SharePoint

SharePoint: PowerShell to Get/Add/Remove Users of Local Administrator Group

Introduction

This article outlines how to get, add and remove users of a local administrator group on SharePoint servers using a PowerShell script.

Local Administrators

The script does the following functionality.

  1. Gets the local administrators of the machine.
  2. Adds a user to the local administrator of the machine (the user must enter the user details into the AddUsers.csv file and place it under the folder where the PowerShell script exists).
  3. Removes a user from the local administrator of the machine (the user must enter the user details into the RemoveUsers.csv file and place it under the folder where the PowerShell script exists).

Get the local administrators of the machine

The following piece of code gets the users under the local administrator group of the machine.

  1. Function GetServerAdministrators([Microsoft.SharePoint.Administration.SPFarm]$farm)  
  2. {  
  3.     write-host ""  
  4.     write-host "Preparing to collect SP server administrator details" -fore magenta  
  5.     $output = $scriptbase + "\" + "ServerAdminDetails.csv"  
  6.     "ServerName" + "," + "AdminMember" | Out-File -Encoding Default -FilePath $Output;  
  7. foreach($server in $farm.Servers)  
  8. {  
  9.     foreach($instance in $server.ServiceInstances)  
  10.     {  
  11.           if($instance.TypeName -eq $timerServiceInstanceName)  
  12.         {  
  13.             [string]$serverName = $server.Name  
  14.             write-host "Collecting administrator details for the server " $servername -fore yellow  
  15.             $admins = invoke-command {net localgroup administrators | where {$_ -AND $_ -notmatch           "command completed successfully"} | select -skip 4} -computer $serverName  
  16.             foreach($admin in $admins)  
  17.             {  
  18.                 write-host $admin " is member of administrator group in server " $serverName                -fore cyan  
  19.                 $serverName + "," + $admin | Out-File -Encoding Default -Append -FilePath               $Output;  
  20.             }  
  21.     write-host "Administrator details for the server " $serverName " has been collected" -fore green  
  22.         }  
  23.     }  
  24. }  
  25. Write-host "Administrator details collected for all the SP servers in the farm" -fore green  
  26.   }  
Add users to the local administrator of the machine
 
The following piece of code helps to add the users to the local administrator group on the SharePoint servers.
  1. Function AddUserToServerAdminGroup([String]$AdminMember, [String]$ServerName)  
  2. {  
  3.     $ans = read-host "Do you want to add user $AdminMember to server $ServerName (y/n)? "  
  4.     if($ans -eq 'y')  
  5.     {  
  6.         write-host "Adding user " $AdminMember " to administrator group on server " $ServerName -fore   yellow  
  7.     $AdminMember1 = $AdminMember.split("\")  
  8.     $AdminMember2 = $AdminMember1[0] + "/" + $AdminMember1[1]  
  9.     $GroupObj = [ADSI]"WinNT://$ServerName/Administrators"  
  10.     $GroupObj.Add("WinNT://$AdminMember2")  
  11.     write-host $AdminMember " added to the local administrator group on the server " $ServerName -fore  green  
  12.     }  
  13.     else  
  14.     {  
  15.     write-host "User choose not to add user " $AdminMember " to the server " $ServerName " administrator    group" -fore cyan  
  16.     }  
  17. }  
Remove users from local administrator of the machine

