Back story real quick: some reason some servers have 2 local admin account... no idea, I took over the job and cleaning everything up.

I need to go through 600-ish (or more) servers to delete the extra account.

PowerShell is great but can't work this out. How can I modify and read this location in PowerShell?

I can read up to here: HKLM:\SAM, and cannot see HKLM:\SAM\SAM... ? How can I get PowerShell to edit permissions and read this location?

Once I can see this location I will work out how to delete it remove-item-somethingsomething

Thanks all :)

  • 1
    You shouldn't attempt to manipulate accounts using the registry. But there is a command line tool, net user that has a /delete option. (And there's probably a Powershell equivalent too.) – Harry Johnston Apr 8 '19 at 2:25
  • this wont delete a "built-in" account, this is the first thing i tried, thanks :) – Pavle Stojanovic Apr 8 '19 at 2:28
  • 5
    You can't delete a built-in account, full stop. But there's only one built-in local administrator account, the other one must be a normal account, which you should be able to delete in the usual way. What are the SIDs for the two accounts? (The whoami /all command will show this.) – Harry Johnston Apr 8 '19 at 2:30

I suggest to:

  • first get a list of all LocalAdmin accounts,
  • without the builtin Administrator whose SID ends with -500,
  • use the following (untested) script which uses a wildcard for the possibly localized group name
    (i.e. Administratoren in German)

## Q:\Test\2019\04\08\SO_961951.ps1

$scriptBlock = { Get-LocalGroup Admin* |
                  Get-LocalGroupMember | 
                   Where SID -notmatch '-500$' | 
                    Select-Object * }

$Servers = Get-ADComputer -Filter 'OperatingSystem -like "*windows*server*"' |
    Select-Object Name,OperatingSystem

$LocalAdmins = foreach($Server in $Servers){
    Invoke-Command -ComputerName $Server.Name -ScriptBlock $scriptBlock

$LocalAdmins | Export-Csv .\LocalAdmins.csv -NoTypeInformation

Sample output:

Name              SID                                            PrincipalSource ObjectClass
----              ---                                            --------------- -----------
Server\LotPings   S-1-5-21-1234567890-987654321-1234567890-1001            Local Benutzer

You could use script like this if you have correct access to remote servers:

$scriptBlock = 
Remove-LocalUser -Name UserToDelete
Invoke-Command -ComputerName RemoteServerName -ScriptBlock $scriptBlock
  • Will this delete the 'built-in' local administrator account ? I will test it anyway. – Pavle Stojanovic Apr 8 '19 at 23:48

This was my way of doing it.

&"\\ServerExes\PavlesFolder\PsExec64.exe" \\$Computer -accepteula -nobanner -i -s cmd /c "echo . | powershell.exe (Remove-Item HKLM:\SAM\SAM\Domains\Account\Users\Names\$account -Force)"

it must be ran as 'SYSTEM' so I'm using PsExec. When it deletes from registry the account still shows up in compmgmt.msc, so to work around that, I re-create the user and delete again (using ADSI).. and its gone.

messy, but works...

function created to do the work:

Function Delete-Account-AsSystem {

    Param (

    &"\\ServerExes\PavlesFolder\PsExec64.exe" \\$Computer -accepteula -nobanner -i -s cmd /c "echo . | powershell.exe (Remove-Item HKLM:\SAM\SAM\Domains\Account\Users\Names\$Account -Force)"

    If($LASTEXITCODE -eq 0){

        If(Get-WmiObject -Class win32_UserAccount -Filter "LocalAccount=True" -ComputerName $Computer | Where-Object {$_.Name -eq "Admin"} -eq $null){

            $temppassword = "P@ssword1!"
            $objOu = [ADSI]”WinNT://$Computer“

            $objUser = $objOU.Create("User", $Account)

            $objOuDelete = [ADSI]”WinNT://$Computer“

            Write-Output "Deleted account."

        }#end if


        Write-Output "Didnt delete account."

    }#end if

}#end function

Delete-Account-AsSystem -Computer server01 -Account Admin

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.