Jump to content

Differentiate if running as local admin vs domain admin?


Recommended Posts

Thanks - yeah I've used the AD UDF here and there. Was kind of hoping there was a easier quicker way since the AD UDF query is a tad slow. And then I'm assuming one would have to loop through the array _AD_GetUserGroups returns looking for an appropriate OU admin group. Was kind of hoping there would be some more basic way within windows to determine this, but if the domain admin account is only granted local rights, how else would one divine this without querying AD?

So rats, unless anyone else has some other trick up their sleeve.

 

 

Link to comment
Share on other sites

38 minutes ago, DrLarch said:

So rats, unless anyone else has some other trick up their sleeve.

You should be able to get the information by running the WHOAMI console command with the appropriate switch(es).

Link to comment
Share on other sites

Thanks Xman, WHOAMI works great! And no AD query required...

Edit: Oops, well WHOAMI would have to be used in combination with some kind of AD lookup it seems. WHOAMI just let's you know if it's a local or domain user. And regarding _AD_IsMemberOf, one would need to know the name of the domain admin group, since domain design varies. At least in the domain I work in, there really aren't any global admin accounts for security, only OU/Specific Site Admin accounts.

So it still appears there's no universal way to determine if the user is a domain admin or just a user with local admin rights.

Edited by DrLarch
Link to comment
Share on other sites

Would be neat if there was some kind of IsAdmin() function that could return values like:
0 - Not Admin
1 - Local Admin
2 - Domain Admin

But not sure that's even possible...

Edited by DrLarch
Link to comment
Share on other sites

Domain Admin doesn't necessarily grant different permissions than being a local admin.  For most cases, the Domain Admin group is added to devices when they are joined to a domain, but in environments with stricter security requirements, this may not be the case.  I just wanted to point out that Domain Admin membership may not be a universal. 

Having said that, you would know your environment best and if you are sure that the domain admin group is in fact a member of local Administrator groups of all domain joined Windows computers, then enumerating if an account is a member of the Domain Admins group and/or checking the Local Administrators group (or executing permissions if elevated) is your best recourse.

Link to comment
Share on other sites

Will check when I return to my computer if the AD UDF can help. 

My UDFs and Tutorials:

Spoiler

UDFs:
Active Directory (NEW 2022-02-19 - Version 1.6.1.0) - Download - General Help & Support - Example Scripts - Wiki
ExcelChart (2017-07-21 - Version 0.4.0.1) - Download - General Help & Support - Example Scripts
OutlookEX (2021-11-16 - Version 1.7.0.0) - Download - General Help & Support - Example Scripts - Wiki
OutlookEX_GUI (2021-04-13 - Version 1.4.0.0) - Download
Outlook Tools (2019-07-22 - Version 0.6.0.0) - Download - General Help & Support - Wiki
PowerPoint (2021-08-31 - Version 1.5.0.0) - Download - General Help & Support - Example Scripts - Wiki
Task Scheduler (NEW 2022-07-28 - Version 1.6.0.1) - Download - General Help & Support - Wiki

Standard UDFs:
Excel - Example Scripts - Wiki
Word - Wiki

Tutorials:
ADO - Wiki
WebDriver - Wiki

 

Link to comment
Share on other sites

According to this article using

net localgroup "Administrators"

will return a list of local admin users.
If you select all AD groups (starting with <domain\> or just by looking for a backslash) and query the members you should get a list all all users with full access to the computer.

My UDFs and Tutorials:

Spoiler

UDFs:
Active Directory (NEW 2022-02-19 - Version 1.6.1.0) - Download - General Help & Support - Example Scripts - Wiki
ExcelChart (2017-07-21 - Version 0.4.0.1) - Download - General Help & Support - Example Scripts
OutlookEX (2021-11-16 - Version 1.7.0.0) - Download - General Help & Support - Example Scripts - Wiki
OutlookEX_GUI (2021-04-13 - Version 1.4.0.0) - Download
Outlook Tools (2019-07-22 - Version 0.6.0.0) - Download - General Help & Support - Wiki
PowerPoint (2021-08-31 - Version 1.5.0.0) - Download - General Help & Support - Example Scripts - Wiki
Task Scheduler (NEW 2022-07-28 - Version 1.6.0.1) - Download - General Help & Support - Wiki

Standard UDFs:
Excel - Example Scripts - Wiki
Word - Wiki

Tutorials:
ADO - Wiki
WebDriver - Wiki

 

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

×
×
  • Create New...