Advanced | Flow of The Week: Gathering Local Admin Status from Microsoft Intune - Microsoft Power Platform Blog (2024)

Hey Flow Fans!

This week’s article comes from Max Fritz at SADA Systems, Inc.

Max is an Office 365 and EMS Architect at SADA Systems, Inc. He focuses on improving collaboration and simplifying implementation, and has worked with Office 365 for the past eight years. He is a self-proclaimed geek, passionate about a broad range of security and collaboration tools and can’t stop talking about the technology he loves.Max is the founder and president of the Minnesota Office 365 User Group, and holds MCSA and MCSE Microsoft certifications. Max can be found speaking at Microsoft 365 conferences all over the US.You can find Max on Twitter @theCloudSherpa (https://twitter.com/TheCloudSherpa), or on LinkedIn (https://www.linkedin.com/in/maxafritz/).

https://image.ibb.co/gAqprL/intune3.png

Background

For those organizations that have fully adopted the Modern Workplace and have gone “cloud only”, you are most likely using Windows 10 on your workstations and managing those workstations with Microsoft Intune. While Intune is good at managing settings (and always getting better), there are limited reporting options available.

One of the most common requests I encounter is to get the status of local admins on the machines managed by Intune. The below Flow will walk us through gathering that information and presenting it to an administrator.

The following steps will be a part of this process:

1. Deploy a PowerShell Script from Intune
2. Device gathers data and kicks off Flow using a REST API call
3. Flow writes data to SharePoint

• Flow subscription
• Intune subscription
• Windows 10 devices in Intune
• OneDrive or SharePoint location to store Excel workbook

SharePoint

For this example, we’ll be using a SharePoint list to store the data, however, you can adapt the below steps and store the data in an Excel workbook if you prefer.

1. In your SharePoint site of choice, go to Add an app.
   
2. From the options, select Custom List.
   
3. Give your list a name. We’ll call ours “Local Admins.”
4. Navigate to your new list and add 2 columns named “Computer Name” and “User Name” by repeating the below steps:
   1. Click Add column.
      
   2. Choose single line of text.
   3. Fill out the column name and click Save.
   4. Make sure to repeat for the second column.
5. Add another column, this time of type Yes/No, called “Is Admin”:
6. Open the SharePoint List settings:
   
7. Scroll down to Views and click on All Items.
8. Under Columns, click the checkbox next to Modified. This will allow the modified date to show in our view.
   
9. Scroll to the bottom and click OK.
10. Your SharePoint list should now look like this:
    

Flow

1. Navigate to https://flow.microsoft.com/ and log in.
2. Get started by Creating a flow from blank
   1. Pro Tip: Create this as a Team Flow so your team can manage it with you!
3. Select Search hundreds of connectors and triggers.
   
4. Search for When a HTTP request is received, and select it as your Trigger.
   
5. Under Request Body JSON Schema, enter the following:

{

“type”: “object”,

“properties”: {

“Device”: {

“type”: “string”

},

“User”: {

“type”: “string”

},

“IsAdmin”: {

“type”: “string”

}

}

}

6. Select New step
7. Search for and select Initialize variable.
8. Fill out the fields as follows:
   
   We will need to refer to this Device/User combination a few times so the variable will help us throughout the Flow.
9. Add a New step again of type Initialize variable.
10. Fill out the fields as follows:
    
    1. To fill in the Value field, search for “false” in the Expressions menu:
       
11. Add a New step of type Get Items (SharePoint)
12. Fill out the fields as following (customize the Site Address and List Name to match your SharePoint list):
    
    This will allow us to see if there is an existing entry for the Device/User combination.
13. Add a New step and select Apply to Each:
    
14. For Select an output from previous steps, choose value:
    
15. Click Add an action and find and select Set a variable.
16. Fill out the fields as following (using the expressions menu to fill in “true”):
    
17. Now that we’ve determined if an item exists already, click New step at the bottom (outside of the loop), and choose Condition:
    
18. Fill out the condition as follows:
    
19. Under If yes (which indicates an item already exists with this Computer/User combination), add an action of Update Item from the SharePoint connector:
    
    NOTE: by selecting ID for Id above, Flow will automatically put this action in a loop. You can safely leave that (you should not try to remove the loop). The action will still only occur once.
20. Under If no (indicating no item exists in SharePoint for this Computer/User combination), add another Condition, and fill out as follows:
    
    NOTE: Use the actual word “true”, not an Expression as in prior steps.
21. Under the new Condition, under If yes (indicating the user is a local admin), add an action of Create Item from the SharePoint connector:
    
22. Under the new Condition, under If no (indicating the user is not a local admin), add an action of Create Item from the SharePoint connector:
    
23. Save your flow, and scroll back up to the top.
24. For When an HTTP Request is received, you should now see a URL next to HTTP POST URL:
    
    1. Save that URL; you will need it in a later step.

PowerShell

1. Create a PowerShell script with the following content and name it “CheckAdmin.ps1” (you can use NotePad if you prefer):
   1. Make sure to add your HTTP POST URL from above inbetween the quotes on the second line.

#The HTTP POST URL from Microsoft Flow

$URI = “” #ADD YOUR URL HERE

#Get Current ComputerName

$computer = $env:computername

#Get Current UserName

$CurrentUser = whoami

#Get User’s Local Group Membership

$CurrentUserGroups = whoami /groups

#Check if current user is a member of the Local Admins group

$CurrentUserAdmin = $CurrentUserGroups -like “*S-1-5-32-544*”

#If user is an admin

if ($CurrentUserAdmin) {

$body = ConvertTo-JSON @{Device = $computer; User = $CurrentUser; IsAdmin = ‘true’}

#Start Flow

Invoke-RestMethod -uri $URI -Method Post -body $body -ContentType ‘application/json’

}

#If user is not an admin

else {

$body = ConvertTo-JSON @{Device = $computer; User = $CurrentUser; IsAdmin = ‘false’}

#Start Flow

Invoke-RestMethod -uri $URI -Method Post -body $body -ContentType ‘application/json’

}

2. Save the PowerShell script locally on your computer.

Intune

1. Navigate to your Intune portal by going to https://portal.azure.com/ and selecting Intune.
   
2. Select Device Configuration.
   
3. Select PowerShell Scripts.
4. Select New, and fill in the information:
   
   1. For Script location, navigate to the PowerShell script you saved earlier.

i.Pro Tip: Keep a backup copy of this script. Intune does not allow you to re-download it.

5. Click on Configure, and match the following settings:
   
6. Click OK, and then Create.
7. On the next screen, click Assignments:
   
8. Click on Select groups
   1. At this point, select a group of Users that you want this script applied to.

i. It is important that the script is not applied to a group of Computers.

2. Click Select, and then Save.

At this point your script will begin running for the users assigned. It could take 24 hours for data to start populating.

The way Intune handles PowerShell scripts means this will run a single time per user per logged in PC. This is great to collect a one time snapshot of local admin status, but if you want to run it again, just simply repeat the Intune steps above again! The Flow is already built to handle updates to existing list entries if you choose to run it multiple times.

Additionally, consider integrating the SharePoint list with PowerBI or alerting to get better visibility into this data.

Also, consider this solution for any data you want to gather from your Windows machines. You could grab application installations, disk health, and more! Just remember that every time this script runs on every machine, it will kick off a Flow, counting against your runs per month.

While not a perfect solution, hopefully, this gives you greater insight into your Intune-managed environment!

Thanks for reading!