Back to all recipes
Level: MidLast updated:
Export a list of all privileged accounts
"Domain Admins","Enterprise Admins","Schema Admins","Account Operators" |
ForEach-Object {
Get-ADGroupMember $_ -Recursive |
Select-Object @{n='Group';e={$_}} , Name, SamAccountName
}Why it works this way
Most organizations discover forgotten admin accounts the first time they run this.
Watch out
- Every account here needs justification, MFA and a separate admin workstation.
- Account Operators is a dangerous forgotten group — check it.