Using Intune, you can create and manage local admin accounts on your Windows devices, which is particularly useful for managing devices not connected to a domain. Using Intune, you can easily create a local user account and add it to the Administrators group.
This blog post outlines the steps for creating a local administrator account. If you need to Add an existing Azure AD/Entra ID user account to the local admin group, please refer to Add a User to Local admin group using Intune.
You can also easily create a local admin account on a Mac device. If you are using Windows 365, you can use the User Settings option to add a user to the local admin on their respective Cloud PCs. Refer to the guide: Elevate User to Local Admin on Windows 365 Cloud PC.
As an example, We are going to create a local admin account called cloudinfraadmin. However, you can create a local admin user account by providing any name you like.
Ways to Create a Local Admin Account using Intune
There are two ways to create a local admin account using the Intune admin center on Windows 10 and Windows 11 devices. These methods are outlined below:
- OMA-URI Setting – Creating a local admin account is possible through the OMA-URI Setting. The Accounts CSP Policies offer the necessary settings for creating a local admin account.
- Powershell Script – Alternatively, a PowerShell script allows for creating a local admin account. This method offers greater flexibility and customization than the OMA-URI approach. For example, you can create a local admin account without a password. Refer to this post for more details: Create a Local Admin Using Intune and PowerShell.
| Delete a local user account using Intune |
|---|
| If you want to delete a local user account using Intune, refer to the post: How To Delete A Local User Account Using Intune. |
Table of Contents
Accounts CSP for Managing Local Administrator Account
Microsoft has provided comprehensive documentation on Accounts CSP. You can rename a device through the Accounts CSP, create a new local Windows account, and associate it with a local user group, such as the Local Administrators group. For more details about Accounts CSP, refer to the Microsoft Docs Accounts CSP Page.
Please note that Accounts CSP policies only apply to Windows devices with Pro, Education, and Enterprise Editions of Windows 10 and Windows 11 devices.
Create a Windows Local Admin Account using Intune
To create a device configuration profile, we will follow below steps:
- Sign in to the Intune admin center.
- Go to Devices > Configuration > Create > New Policy.
Select the following settings on the Create a Profile pane and click Create.
- Select Platform as Windows 10 and later
- Profile type as Templates.
- Template Name: Custom
Basics Tab
- Name: Create a local admin on all devices.
- Description: This custom device configuration profile will create a local administrator account called cloudinfraadmin on all intune-managed devices.
Configuration settings Tab
- Click on the Add button to add OMA-URI settings and provide the following:
- Name: Create Local User Account
- OMA-URI: ./Device/Vendor/MSFT/Accounts/Users/cloudinfraadmin/Password
- Data type: String
- Value: C0mputEr@10!
You can replace cloudinfraadmin to any other name to create local user account as per your requirement. For example: If you replace cloudinfraadmin with myadminacc the local user account with name myadminacc will be created.
Note
- Click on the Add button again to add OMA-URI settings and provide the following:
- Name: Add user to Local administrator group
- OMA-URI: ./Device/Vendor/MSFT/Accounts/Users/cloudinfraadmin/LocalUserGroup
- Data type: Integer
- Value: 2
Assignments
Create an Entra Security group that includes the users or devices for which you want to apply the custom device configuration profile. If you add users to the group, a local admin account will be created on all users devices joined to Entra and enrolled into Intune.
If you intend to deploy this configuration to specific devices, ensure that you add the devices to the Entra Security group, not the users. To deploy it on all end-user devices, click on + Add all devices to target all devices enrolled in Intune.
Applicability Rules
You can set up rules on this page to target specific versions or editions of the Windows operating system for this device configuration profile. For example, you can create a rule to assign this profile if the OS edition is Windows 10/11 Professional.
Review + Create
Review the device configuration profile on the Review + Create tab and click Create.
Monitor the Progress of Local Admin Account Creation
To monitor the deployment progress of a Device configuration profile, follow the below steps:
- Sign in to the Intune admin center.
- Click on “Devices” and then select “Configuration“.
- Choose the Device Configuration profile you want to work with, and at the top of the page, you’ll see a quick view of the Success, Failure, Conflict, Not Applicable, and In Progress status.
- Click on View report to access more detailed information.
Sync Intune Policies
The device check-in process might not begin immediately. If you’re testing this policy on a test device, you can manually kickstart the Intune sync from the device itself or remotely through the Intune admin center.
Alternatively, you can use PowerShell to force the Intune sync on Windows devices. Restarting the device is another way to trigger the Intune device check-in process.
End-user Experience
After the policy is deployed successfully, check the end user’s device. Confirm if a local user account has been created and added to the local administrator’s group.
- Click on Start and search for Computer Management.
- Click on Local Users and Groups > Users and find the local user account created by Intune Custom device configuration profile, which is cloudinfraadmin.
- Next, ensure the account is added to the Administrators group, granting local admin privileges. Go to Computer Management > Local Users and Groups > Groups > Administrators and check if your local user account is listed within the Administrators group.
