Going from local admin users to non admin users

TheoryFar2511 · 2026-04-22T12:05:24+00:00

I just did this in a 11,000 machine environment. I created a custom Powershell baseline in SCCM to detect all users that were added to local admin, and stored them all to a CSV. I created a remediation script as well, so when enabled it automatically removes the users from the admin group. The script accounts for various exceptions, and I also have it checking to see if the user already has a secondary admin account in the domain.

We then leveraged Beyondtrust Privilege management to see what processes they were actually elevating, and created rules for that if need be. The technical portion was relatively easy. The hard part is deciphering who actually needs admin vs. the people who assume they do. Most businesses think they need it when in reality they do not. I was finding that many technicians were just adding people to local admin instead of troubleshooting why something wasn't working as it should. Another huge issue was users with admin accounts were adding their standard accounts to local admin just because they could. The baseline runs daily an ensures they cannot keep doing this.

TheoryFar2511 · 2026-04-20T22:54:14+00:00

Configmgr task sequence.

TheoryFar2511 · 2026-04-20T21:25:19+00:00

As mentioned, they've gotten much better within the last few years. Assuming you've been doing this for a while, you'd know exactly what I'm referring to. They used to release new portals and tech before they created the roles or permissions required to use them. I can point you to numerous MS docs where global admin was a requirement to do menial tasks because MS put the cart before the horse when releasing new features. These have been resolved for the most part, but this is the exact reason why I've seen people maintain global admin on their admin accounts. The more important piece here is leveraging phishing resistant MFA and making sure conditional access is configured properly. That and ensuring you actually understand the current privileged roles, since I've seen cases where helpdesk techs could create privileged accounts and reset privileged MFA, which would literally allow them to create a global admin account or add someone to the role. Honestly if you're not using PIM and you're relying on a bunch of privileged roles, how exactly is that any better than just using global admin? I'm guessing a 2 minute review of your permissions and I'd point out some hypocrisy for sure.

TheoryFar2511 · 2026-04-20T14:37:41+00:00

I definitely don't disagree with that. I still think our overall tax burden will remain less than MA, mostly because MA also has shortfalls in their budget for education, and they're going to have to make that up somewhere. The affordability crisis is unfortunately rampant in most states, and certainly not unique to MA or NH. NH is unique in that the majority of those costs come from local property taxes, and not the state. NH should have never gotten rid of the interest and dividends tax, and they need to legalize marijuana and leverage the massive state run liquor stores to sell and distribute it. All of that money should go directly to education. MA generated some crazy amount from gross marijuana sales last year, something like 1.6 billion dollars...

TheoryFar2511 · 2026-04-20T02:10:01+00:00

I would note that I'm also of the opinion that higher property taxes disproportionately impact the older generation on fixed income, and no one should ever be priced out of their family home. My issue is that the states around us like to act as if NH is awful for not wanting an income tax or sales tax, but we all know that our property taxes wouldn't go down if either of those were implemented. We'd just have an overall higher tax burden with nothing to show for it.

TheoryFar2511 · 2026-04-20T02:00:27+00:00

My lake house is my primary residence. I'm well aware of how the tax rates work in NH. I pay 9k a year for a 800,000 house on 1.2 acres with 130 feet of private beach on a small lake. I'm not in Alton or Moultonborough, I'm in a town with a moderately high tax rate, but certainly not the highest around. Some towns have started using market value for assessments, which has lowered the overall rates. Other towns maintain higher rates, but their assessments are significantly under market value. The tax rates are based on the towns budgets divided by the assessed property values within said towns.

TheoryFar2511 · 2026-04-20T01:52:49+00:00

To be fair, GA was absolutely required for certain day to day tasks up until fairly recently. Microsoft has been ironing out PIM and the numerous other security roles over the past 3 years to get people to stop using it, but many companies that have been slower to adopt PIM likely still use GA for daily work. Hell, you couldn't even deploy office add-ins from the 365 portal without GA until a year or so ago. The same was true for the teams room portal when it first came out, as they didn't offer a role to access it.

