Under Review

Sophos EDR: Query that will show me all users and groups (including domain accounts) in the local Administrators group of a PC

I want to see any users or groups that have been added to the Local Administrators group on a PC.  Including domain users and groups.

I've been looking at this post:  https://community.sophos.com/intercept-x-endpoint/i/user/edr-query-to-find-all-local-admins-windows?CommentId=93258a04-7e54-431b-a1db-0c1231f2b453

However, it is not showing me the domain users and groups that have been added to a PC's Local Administrators group.

Any help would be appreciated!

Thank you!

Matt

Parents Comment Children
No Data