Join us at Experience '19: The Digital Employee Experience Conference. Learn More

cookie alert

We use cookies to offer you a better browsing experience, analyze site traffic, personalize content, and serve targeted advertisements. If you continue to use this site, you consent to our use of cookies.

What's New

View all resources

Nexthink Library

User Access Control

Ensure the compliance by checking the Administrators group and verifying User Access Control (UAC) is enabled.

Enable User Access Control Get Local Administrators

Content

Campaigns - 1
Remote actions - 2

Required Modules

Nexthink Act
Nexthink Engage

Platforms

Windows

Compatibility

V6.14 and later
Install
  • 2.0.1.0 - Fixed output management of Get-LocalAdministrators Remote Action
  • 2.0.0.0 - Added Get-LocalAdministrators Remote Action
  • 1.0.0.0 - Initial release

Description

This Library pack is composed of Remote Action scripts which help improving the compliance level by enforcing User Access Control to be enabled, and listing members of Administrator group filtered by provided whitelist.Please use the link on the left menu to learn more about the function and range of action of the script.

Enable User Access Control

Script Description

Checks if User Access Control is enabled, and enables it if it is not.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

LabelDescription
Campaign IdUID of the campaign to notify user that the device must be restarted

Outputs

None.

Further Information

The device must be restarted after this action for the changes to take effect.

Get Local Administrators

Script Description

Obtains a list and total number of identities (local and domain users or groups) who are members of the target device Administrators group, filtered by provided whitelist.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

LabelDescription
WhitelistOptional list of identities (users and groups) to be excluded from the data obtained. Multiple values are comma-separated. Example values are "DOMAINUser, Admin, Local Admin, Admin Group"

Outputs

LabelTypeDescription
Local IdentitiesStringListList of local identities (users and groups) added to Administrators group
Domain IdentitiesStringListList of domain identities (users and groups) added to Administrators group
Total IdentitiesIntTotal number of identities (users and groups) added to Administrators group, excluding the ones present in the whitelist

Test Scenarios

Success
Test CaseThe script execution is successful and data is displayed in Finder as custom fields
EnvironmentWindows 10 x86/x64 (1803/1809/1903) - Windows 7 x86/x64 (Multi-language)
ResultsSuccess - Script is executed with an empty Whitelist LocalIdentities and DomainIdentities are retrieved without skipping/ignoring any identity
Success - Whitelist contains values that were not found in Administrators group LocalIdentities and DomainIdentities are retrieved without skipping/ignoring any identity
Success - Whitelist contains an identity name (either local or domain name) that is currently added to Administrators group DomainIdentities and DomainIdentities are, skipping the given identities matching against the Whitelist
Success - there are no domain users/groups addedd as Administrators DomainIdentities will be empty, and will be displayed as "-" in Finder
Failure
Test CaseThe script execution fails and throws an exception due to invalid input
EnvironmentWindows 10 x86/x64 (1803/1809/1903) - Windows 7 x86/x64 (Multi-language)
ResultsFailure - The Whitelist contains a value with more than 20 characters Exception is thrown and script exit code is 1
Failure - The Whitelist contains a value with invalid characters Exception is thrown and script exit code is 1
Thank you!