The following piece of code helps to remove the users from the local administrator group on the SharePoint servers.
  1. Function RemoveUserFromServerAdminGroup([String]$AdminMember, [String]$ServerName)  
  2. {  
  3.     $ans = read-host "Do you want to remove user $AdminMember from server $ServerName (y/n)? "  
  4.     if($ans -eq 'y')  
  5.     {  
  6.         write-host "Removing user " $AdminMember " from administrator group on server " $ServerName -       fore yellow  
  7.         $AdminMember1 = $AdminMember.split("\")  
  8.         $AdminMember2 = $AdminMember1[0] + "/" + $AdminMember1[1]  
  9.         $GroupObj = [ADSI]"WinNT://$ServerName/Administrators"  
  10.         $GroupObj.Remove("WinNT://$AdminMember2")  
  11.         write-host $AdminMember " removed from the local administrator group on the server "        $ServerName -fore green  
  12.     }  
  13.     else  
  14.     {  
  15.     write-host "User choose not to remove user " $AdminMember " from the server " $ServerName "     administrator group" -fore cyan  
  16.     }  
  17. }  
Complete Code
  1. $LogTime = Get-Date -Format yyyy-MM-dd_hh-mm  
  2. $LogFile = ".\GetServerAdministratorsPatch-$LogTime.rtf"  
  3.  
  4. # Add SharePoint PowerShell Snapin  
  5.   
  6.   
  7. if ( (Get-PSSnapin -Name Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue) -eq $null ) {  
  8.     Add-PSSnapin Microsoft.SharePoint.Powershell  
  9. }  
  10. import-module WebAdministration  
  11.   
  12. $scriptBase = split-path $SCRIPT:MyInvocation.MyCommand.Path -parent  
  13. Set-Location $scriptBase  
  14.   
  15. write-host "TESTING FOR LOG FOLDER EXISTENCE" -fore yellow  
  16. $TestLogFolder = test-path -path $scriptbase\Logs  
  17. if($TestLogFolder)  
  18. {  
  19.     write-host "The log folder already exist in the script location" -fore yellow  
  20.     $clearlogfolder = read-host "Do you want to clear the log folder (y/n)"  
  21.     if($clearlogfolder -eq 'y')  
  22.     {  
  23.         write-host "The user choosen to clear the log folder" -fore yellow  
  24.         write-host "Clearing the log folder" -fore yellow  
  25.         remove-item $scriptbase\Logs\* -recurse -confirm:$false  
  26.         write-host "Log folder cleared" -fore yellow  
  27.     }  
  28.     else  
  29.     {  
  30.         write-host "The user choosen not to clear the log files" -fore yellow  
  31.     }  
  32. }  
  33. else  
  34. {  
  35.     write-host "Log folder does not exist" -fore yellow  
  36.     write-host "Creating a log folder" -fore yellow  
  37.     New-Item $Scriptbase\Logs -type directory  
  38.     write-host "Log folder created" -fore yellow  
  39. }         
  40.  
  41. #moving any .rtf files in the scriptbase location  
  42. $FindRTFFile = Get-ChildItem $scriptBase\*.* -include *.rtf  
  43. if($FindRTFFile)  
  44. {  
  45.     write-host "Some old log files are found in the script location" -fore yellow  
  46.     write-host "Moving old log files into the Logs folder" -fore yellow  
  47.     foreach($file in $FindRTFFile)  
  48.         {  
  49.             move-item -path $file -destination $scriptbase\logs  
  50.         }  
  51.     write-host "Old log files moved successfully" -fore yellow  
  52. }  
  53.   
  54. start-transcript $logfile  
  55.   
  56. $global:timerServiceName = "SharePoint 2010 Timer"  
  57. $global:timerServiceInstanceName = "Microsoft SharePoint Foundation Timer"  
  58.  
  59. # Get the local farm instance  
  60. [Microsoft.SharePoint.Administration.SPFarm]$farm = [Microsoft.SharePoint.Administration.SPFarm]::get_Local()  
  61.   
  62. Function GetServerAdministrators([Microsoft.SharePoint.Administration.SPFarm]$farm)  
  63. {  
  64.   
  65.     write-host ""  
  66.     write-host "Preparing to collect SP server administrator details" -fore magenta  
  67.   
  68.     $output = $scriptbase + "\" + "ServerAdminDetails.csv"  
  69.     "ServerName" + "," + "AdminMember"  | Out-File -Encoding Default -FilePath $Output;  
  70.   
  71.     foreach($server in $farm.Servers)  
  72.         {  
  73.         foreach($instance in $server.ServiceInstances)  
  74.                 {  
  75.               
  76.                       if($instance.TypeName -eq $timerServiceInstanceName)  
  77.             {  
  78.                           [string]$serverName = $server.Name  
  79.                 write-host "Collecting administrator details for the server " $servername -fore yellow  
  80.                 $admins = invoke-command {net localgroup administrators | where {$_ -AND $_ -notmatch "command completed successfully"} | select -skip 4} -computer $serverName  
  81.                 foreach($admin in $admins)  
  82.                 {  
  83.                     write-host $admin " is member of administrator group in server " $serverName -fore cyan  
  84.                     $serverName + "," + $admin | Out-File -Encoding Default  -Append -FilePath $Output;  
  85.                 }  
  86.                 write-host "Administrator details for the server " $serverName " has been collected" -fore green  
  87.             }  
  88.         }  
  89.     }  
  90.     Write-host "Administrator details collected for all the SP servers in the farm" -fore green  
