Create A Local Admin Using Intune And Powershell

In my last blog post, I demonstrated creating a local admin account through Intune. This involved creating a local user account and adding it to the local Administrator’s group via a custom device configuration profile.

In this blog post, we’ll explore a different way of setting up a local admin account with Intune. This time, we won’t be using OMA-URI settings. Instead, we’ll use Devices > Scripts and Remediations to create a local user account.

After that, we’ll add this user account to the Administrators group using the Local User Group Membership option found under Endpoint Security > Account Protection

We’ll be using PowerShell scripts to create a local user account. You can create the account without a password, but you can tweak the script to add one. Alternatively, you can explore the OMA-URI approach if that aligns better with your requirements.

I’ve created two Remediation scripts. The first one Detects whether a specified local user account already exists. A second (remediation script) script will create a local user account for you if it’s not found. You can change the name of the local user account in the script.

Create a local admin account on macOS using Intune
Step-by-step guide

Delete a local user account using Intune
If you’re interested in learning how to delete a local user account using Intune, you can refer to my other blog post: How To Delete A Local User Account Using Intune

Step 1 – Create a Script Package

To create a script package, follow the below steps:

Sign in to the Intune admin center.
Go to Devices > Scripts and Remediations.
Click on + Create under the Remediations tab.

Basics

Provide a Name, Description, and Publisher Information. For example:

Name – Create cloudinfra101 local user account
Description – Provide a useful description.
Publisher – Jatin Makhija

Settings

Create a detection script using the Powershell code below. Save it as DetectLocaluser.ps1.

DetectLocaluser.ps1

$userName = "cloudinfra101"
$Userexist = (Get-LocalUser).Name -Contains $userName
if ($userexist) { 
  Write-Host "$userName exist" 
  Exit 0
} 
Else {
  Write-Host "$userName does not Exists"
  Exit 1
}

Create a remediation script using the Powershell code below. Save it as RemediateLocalUser.ps1.

RemediateLocalUser.ps1

$userName = "cloudinfra101"
$userexist = (Get-LocalUser).Name -Contains $userName
if($userexist -eq $false) {
  try{ 
     New-LocalUser -Name $username -Description "Cloudinfra101 local user account" -NoPassword
     Exit 0
   }   
  Catch {
     Write-error $_
     Exit 1
   }
}

Detection script file – Browse to the Detection script Detectlocaluser.ps1
Remediation script file – Browse to Remediation script file RemediateLocalUser.ps1
Run this script using the logged-on credentials – No
Enforce script signature check – No
Run script in 64-bit Powershell – Yes

Assignments

Click Add groups and select the Entra security group containing Windows 10/11 test devices. Once testing proves successful, you can expand the deployment by including additional devices in the group.

Review + Create

Review the deployment and click on Create to start the deployment process.

Step 2 – Add Local user account to the Administrators group

We’ve created a script package for deploying our new local user account named cloudinfra101. We also want to add it to the Local Administrators group. Let’s check the steps:

Sign in to the Intune admin center.
Go to Endpoint Security > Account Protection.
Click on + Create Policy.
Select Platform as Windows 10 and Later.
Select Profile as a Local user group membership.
Click on Create.

Add Local user account to the Administrators group — Add Local user account to the Administrator’s group