Create a local user account via Windows 10 MDM

113 thoughts on “Create a local user account via Windows 10 MDM”

1. Hi Alvaro,
   No, that’s sadly not possible via an OMA-URI. You would have to look at something like PowerShell to address that.
   Regards, Peter

2. Pingback: Challenges while managing administrative privileges on your Azure AD joined Windows 10 devices | Modern Workplace Blog

3. Is there away to set the flags to uncheck change at next login or to check never expire

4. Hi Andy,
   Not by using OMA-URI. That would require custom scripting.
   Regards, Peter

5. Pingback: Managing local administrators via Windows 10 MDM – More than just ConfigMgr

6. Hi Peter,

   Thanks this works well!

   I was wondering now that we have a working admin account “testuser” how we could add a feature to this profile that removes the default administrator account or other accounts.

   Thanks
   PC

7. So far from the documentation the only supported operating is Add. How to delete the local admin user after some time?

8. Hi Aaron,
   Removing the user can not be achieved with this CSP. Probably the easiest would be a small script.
   Regards, Peter

9. Hi PC,
   This CSP only allows you to create the account.
   Regards, Peter

10. I use this little gem of a PoSH script. I find a lot of people forget the ADSI command still works locally.

    This script will create a user called ‘Local User’, assign it to the local Administrator group, set the password
    that you define and to never expire. I simply update the password once a month and push it out via Intune using he native PoSHh scipt option.

    This script will look for any built-in accounts (e.g. service accounts, SQL) and automaticly excluded them. Bulit-in accouonts end in ‘-500’, but you can excluded your own as long as you know the name. I left a few ‘ElseIf’ statements to referance those. You can also exlcuded users in certain local groups (see bottom $remove). By default the script will disable and randomize the password of any account not exlcuded. If you want to delete accounts that are not exlcuded, remove the ” from line 152 and 156. Enjoy!

    param(
    [string]$ComputerName = “$env:computername”
    )

    ##: Feedback
    Write-Output “$ComputerName ——————————————————————–`n”

    # http://msdn.microsoft.com/en-us/library/aa772300(VS.85).aspx
    $ADS_UF_SCRIPT = 1 # 0x1
    $ADS_UF_ACCOUNTDISABLE = 2 # 0x2
    $ADS_UF_HOMEDIR_REQUIRED = 8 # 0x8
    $ADS_UF_LOCKOUT = 16 # 0x10
    $ADS_UF_PASSWD_NOTREQD = 32 # 0x20
    $ADS_UF_PASSWD_CANT_CHANGE = 64 # 0x40
    $ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED = 128 # 0x80
    $ADS_UF_TEMP_DUPLICATE_ACCOUNT = 256 # 0x100
    $ADS_UF_NORMAL_ACCOUNT = 512 # 0x200
    $ADS_UF_INTERDOMAIN_TRUST_ACCOUNT = 2048 # 0x800
    $ADS_UF_WORKSTATION_TRUST_ACCOUNT = 4096 # 0x1000
    $ADS_UF_SERVER_TRUST_ACCOUNT = 8192 # 0x2000
    $ADS_UF_DONT_EXPIRE_PASSWD = 65536 # 0x10000
    $ADS_UF_MNS_LOGON_ACCOUNT = 131072 # 0x20000
    $ADS_UF_SMARTCARD_REQUIRED = 262144 # 0x40000
    $ADS_UF_TRUSTED_FOR_DELEGATION = 524288 # 0x80000
    $ADS_UF_NOT_DELEGATED = 1048576 # 0x100000
    $ADS_UF_USE_DES_KEY_ONLY = 2097152 # 0x200000
    $ADS_UF_DONT_REQUIRE_PREAUTH = 4194304 # 0x400000
    $ADS_UF_PASSWORD_EXPIRED = 8388608 # 0x800000
    $ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION = 16777216 # 0x1000000

    Function AddUserFlag()
    {
    $userName = $args[0]
    $flag = $args[1]
    $u = [adsi]”WinNT://$ComputerName/$userName,user”
    $u.invokeSet(“userFlags”, ($u.userFlags[0] -BOR $flag))
    $u.commitChanges()
    }

    Function RemoveUserFlag()
    {
    $userName = $args[0]
    $flag = $args[1]
    $u = [adsi]”WinNT://$ComputerName/$userName,user”
    if ($u.UserFlags[0] -BAND $flag)
    {
    $u.invokeSet(“userFlags”, ($u.userFlags[0] -BXOR $flag))
    $u.commitChanges()
    }
    }

    Function GetRandomString()
    {
    [int]$Length = $args[0]

    $set = ‘~!@#$%^&*-+=?ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789’.ToCharArray()
    $result = “”
    for ($x = 0; $x -lt $Length; $x++) {
    $result += $set | Get-Random
    }

    return $result
    }

    ##: Get local user list
    $computer = [ADSI]”WinNT://$ComputerName,computer”
    $Users = $computer.psbase.Children | Where-Object {$_.psbase.schemaclassname -eq ‘user’}