  91.   
  92. }  
  93.   
  94.   
  95. Function AddUserToServerAdminGroup([String]$AdminMember, [String]$ServerName)  
  96. {  
  97.   
  98.     $ans = read-host "Do you want to add user $AdminMember to server $ServerName (y/n)? "  
  99.     if($ans -eq 'y')  
  100.     {  
  101.         write-host "Adding user " $AdminMember " to administrator group on server " $ServerName -fore yellow  
  102.           
  103.         $AdminMember1 = $AdminMember.split("\")  
  104.         $AdminMember2 = $AdminMember1[0] + "/" + $AdminMember1[1]  
  105.           
  106.         $GroupObj = [ADSI]"WinNT://$ServerName/Administrators"  
  107.         $GroupObj.Add("WinNT://$AdminMember2")  
  108.         write-host $AdminMember " added to the local administrator group on the server " $ServerName -fore green  
  109.     }  
  110.     else  
  111.     {  
  112.         write-host "User choose not to add user " $AdminMember " to the server " $ServerName " administrator group" -fore cyan  
  113.     }  
  114.   
  115. }  
  116.   
  117.   
  118. Function RemoveUserFromServerAdminGroup([String]$AdminMember, [String]$ServerName)  
  119. {  
  120.   
  121.     $ans = read-host "Do you want to remove user $AdminMember from server $ServerName (y/n)? "  
  122.     if($ans -eq 'y')  
  123.     {  
  124.         write-host "Removing user " $AdminMember " from administrator group on server " $ServerName -fore yellow  
  125.           
  126.         $AdminMember1 = $AdminMember.split("\")  
  127.         $AdminMember2 = $AdminMember1[0] + "/" + $AdminMember1[1]  
  128.           
  129.         $GroupObj = [ADSI]"WinNT://$ServerName/Administrators"  
  130.         $GroupObj.Remove("WinNT://$AdminMember2")  
  131.         write-host $AdminMember " removed from the local administrator group on the server " $ServerName -fore green  
  132.     }  
  133.     else  
  134.     {  
  135.         write-host "User choose not to remove user " $AdminMember " from the server " $ServerName " administrator group" -fore cyan  
  136.     }  
  137.   
  138. }  
  139.   
  140. write-host "########################################################################################################" -fore cyan  
  141. write-host "Enter 1 to get the SP server administrator details" -fore green  
  142. write-host "Enter 2 to add users to local administrator group" -fore green  
  143. write-host "Enter 3 to remove users from local administrator group" -fore green  
  144. write-host "########################################################################################################" -fore cyan  
  145.   
  146.   
  147. $option = read-host "Enter the option "  
  148.   
  149. switch($option)  
  150.   
  151. {  
  152.   
  153.     1{  
  154.         GetServerAdministrators $farm  
  155.       }  
  156.   
  157.     2{  
  158.         write-host "Preparing to add users to the server administrator group" -fore magenta  
  159.         $csvfile = $scriptbase + "\" + "AddUsers.csv"  
  160.         import-csv $csvfile | where {  
  161.         AddUserToServerAdminGroup $_.AdminMember $_.ServerName  
  162.         }  
  163.         write-host "Users has been added to local administrators group" -fore green  
  164.       }  
  165.   
  166.     3{  
  167.         write-host "Preparing to remove users from the server administrator group" -fore magenta  
  168.         $csvfile1 = $scriptbase + "\" + "RemoveUsers.csv"  
  169.         import-csv $csvfile1 | where {  
  170.         RemoveUserFromServerAdminGroup $_.AdminMember $_.ServerName  
  171.         }  
  172.         write-host "Users has been removed from local administrators group" -fore green       
  173.       }  
  174.   
  175. }  
  176.   
  177. stop-transcript  
Execution Procedure
  1. Download and copy the script folder to the SharePoint server.
  2. Launch the SharePoint management shell.
  3. Navigate to the script path and execute the script.

Enter the desired option.

Conclusion

Thus this article outlines how to get, add and remove users of the local administrator group on SharePoint servers using a PowerShell script.

Up Next
    Ebook Download
    View all
    Learn
    View all
    Get Started

    You need to be a premium member to use this feature. To access it, you'll have to upgrade your membership.

    Become a sharper developer and jumpstart your career.

    Basic

    $0

    $

    . 00

    monthly

    For Basic members:

    • Standard Profile
    • Access learning courses
    • Access free e-books
    • 1x point
    Premium

    $20

    $

    . 00

    monthly

    For Premium members:

    • Earn 2x reward points
    • Premium profile with Verified check
    • Premium Avatar with status update
    • Learning courses
    • Unlimited Certifications and badges on profile
    • Unlimited Book downloads
    • Access to Premium content
    • Online Training
    • Unlimited PDF conversions and downloads
    • Professional Resume Writing
    • Interview Preparations Guide
    • 25 messages per month
    • 1 "Kodzu" avatar, basic
    Elite

    $45

    $

    . 00

    monthly

    For Elite members:

    • Bundle E-books
    • Access to all Learn Series
    • Unlimited Apply Jobs