Monitoring Windows local administrator group

[cyrus494]

Hi,

I want to monitor membership of the Local Administrators group on several of my systems. When I run the WMI query described Here, the group membership recursively expands. This ends up reporting A LOT of entries. I would like to get only the members that are directly in the group.

I'm using the WMI monitor with a locally installed Universal Forwarder.

This WMI works:

SELECT * FROM Win32_GroupUser where GroupComponent="Domain='MACHINE_NAME',Name='Administrators'"

BUT it requires me to include the MACHINE_NAME. Is there a different way to write the query? Can I use environment variables? I've tried $HOSTNAME & $COMPUTERNAME to no avail. Is there a better way to do this?

[ShaneNewman]

User powershell for this...

Get-WmiObject win32_groupuser | Where-Object { $_.GroupComponent -match 'administrators' } | ForEach-Object {[wmi]$_.PartComponent }