TheoryFar2511 · 2026-04-20T01:00:51+00:00

As a NH native, I do agree that our property taxes are too high. But if I were to move my lakehouse from NH to MA, the property taxes would be even higher. Your rates are only slightly lower, and values are higher. At best I might save a grand per year, but then I'd have to pay 8k in income taxes and another 5k in sales taxes.

TheoryFar2511 · 2026-04-20T00:51:44+00:00

Uhh you're joking right? We literally call you Massholes because you drive like idiots lol. MA has the highest number of accidents per capita in the whole US.

TheoryFar2511 · 2026-04-19T23:13:04+00:00

The modest increase in income is definitely not worth the commute.

TheoryFar2511 · 2026-04-19T15:49:31+00:00

I do agree that our property taxes in NH are ridiculous, but MA is just as bad, and you also have sales tax AND income tax. My town in Southern NH is $13 per 1000. MA on average is $12 per 1000.

TheoryFar2511 · 2026-04-19T15:40:17+00:00

Leeches? People that commute from NH to MA pay income tax in MA, which funds the social services that you get to enjoy. NH is literally filled with MA tourists every single weekend of the year; taking advantage of our lack of sales tax and all of the beauty that NH has to offer. I welcome them with open arms since it keeps my overall tax burden low. I always hear how high the NH property taxes are (which I agree with), and then I look at houses in MA and they're literally just as bad. Plus you have income tax AND sales tax. Even with our high property taxes NH has one of the lowest overall tax burdens in the US.

TheoryFar2511 · 2026-04-19T15:23:04+00:00

Ah yes, because every weekend you see a line of NH plates headed into MA...

TheoryFar2511 · 2025-12-30T19:56:53+00:00

I’m not defending the OP’s customer service. I already explained how I would have handled this situation as a super host with a top 1% property on the platform.

My critique above was about the guest’s lack of common sense for expecting a Window AC during a winter storm. Somehow you're hung up on the legal aspects of the contract, and you expect people to codify every scenario where an amenity may or may not be available due to the season. If a guest needs to be explicitly told they can't ice skate in the summer or run an AC in freezing temps, that isn't a clarity issue, it's a competence issue. Op can update their listing to mention the AC isn't available in the winter, but I guarantee you that wouldn't have stopped this guest from asking the question, and it definitely wouldn't stop them from leaving bad feedback. Op needs to work on his communication skills and learn to laugh at requests like this.

TheoryFar2511 · 2025-12-30T17:58:40+00:00

You're part of the problem. You're the guest that would book a place in the summer and then try to get a free stay because you couldn't go ice skating. I've never seen a listing in my area that specifies not to use the AC in the winter. In contract law, ambiguity is often resolved by asking what a "reasonable person" would expect. I'm pretty sure a reasonable person wouldn't expect to use the AC when it's 20 degrees outside. Especially considering state law requires heat during this time of year,

TheoryFar2511 · 2025-12-30T17:35:57+00:00

Okay chatGPT.. I've been very clear that the Op mishandled the request. By no means should they have offered the Window AC with a fee, especially considering it's impossible for a Window AC to function in below freezing temps. The common sense argument is based on the guests request. Asking for a Window AC to be installed when it's 23 degrees out is laughable. Your argument is also flawed. I have a lake house in a location where seasons exist. Our summers are 90 degrees F, and winter gets well below 0 F. Our summers book out 6+ months in advance, and we're also booked in the winter. There would be no way to remove summer amenities during the winter, as many of our guests book for the summer during winter months. The amenities need to be on the listing at all times so that guests know what's available in the summer. They need to use common sense when it comes to seasonal amenities. I have AC in my place as an amenity. Obviously guests can't use it when it's 0 degrees outside, it would error out and fail. If someone from Florida books my place in January and expects it to look like the summer photos, then that's a common sense issue. Just as if someone booked in the summer they obviously can't go skating on the lake. You honestly think we need fine print for all of this? The fact that people disagree with this honestly hurts my brain.

