Windows 10: Issue with Removing Local Admin Rights via Intune for Group Members

Hello,,I'm experiencing a challenge with Intune's "Local user group membership" policy on Windows 11. I've been attempting to remove local admin rights from devices, and the policy works as expected when I add individual users. However, when I try to apply the policy to a group, it doesn't seem to be effective.Here's what I've done so far:Accessed the Intune admin center.Navigated to "Local user group membership" under policies.Successfully removed local admin rights for individual accounts.The issue arises when I attempt to remove admin rights for a group of users. Despite adding the gro

:)

 

admin rights keep disappearing!?!!

Hi guys,

I am actually having a problem at work that our IT department hasn't been able to figure out. I am supposed to be a member of the admin group. We are on a domain. The problem is that everytime I reboot the computer I loose my admin rights(no longer in the administrator group) and just become a normal user again. I have tried googling this and didn't get to many results.
I believe IT is just giving me local admin rights, not admin rights for the whole domain.

Any suggestions?

EDIT: It is on Windows XP Pro.

 

Intune device issue

Hello,

has anyone experienced an issue where a device in intune has had a "fresh start" however it didn't actually do anything and has removed the device from intune? The device has no local admin account and cannot be managed in intune anymore with things locked down such as re-installing windows or resetting the device. Any suggestions besides swapping out the drive?

Thanks,

Jamie.

 

Trouble creating Local admin users via Intune

We are trying to create a local admin user other than the auto pilot user in Intune. The way we have setup is our auto pilot user (Domain user account) is an admin user and then we are using CSP to create another local admin user. We are using hybrid mode enrollment.

We have a Device configuration profile with OMA URI as follows:

- OMA-URI: ./Device/Vendor/MSFT/Accounts/Users/localadmin/Password

Data Type: String

Value: *******

- OMA-URI: ./Device/Vendor/MSFT/Accounts/Users/localadmin/LocalUserGroup: 2

Data Type: Integer

Value: 2

Assignment : User Group

When it Works:

So far based on testing it works when the profile is assigned to the Dynamic device group which is created to perform auto pilot on intune machines for which the device hash is already imported, but in this process it fails to make the auto pilot user as an admin

When it doesn't work:

When the configuration profile is applied to user group, it fails to create the user, but then the auto pilot user is created properly with admin rights.

Variations tried:

Making the localadmin user as a non admin by changing the integer value to 1 and then first tried with dynamic device group assigned, which failed and also the user group which also failed.

Client machine Windows version: Windows 10 21H2

Would like to avoid the PowerShell script method if possible. Kindly let me know if you require any further details.