The Need for Local Admin Rights
In a tightly controlled corporate environment, standard employees should never have local administrator privileges on their workstations. This prevents them from installing unauthorized software or modifying critical system settings. However, there are times when a developer or a specialized technician requires elevated access to a specific machine—such as DEV-LAPTOP-04—without granting them domain-wide administrator privileges.
While you can use the graphical Computer Management (compmgmt.msc) snap-in to add a user to the local Administrators group, this requires navigating through multiple menus. PowerShell allows you to grant these permissions instantly, which is especially useful when executing commands remotely via WinRM.
Using the Add-LocalGroupMember Cmdlet
PowerShell provides a dedicated module for managing local security accounts. To modify the local Administrators group, you must run PowerShell with elevated Administrator privileges.
Suppose you want to add the local user account TechSupport to the local Administrators group. You would use the Add-LocalGroupMember cmdlet.
Add-LocalGroupMember -Group "Administrators" -Member "TechSupport"This command executes silently. The TechSupport account now possesses full local administrative rights and can bypass UAC (User Account Control) prompts.
Adding an Active Directory Domain User
More commonly, you will want to grant local admin rights to an Active Directory domain user, rather than a local account. The syntax is identical, but you must prepend the domain NetBIOS name to the user’s login ID.
For example, to add the domain user JSmith from the CONTOSO domain to the local machine’s Admin group, run:
Add-LocalGroupMember -Group "Administrators" -Member "CONTOSO\JSmith"Adding an Azure AD (Entra ID) User
If your organization uses Microsoft Intune and Azure Active Directory (now Entra ID), the machines are not joined to a traditional on-premise domain. In this scenario, the user account prefix changes.
To grant local admin rights to a cloud-only user (e.g., [email protected]), you must use the AzureAD\ prefix:
Add-LocalGroupMember -Group "Administrators" -Member "AzureAD\[email protected]"Verifying Group Membership
In a scripting or automated deployment scenario, you should always verify that the command succeeded before closing the session.
You can list all current members of the local Administrators group using the Get-LocalGroupMember cmdlet:
Get-LocalGroupMember -Group "Administrators"The output will be a clean table showing the PrincipalSource (Local, ActiveDirectory, or AzureAD) and the exact name of every user and security group that currently possesses administrative control over the workstation.