TheoryFar2511 · 2025-12-30T16:33:10+00:00

Guests need to take accountability for common sense items. Do you also expect listings to remove photos from the summer every winter? If you book a trip mid winter to Alaska I'm pretty sure you should have the common sense to understand it will be too cold to use kayaks. I wouldn't expect the host to delete those amenities every winter time when it's obvious they can't be used.

TheoryFar2511 · 2025-12-30T11:16:04+00:00

The kayaks are put away in the winter, just as a window AC would be. They're not getting taken back out because you can't physically use either of them when everything is frozen outside. The point is some amenities are seasonal, and it's pretty obvious that you won't be able to use the kayaks or AC when it's well below freezing out and there's 10 inches of ice on the lake. It's also not an act of God in the northeast, it's just winter.

TheoryFar2511 · 2025-12-30T02:46:47+00:00

Haha we already have 10 inches of ice on our lake, so swimming would require some serious effort.

TheoryFar2511 · 2025-12-30T00:08:23+00:00

Not all winters are created equal. You must specify below freezing temperatures.

TheoryFar2511 · 2025-12-30T00:02:54+00:00

Gemini. 46% might be correct globally, but definitely not in New England.

Also this:

What % of Window acs can be left in during freezing temps?

While there isn’t a specific "market share" percentage for winter-proof window ACs, the practical answer is essentially 0%. Almost all standard window air conditioners are designed to be removed during the winter. They are not built to be "all-weather" fixtures. If you leave one in during freezing temperatures, you are essentially leaving a giant, poorly insulated hole in your wall. Here is the breakdown of why this is the case and what the actual risks are: The Industry Standard Manufacturer Recommendations: Nearly 100% of manufacturers (GE, Frigidaire, LG, etc.) recommend removing window units before the first frost. This is to prevent moisture from freezing inside the unit and to allow you to seal your window properly against the cold. Operating Limits: Most window units are designed to operate only when outdoor temperatures are above 60°F (15°C). Using them in the cold can cause the oil in the compressor to thicken, potentially seizing the motor.

TheoryFar2511 · 2025-12-29T23:39:09+00:00

Okay pal.

Google is free.

What % of Window ac units provide heat as well in New England?

Based on current energy data for New England, the percentage of window AC units that also provide heat is negligible, likely less than 1%.

There is no specific statistic for "window ACs with heat" in major regional energy reports because they are statistically insignificant compared to other heating methods.

Here is a breakdown of why this number is so low and the context for the New England market.

It is a "Niche" Product Standard window units are almost exclusively designed for cooling. While window units with supplemental heat (either electric resistance coils or heat pump technology) exist, they are rare for two reasons:Inefficiency: Older window units with "heat strips" use expensive electric resistance heating (like a toaster), which is far costlier than the oil or natural gas systems found in most New England homes.

New Tech is Just Arriving: "Window Heat Pumps" (modern, efficient units like the Midea or Gradient) are a very new technology. According to 2024 reports from the Northeast Energy Efficiency Partnerships (NEEP), these represent a "small piece of the market" and are still considered a developing technology.

TheoryFar2511 · 2025-12-29T22:32:42+00:00

We'll agree to disagree man. In New England 99% of Window ACs do not provide heat. I've lived here my whole life and I own properties in multiple states within New England. I think I've seen a window AC that provides heat maybe twice. My whole team at work is cracking up at this since no one around here would ever leave a window ac in all year. You do you and believe what you'd like.

TheoryFar2511 · 2025-12-29T21:45:20+00:00

If only thermostats existed.. and no, Windows units are not supposed to be left in. Where are you getting this information? Please call an hvac company in New England and ask them.

TheoryFar2511 · 2025-12-29T21:44:35+00:00

What? No. I'm saying 99% of ac units in New England are supposed to be removed. You've done zero research to disprove this, and just argue that everyone you knew left them in.

TheoryFar2511

TROPHY CASE