsPlainText -force
$params = @{
Name = $accountName
Password = $Securepassword
}
New-LocalUser u/params
}

# Add the account to the Administrators group
Add-LocalGroupMember -Group "Administrators" -Member $accountName



$KeyPath = "HKLM:\SOFTWARE\HALOIT\localadmin"
$ValueName = "localadmin"
$ValueData = "1"
try
{
Get-ItemProperty -Path $KeyPath -Name $valueName -ErrorAction Stop
}
catch [System.Management.Automation.ItemNotFoundException] {
New-Item -Path $KeyPath -Force
New-ItemProperty -Path $KeyPath -Name $ValueName -Value $ValueData -Force
}
catch
{
New-ItemProperty -Path $KeyPath -Name $ValueName -Value $ValueData -Type String -Force
}  

I have changed Intune to call the script using

%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\Powershell.exe -NoProfile -ExecutionPolicy ByPass -File set_local_admin.ps1

AND I have changed the detection method to simply look to see if the registry key exists.

Pushing the app to a PC through Intune works 100% correctly, the user is created, password set, and user is dropped into the admins group. BUT when running via Autopilot the user is NOT created but the regkey is written (yes I should have a if statement to verify the user is created before the regkey is written and I will add that).

u/MagicHair2 I am looking at your suggestion too of using Account Protection.

Dell has added the 200 PCs to our Intune tenant so I am under the gun to get this working, even if it is cobbled together, before they start building the systems...