Report local Administrators members
Documentation: Microsoft Learn
Get-LocalGroupMember resolves the group membership and returns each principal with two useful qualifiers.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-LocalGroupMember -Group Administrators | Select-Object Name,ObjectClass,PrincipalSource- Stage 1Get-LocalGroupMember
-Group - Stage 2Select-Object
Positional values or no named parameters
How it works
Get-LocalGroupMember resolves the group membership and returns each principal with two useful qualifiers. ObjectClass says whether the entry is a user or a nested group, and PrincipalSource separates a local account from a domain one. Select-Object keeps those columns next to the resolved name.
Adapting it
Point -Group at Remote Desktop Users or Backup Operators to cover the other groups that grant meaningful access on a member server.
Requirements
Elevation on most builds.
If the result is unexpected
The enumeration fails with "Failed to compare two elements in the array" or a message about a principal that could not be resolved, and no membership list comes back at all.
The cmdlet resolves every member SID to a name, and a SID left behind by a deleted domain account or belonging to an unreachable trusted domain cannot be resolved. Its internal sorting then fails on that entry and aborts the whole call rather than returning the members it did resolve. This is known behavior in the LocalAccounts module rather than a permissions issue.
- Confirm the session is elevated, since an unelevated attempt fails with a different and much clearer access message.
- Fall back to net localgroup Administrators, which prints raw entries including the ones that will not resolve.
- Read the membership through the WinNT ADSI provider when the cmdlet keeps failing.
- Remove orphaned entries with net localgroup Administrators /delete using the SID string itself.
- Check whether a trusted domain is unreachable, because that produces the same symptom with no orphaned entry involved.
Validate the result
The cmdlet returns the full membership with every entry resolving to a name, and the count matches what net localgroup reports.
Keep the check reliable
Remove accounts from local groups during offboarding rather than only deleting the directory object, since that is what leaves the orphaned SID behind.
