Managing local Administrators with Intune: local user group membership policy and errors

Who is a local administrator on your Windows devices is one of the most important security settings you manage, and Intune can control it without scripts. The local user group membership policy can add helpdesk groups, remove leftover accounts or lock the Administrators group down completely, but Replace mode is unforgiving. In this post I'll show how the policy works, how to build it for Entra joined and hybrid joined devices, and how to read its errors.

How it works#

The Local user group membership profile lives under Endpoint security › Account protection in the Microsoft Intune admin center and writes the LocalUsersAndGroups Policy CSP (./Device/Vendor/MSFT/Policy/Config/LocalUsersAndGroups/Configure). It needs Windows 10 20H2 or later, or Windows 11, and it manages only the six built-in groups that Windows evaluates at sign-in: Administrators, Users, Guests, Power Users, Remote Desktop Users and Remote Management Users.

Each rule in the profile combines one or more local groups, an action and a list of members:

Replace rules are processed last so they win. If one policy uses Replace and another uses Update on the same group, Replace wins and Intune doesn't report a conflict.

Prerequisites#

• Know the join type. The Users selection type (an Entra user and group picker) works on Microsoft Entra joined devices only. Manual works on Entra joined and hybrid joined devices and takes a SID, domain\username or a username, in that order of preference. Use Active Directory values for hybrid joined devices and Entra values for Entra joined devices.
• For Entra groups entered manually, you need the group's SID. Names aren't supported for Entra groups. The SID is in the group's securityIdentifier property:

Connect-MgGraph -Scopes 'Group.Read.All'
Get-MgGroup -Filter "displayName eq 'Workstation Admins'" -Property DisplayName,SecurityIdentifier |
    Select-Object DisplayName, SecurityIdentifier

• A snapshot of who is in the Administrators group today, from a few representative devices. On Entra joined devices that usually includes the SIDs of the Global Administrator role, the Microsoft Entra Joined Device Local Administrator role and often the user who joined the device.

Step-by-step#

1. Create the profile#

Go to Endpoint security › Account protection › Create Policy, choose platform Windows and profile Local user group membership. On Configuration settings, add a rule: pick the local group, the group and user action, the user selection type and the members.

2. Start with Update#

For most tenants the first policy is an Add (Update) rule that puts an Entra group of support staff into Administrators, plus a Remove (Update) rule for known leftover accounts. Nothing else in the group changes, so the risk is low.

3. Use Replace deliberately#

If you want Administrators to contain exactly your list, use Add (Replace) and include everything you need to keep:

• The built-in Administrator account. Windows blocks its removal, and leaving it out of a Replace list fails with 0x55b ERROR_SPECIAL_ACCOUNT: Cannot perform this operation on built-in accounts. Add it by name (Administrator, or its new name if you renamed it).
• The account Windows LAPS manages, if it isn't the built-in Administrator. LAPS still manages that account's password, but once Replace removes it from Administrators it no longer has admin rights. See deploying Windows LAPS with Intune.
• Any Entra role SIDs you still rely on from your snapshot.

Assign the Replace policy to a small device group first and keep a LAPS password at hand for each test device.

4. Handle hybrid joined devices#

Use Manual with the AD group's SID or CONTOSO\Workstation Admins. Microsoft recommends fully qualified names over bare names for the best results.

5. Remote Desktop Users#

Entra groups added through this policy don't apply to remote desktop connections. To grant RDP on Entra joined devices, add the individual users' SIDs to Remote Desktop Users.

Verify#

After a sync, check the group on the device:

Get-LocalGroupMember -SID 'S-1-5-32-544' |
    Select-Object Name, ObjectClass, PrincipalSource, SID
net localgroup Administrators

Using the well-known SID S-1-5-32-544 works on any display language. Entra groups show up as SIDs starting S-1-12-1-. If one command fails on a member it can't resolve, use the other. Then confirm the policy result in the event log:

Get-WinEvent -LogName 'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin' -MaxEvents 300 |
    Where-Object { $_.Message -like '*LocalUsersAndGroups*' } |
    Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-List

Good looks like this: the group contains exactly the members you expect, the newest LocalUsersAndGroups events contain no errors, and the profile shows success for the device in the admin center.

Tips & gotchas#

• Reporting is per profile, not per rule. The per-setting view shows the whole set of rules as one setting. A rule with an error is skipped while the others are still sent, so a partial result is possible.
• Invalid members don't stop the policy. Unknown group names, SIDs or members are skipped, the valid parts apply, and an error is returned at the end. Member SIDs are added without being resolved, so a mistyped SID is added as-is.
• Troubleshoot name lookups with lsp.log. Set LspDbgInfoLevel to 0x800 and LspDbgTraceOptions to 0x1 under HKLM\SYSTEM\CurrentControlSet\Control\Lsa, reproduce, read C:\Windows\debug\lsp.log, then set both back to 0x0.
• Prefer one policy per device. Intune's documentation says a Replace rule in one policy and an Update rule in another resolve without a conflict, but the CSP FAQ warns that more than one LocalUsersAndGroups configuration on a device results in a conflict, and conflicting settings aren't sent. One policy with several rules avoids the question.
• Don't mix with RestrictedGroups. Microsoft recommends LocalUsersAndGroups over the older RestrictedGroups/ConfigureGroupMembership setting from Windows 10 20H2, and applying both to one device is unsupported. Remove old custom OMA-URI or Group Policy restricted groups first; the MDM diagnostic report shows what is configured.
• Fewer admins need other tools. Once standard users can't elevate, Endpoint Privilege Management covers the tasks that still need admin rights.

References#

• Account protection policy for endpoint security in Intune
• Policy CSP - LocalUsersAndGroups