Removing Local Admin Rights from Users: How to Enforce Standard User Accounts Without Breaking Everything

Before removing anything, inventory the current state.

# Check local Administrators group members on a single machine
Get-LocalGroupMember -Group 'Administrators'

# Audit local Administrators group across all workstations
$workstations = Get-ADComputer -SearchBase 'OU=Workstations,DC=domain,DC=com' -Filter *
$results = @()
foreach ($ws in $workstations) {
    try {
        $members = Invoke-Command -ComputerName $ws.Name -ScriptBlock {
            Get-LocalGroupMember -Group 'Administrators' | ForEach-Object {
                [PSCustomObject]@{
                    Computer = $env:COMPUTERNAME
                    Member = $_.Name
                    PrincipalSource = $_.PrincipalSource
                    ObjectClass = $_.ObjectClass
                }
            }
        } -ErrorAction Stop
        $results += $members
    } catch {
        Write-Warning "Unreachable: $($ws.Name)"
    }
}

# Filter for domain users (not service accounts or domain groups)
$results | Where-Object {
    $_.PrincipalSource -eq 'ActiveDirectory' -and
    $_.ObjectClass -eq 'User' -and
    $_.Member -notlike '*service*' -and
    $_.Member -notlike '*admin*'
} | Export-Csv C:\LocalAdminAudit.csv -NoTypeInformation

This gives you a list of regular user accounts with local admin rights. Sort by frequency (how many machines a user has admin rights on) -- users with local admin on many machines are higher priority for removal.

Restricted Groups GPO overwrites the local Administrators group membership on every policy refresh.

Group Policy path: Computer Configuration > Windows Settings > Security Settings > Restricted Groups

Right-click > Add Group:

• Group: Administrators
• Members: Specify who should be in the local Administrators group:
  • BUILTIN\Administrator (the built-in local admin account)
  • DOMAIN\Domain Admins (for domain admin access)
  • DOMAIN\IT-Local-Admin-Group (if you want specific IT staff to have local admin)
  • Do NOT include: individual user accounts

If a user is currently in local Admins on a machine and your GPO does not list them in the Restricted Groups configuration, they will be removed on the next policy refresh.

Alternative approach: Local Users and Groups preference (more granular): Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups

• New > Local Group
• Group name: Administrators
• Action: Update
• Remove the current user checkbox: unchecked (but specify the exact membership) This approach does not overwrite the entire group -- it adds or removes specific members without touching others.

Standard user enforcement will break some applications. Common scenarios and solutions:

Legacy application requires admin rights to run:

• Check if the application can be installed in a per-user location (AppData) rather than Program Files -- many older apps work correctly as standard user if installed to a per-user path
• Use Microsoft Application Compatibility Toolkit to create a compatibility shim that elevates silently for the specific executable
• Use Windows Installer repair with elevated privileges (the SYSTEM account can apply it) rather than running the app elevated
• If the application genuinely cannot run without admin rights: create an Application Virtualization (App-V) package or use a terminal server/virtual desktop for that application

Approved software that needs installation: For planned software installations, use your software deployment tool (SCCM, Intune, Chocolatey) to deploy as SYSTEM -- standard users do not need local admin to receive SCCM/Intune-delivered software.

Ad-hoc elevation for specific tasks: For individual users who occasionally need elevation for specific legitimate tasks (IT staff on managed machines, power users), use a PAM tool that provides time-limited, approved elevation:

• CyberArk Endpoint Privilege Manager
• BeyondTrust Privilege Management for Windows
• Thycotic Privilege Manager These allow standard users to request elevation for specific executables, with approval workflow and full audit trail.

Document exceptions: For each application exception, document: the application name, why it needs elevation, who approved the exception, and when it should be reviewed for remediation.

UAC hardening matters even after removing local admin rights -- it protects against elevation prompt manipulation for the remaining admin accounts.

Key UAC Group Policy settings: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options

• User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

  • Recommended: Prompt for credentials on the secure desktop
  • This requires admins to enter their password for elevation, not just click 'Yes'
  • The secure desktop prevents screen capture or click-jacking of the UAC prompt

• User Account Control: Behavior of the elevation prompt for standard users

  • Recommended: Prompt for credentials on the secure desktop
  • Standard users see a credential prompt when elevation is needed -- they can call IT or use a separate admin credential

• User Account Control: Run all administrators in Admin Approval Mode

  • Enabled (this is the setting that makes UAC work -- do not disable it)

• User Account Control: Switch to the secure desktop when prompting for elevation

  • Enabled (prevents click-jacking of UAC prompts by malicious foreground windows)

• User Account Control: Detect application installations and prompt for elevation

  • Enabled (catches installer packages that would otherwise run silently)

# Verify UAC settings on an endpoint
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' |
    Select-Object EnableLUA, ConsentPromptBehaviorAdmin, ConsentPromptBehaviorUser, PromptOnSecureDesktop
# EnableLUA = 1 (UAC enabled)
# ConsentPromptBehaviorAdmin = 1 (prompt for credentials, not just consent)
# ConsentPromptBehaviorUser = 1 (prompt for credentials on standard user elevation)
# PromptOnSecureDesktop = 1 (use secure desktop)