Set Local user Account Password to never expire using Intune
To set the local user account’s password expiry to ‘Never‘ on target devices, deploy a PowerShell script with the given command. For step-by-step instructions on deploying PowerShell scripts via Intune, refer to the blog post titled How to Deploy a PowerShell Script Using Intune.
Set-LocalUser -Name "cloudinfraadmin" -PasswordNeverExpires 1
Conclusion
In this blog post, we’ve learned how to create a local administrator account on Intune-managed devices through a custom device configuration profile. It’s a straightforward process that enables you to create a local admin to manage all your organization’s devices.
What OMA-URI would we use if we dont want it to have a password associated with it because Windows LAPS will set the random password?
In that case, you can try creating a local user using a Powershell script:
PS C:\> New-LocalUser -Name “localuser01” -Description “Description of this account.” -NoPassword
Using that would they be part of the Administrators group?
Hello dj56, I have created a blog post which shows how you can create a local user account without password using Intune. You will have to use Proactive remediations to create local user account.
Then add that account to local administrators group using Local user group membership option.
https://cloudinfra.net/create-a-local-admin-using-intune-and-powershell/
Isn’t using OMA-URI settings for creating or managing accounts the OLD method? Why can’t Intune admins use the Endpoint Security -> Account Protection -> Local user group membership templates instead?
Yes, you can use that as well. Please create the local user account first before updating Administrator group.
Cool stuff.
Tried this and it worked a treat
This CSP always works but shows error 0x87d1fde8. Any ideas?
Hi Jeff,
Same issue for me as well. The config applies but I experience the same error for both settings.
I have been doing additional digging. Here’s some information that may help.
Blog: https://call4cloud.nl/2021/12/i-kill-remediation-errors/
MS: https://learn.microsoft.com/en-us/windows/client-management/mdm/accounts-csp
“Supported operation is Add and the GET operation is not supported. When you have configured this setting from the Endpoint Manager it will report as failed when deployed.”
Any ideas as to why the profile shows errors on config profile?
Setting Name Setting Status Errorcode
Create LAdmin [./Device/Vendor/MSFT/Accounts/Users/hmadmin/Password] Error -2016281112
AddLAGroup ./Device/Vendor/MSFT/Accounts/Users/cloudinfraadmin/LocalUserGroup Error -2016281112
The account is created successfully and added to the local admin group.
Thank you,
Yes, even though it error’s out, the account is still created and added to local admin group. This could be due to the password which Intune is probably not able to verify and confirm if the profile deployment is successful.
If you want to use another way to deploy local user account and add it to local admin, you can also use Intune Proactive remediations and Local user group membership option. I have written a blog post on this to provide the scripts and step by step guide: https://cloudinfra.net/create-a-local-admin-using-intune-and-powershell/
A recent change in Intune requires E3 or better licensing to use Proactive Remediations. It is no longer available to those with M365 Business Premium, which unfortunately cuts off many non-profits and SMBs.
Hi, what if you want to delete a local user? The MS documentation teaches you how to remove it from specific groups but not remove it from the Users part of Local Users and Groups.
You can delete a local user account using Intune Proactive remediations. Here’s is a blog post which provides step by step guide along with powershell scripts to delete a local user account using Intune.
https://cloudinfra.net/how-to-delete-a-local-user-account-using-intune/
Am I correct in assuming that the password created in this process is a ‘one and done’ deployment in that it creates the account, sets the password and then leaves it? There wouldn’t be any issues with having another policy, lets say Windows LAPS since someone else mentioned it, changing the password?
Also for the password, Are we able to use the serial number in the password by using “%SERIAL%” or {{serialnumber}} as used with Account SCP or in certain areas of Intune?
I am also looking for an answer on Windows LAPS and would this be affected by the CSP policy?
Hi Jatin,
Thanks for the article.
Just wondering how do we create the local account without forcing it to change password at first logon? Because the creation of the local account and adding it to admin groups works well, it’s just that when we use it for the first time for anything that requires elevation, it says the account needs to change password first.
Hello Shawn, You can follow below article which provides the steps to disable “User must Change password at next logon” flag using intune https://cloudinfra.net/enable-disable-user-must-change-password-at-next-logon-using-intune/
Question: Why does this show errors, but create the account.
My best guess is that Intune could not verify the local user account password. I am not 100% sure on this yet. You can Ignore the error, or else use Intune remediations or Powershell script to create a Local admin user. I may reach out to Microsoft to get some answers.
I know this is a relatively older post but I’ve run it and while the account get’s created in Administrator’s group, it’s also created in the Users group. Any idea why that would happen?
Hi Jamie, As it creates a local user and adds it to the local administrator group, you will find it showing under the Local Users and Groups > Users folder and then gets added to the Groups > Administrators group.
Hi Jatin, so the account is being added to both the Groups > Administrators group and the Groups > Users group (the one noting that members can’t make changes), that then won’t allow the account’s admin function to work regardless of the membership in the Admins group, but I can’t figure out why it added it to both.