Trouble creating Local admin users via Intune

Rookie{} 61 Reputation points
2022-03-28T17:22:15.113+00:00

We are trying to create a local admin user other than the auto pilot user in Intune. The way we have setup is our auto pilot user (Domain user account) is an admin user and then we are using CSP to create another local admin user. We are using hybrid mode enrollment.

We have a Device configuration profile with OMA URI as follows:

  • OMA-URI: ./Device/Vendor/MSFT/Accounts/Users/admin1/Password Data Type: String Value: *******
  • OMA-URI: ./Device/Vendor/MSFT/Accounts/Users/admin1/LocalUserGroup: 2 Data Type: Integer Value: 2

Assignment : User Group

When it Works:

So far based on testing it works when the profile is assigned to the Dynamic device group which is created to perform auto pilot on intune machines for which the device hash is already imported, but in this process it fails to make the auto pilot user as an admin

When it doesn't work:

When the configuration profile is applied to user group, it fails to create the user, but then the auto pilot user is created properly with admin rights.

Variations tried:

Making the localadmin user as a non admin by changing the integer value to 1 and then first tried with dynamic device group assigned, which failed and also the user group which also failed.

Client machine Windows version: Windows 10 21H2

Would like to avoid the PowerShell script method if possible. Kindly let me know if you require any further details.

Microsoft Intune Configuration
Microsoft Intune Configuration
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Configuration: The process of arranging or setting up computer systems, hardware, or software.
1,723 questions
Microsoft Intune Enrollment
Microsoft Intune Enrollment
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Enrollment: The process of requesting, receiving, and installing a certificate.
1,251 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Crystal-MSFT 42,961 Reputation points Microsoft Vendor
    2022-03-29T01:25:29.183+00:00

    @Rookie{} , For the test "Making the localadmin user as a non admin by changing the integer value to 1, and then first tried with dynamic device group assigned, which failed and also the user group which also failed.", this is failed because "./Device/Vendor/MSFT/Accounts/Users/localadmin/LocalUserGroup" only support add operation. Changing is replace operation. So it will fail. we can see more details in the following link:
    https://learn.microsoft.com/en-us/windows/client-management/mdm/accounts-csp

    If we want to add the user into local administrators group, we can choose LocalUsersAndGroups CSP instead. Here is a link with more details for the reference:
    https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-localusersandgroups

    For the Autopilot admin and configuration profile to create local admin conflict issue, I will do test in my environment to see if I have the same issue. This needs some time. if there's any update, I will update here.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.