    ##: Iterate
    foreach ($user in $Users.psbase.syncroot)
    {
    If ($user.name -eq “Administrator”)
    {
    $randpass = GetRandomString(20)
    Write-Output(” “+$user.name+”: Disable and set strong password –> ‘”+$randpass+”‘”)
    AddUserFlag $user.name $ADS_UF_DONT_EXPIRE_PASSWD
    AddUserFlag $user.name $ADS_UF_ACCOUNTDISABLE

    $user.setpassword($randpass)
    $user.description = “Local Administrator account”
    $user.setinfo()
    }
    ElseIf ($user.name -eq “Guest”)
    {
    $randpass = GetRandomString(20)
    Write-Output(” “+$user.name+”: Disable and set strong password –> ‘”+$randpass+”‘”)
    AddUserFlag $user.name $ADS_UF_DONT_EXPIRE_PASSWD
    AddUserFlag $user.name $ADS_UF_ACCOUNTDISABLE

    $user.setpassword($randpass)
    $user.description = “Local Guest account”
    $user.setinfo()
    }
    ElseIf ($user.name -eq “DefaultAccount”)
    {
    $randpass = GetRandomString(20)
    Write-Output(” “+$user.name+”: Disable and set strong password –> ‘”+$randpass+”‘”)
    AddUserFlag $user.name $ADS_UF_DONT_EXPIRE_PASSWD
    AddUserFlag $user.name $ADS_UF_ACCOUNTDISABLE

    $user.setpassword($randpass)
    $user.description = “Local Default account”
    $user.setinfo()
    }
    ElseIf ($user.name -eq “ASPNET”)
    {
    Write-Output(” “+$user.name+”: Ignore service account”)

    }
    ElseIf ($user.name -eq “Local User”)
    {
    Write-Output(” “+$user.name+”: Ignore service account”)

    }
    ElseIf ($user.name -eq “kioskUser0″)
    {
    Write-Output(” “+$user.name+”: Ignore service account”)

    }
    Else
    {
    $randpass = GetRandomString(20)
    Write-Output(” “+$user.name+”: Disable and set strong password –> ‘”+$randpass+”‘”)
    AddUserFlag $user.name $ADS_UF_DONT_EXPIRE_PASSWD
    AddUserFlag $user.name $ADS_UF_ACCOUNTDISABLE

    $user.setpassword($randpass)
    $user.description = “Local manually created account”
    $user.setinfo()
    }

    }

    Write-Output “`n——————————————————————————-`n”

    Get-CimInstance -ClassName win32_group -Filter “name = ‘administrators'” |
    Get-CimAssociatedInstance -Association win32_groupuser |
    Where-Object { $_.SID -notlike “*-500” } |
    Where-Object {
    # Filter out accounts that are used for local services
    $_.Name -notin {
    # An array of the names for the local computer (domainpart always “.”)
    Get-WmiObject -Class Win32_Service |
    Select-Object -ExpandProperty startname -Unique |
    Where-Object { $_ -like “.\*” } |
    ForEach-Object { Split-Path -Path $_ -Leaf }
    }
    } |

    $Computer = [ADSI]”WinNT://$Env:COMPUTERNAME,Computer”

    $User = $Computer.Create(“User”, “Local User”)
    $User.SetPassword(“”)
    $User.SetInfo()
    $User.FullName = “Local User”
    $User.SetInfo()
    $User.UserFlags = 64 + 65536 # ADS_UF_PASSWD_CANT_CHANGE + ADS_UF_DONT_EXPIRE_PASSWD
    $User.SetInfo()
    $group = [ADSI]”WinNT://./Administrators,group”
    $group.Add(“WinNT://Local User,user”)
    $remove = net localgroup administrators | select -skip 6 | ? {$_ -and $_ -notmatch ‘successfully|^Administrator|Local User’}; foreach ($user in $remove) {net localgroup administrators “`”$user`”” /delete};
    $remove = net localgroup “Power Users” | select -skip 6 | ? {$_ -and $_ -notmatch ‘successfully|^Administrator|Local User’}; foreach ($user in $remove) {net localgroup “Power Users” “`”$user`”” /delete};
    $remove = net localgroup “Backup Operators” | select -skip 6 | ? {$_ -and $_ -notmatch ‘successfully|^Administrator|Local User’}; foreach ($user in $remove) {net localgroup “Backup Operators” “`”$user`”” /delete};
    $remove = net localgroup “Device Owners” | select -skip 6 | ? {$_ -and $_ -notmatch ‘successfully|^Administrator|Local User’}; foreach ($user in $remove) {net localgroup “Device Owners” “`”$user`”” /delete};

11. Great write up Peter. I can’t seem to get the created user to not have the “User must change password at next logon” unchecked. I am trying to create a local admin user but if I haven’t manually updated the password on first logon, i can’t use it to elevate.

    Cheers,

12. Thank you for sharing, NVader2000!
    Regards, Peter

13. Hi Quardi,
    That’s often policy related. From the perspective of this configuration, that can only be adjusted by custom scripting and not via the CSP.
    Regards, Peter

This site uses Akismet to reduce spam. Learn how your comment data is processed.