Monitoring Windows local administrator group

cyrus494 — Wed, 30 Oct 2013 00:25:50 GMT

Hi,

I want to monitor membership of the Local Administrators group on several of my systems. When I run the WMI query described Here, the group membership recursively expands. This ends up reporting A LOT of entries. I would like to get only the members that are directly in the group.

I'm using the WMI monitor with a locally installed Universal Forwarder.

This WMI works:

SELECT * FROM Win32_GroupUser where GroupComponent="Domain='MACHINE_NAME',Name='Administrators'"

BUT it requires me to include the MACHINE_NAME. Is there a different way to write the query? Can I use environment variables? I've tried $HOSTNAME & $COMPUTERNAME to no avail. Is there a better way to do this?

Re: Monitoring Windows local administrator group

ShaneNewman — Wed, 30 Oct 2013 01:47:11 GMT

User powershell for this...

Get-WmiObject win32_groupuser | Where-Object { $_.GroupComponent -match 'administrators' } | ForEach-Object {[wmi]$_.PartComponent }

topic Monitoring Windows local administrator group in Getting Data In

Monitoring Windows local administrator group

Re: Monitoring Windows local administrator group