SharePoint: PowerShell to Get/Add/Remove Users of Local Administrator Group

Introduction

This article outlines how to get, add and remove users of a local administrator group on SharePoint servers using a PowerShell script.

Local Administrators

The script does the following functionality.

1. Gets the local administrators of the machine.
   
2. Adds a user to the local administrator of the machine (the user must enter the user details into the AddUsers.csv file and place it under the folder where the PowerShell script exists).
   
3. Removes a user from the local administrator of the machine (the user must enter the user details into the RemoveUsers.csv file and place it under the folder where the PowerShell script exists).

Get the local administrators of the machine

The following piece of code gets the users under the local administrator group of the machine.

Function GetServerAdministrators([Microsoft.SharePoint.Administration.SPFarm]$farm)
{
    write-host ""
    write-host "Preparing to collect SP server administrator details" -fore magenta
    $output = $scriptbase + "\" + "ServerAdminDetails.csv"
    "ServerName" + "," + "AdminMember" | Out-File -Encoding Default -FilePath $Output;
foreach($server in $farm.Servers)
{
    foreach($instance in $server.ServiceInstances)
    {
          if($instance.TypeName -eq $timerServiceInstanceName)
        {
            [string]$serverName = $server.Name
            write-host "Collecting administrator details for the server " $servername -fore yellow
            $admins = invoke-command {net localgroup administrators | where {$_ -AND $_ -notmatch           "command completed successfully"} | select -skip 4} -computer $serverName
            foreach($admin in $admins)
            {
                write-host $admin " is member of administrator group in server " $serverName                -fore cyan
                $serverName + "," + $admin | Out-File -Encoding Default -Append -FilePath               $Output;
            }
    write-host "Administrator details for the server " $serverName " has been collected" -fore green
        }
    }
}
Write-host "Administrator details collected for all the SP servers in the farm" -fore green
  }

Add users to the local administrator of the machine

 
The following piece of code helps to add the users to the local administrator group on the SharePoint servers.

Function AddUserToServerAdminGroup([String]$AdminMember, [String]$ServerName)
{
    $ans = read-host "Do you want to add user $AdminMember to server $ServerName (y/n)? "
    if($ans -eq 'y')
    {
        write-host "Adding user " $AdminMember " to administrator group on server " $ServerName -fore   yellow
    $AdminMember1 = $AdminMember.split("\")
    $AdminMember2 = $AdminMember1[0] + "/" + $AdminMember1[1]
    $GroupObj = [ADSI]"WinNT://$ServerName/Administrators"
    $GroupObj.Add("WinNT://$AdminMember2")
    write-host $AdminMember " added to the local administrator group on the server " $ServerName -fore  green
    }
    else
    {
    write-host "User choose not to add user " $AdminMember " to the server " $ServerName " administrator    group" -fore cyan
    }
}

Remove users from local administrator of the machine

The following piece of code helps to remove the users from the local administrator group on the SharePoint servers.

Function RemoveUserFromServerAdminGroup([String]$AdminMember, [String]$ServerName)
{
    $ans = read-host "Do you want to remove user $AdminMember from server $ServerName (y/n)? "
    if($ans -eq 'y')
    {
        write-host "Removing user " $AdminMember " from administrator group on server " $ServerName -       fore yellow
        $AdminMember1 = $AdminMember.split("\")
        $AdminMember2 = $AdminMember1[0] + "/" + $AdminMember1[1]
        $GroupObj = [ADSI]"WinNT://$ServerName/Administrators"
        $GroupObj.Remove("WinNT://$AdminMember2")
        write-host $AdminMember " removed from the local administrator group on the server "        $ServerName -fore green
    }
    else
    {
    write-host "User choose not to remove user " $AdminMember " from the server " $ServerName "     administrator group" -fore cyan
    }
}

Complete Code

$LogTime = Get-Date -Format yyyy-MM-dd_hh-mm
$LogFile = ".\GetServerAdministratorsPatch-$LogTime.rtf"

# Add SharePoint PowerShell Snapin


if ( (Get-PSSnapin -Name Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue) -eq $null ) {
    Add-PSSnapin Microsoft.SharePoint.Powershell
}
import-module WebAdministration

$scriptBase = split-path $SCRIPT:MyInvocation.MyCommand.Path -parent
Set-Location $scriptBase

write-host "TESTING FOR LOG FOLDER EXISTENCE" -fore yellow
$TestLogFolder = test-path -path $scriptbase\Logs
if($TestLogFolder)
{
    write-host "The log folder already exist in the script location" -fore yellow
    $clearlogfolder = read-host "Do you want to clear the log folder (y/n)"
    if($clearlogfolder -eq 'y')
    {
        write-host "The user choosen to clear the log folder" -fore yellow
        write-host "Clearing the log folder" -fore yellow
        remove-item $scriptbase\Logs\* -recurse -confirm:$false
        write-host "Log folder cleared" -fore yellow
    }
    else
    {
        write-host "The user choosen not to clear the log files" -fore yellow
    }
}
else
{
    write-host "Log folder does not exist" -fore yellow
    write-host "Creating a log folder" -fore yellow
    New-Item $Scriptbase\Logs -type directory
    write-host "Log folder created" -fore yellow
}

#moving any .rtf files in the scriptbase location
$FindRTFFile = Get-ChildItem $scriptBase\*.* -include *.rtf
if($FindRTFFile)
{
    write-host "Some old log files are found in the script location" -fore yellow
    write-host "Moving old log files into the Logs folder" -fore yellow
    foreach($file in $FindRTFFile)
        {
            move-item -path $file -destination $scriptbase\logs
        }
    write-host "Old log files moved successfully" -fore yellow
}

start-transcript $logfile

$global:timerServiceName = "SharePoint 2010 Timer"
$global:timerServiceInstanceName = "Microsoft SharePoint Foundation Timer"

# Get the local farm instance
[Microsoft.SharePoint.Administration.SPFarm]$farm = [Microsoft.SharePoint.Administration.SPFarm]::get_Local()

Function GetServerAdministrators([Microsoft.SharePoint.Administration.SPFarm]$farm)
{

    write-host ""
    write-host "Preparing to collect SP server administrator details" -fore magenta

    $output = $scriptbase + "\" + "ServerAdminDetails.csv"
    "ServerName" + "," + "AdminMember"  | Out-File -Encoding Default -FilePath $Output;

    foreach($server in $farm.Servers)
        {
        foreach($instance in $server.ServiceInstances)
                {

                      if($instance.TypeName -eq $timerServiceInstanceName)
            {
                          [string]$serverName = $server.Name
                write-host "Collecting administrator details for the server " $servername -fore yellow
                $admins = invoke-command {net localgroup administrators | where {$_ -AND $_ -notmatch "command completed successfully"} | select -skip 4} -computer $serverName
                foreach($admin in $admins)
                {
                    write-host $admin " is member of administrator group in server " $serverName -fore cyan
                    $serverName + "," + $admin | Out-File -Encoding Default  -Append -FilePath $Output;
                }
                write-host "Administrator details for the server " $serverName " has been collected" -fore green
            }
        }
    }
    Write-host "Administrator details collected for all the SP servers in the farm" -fore green

}


Function AddUserToServerAdminGroup([String]$AdminMember, [String]$ServerName)
{

    $ans = read-host "Do you want to add user $AdminMember to server $ServerName (y/n)? "
    if($ans -eq 'y')
    {
        write-host "Adding user " $AdminMember " to administrator group on server " $ServerName -fore yellow

        $AdminMember1 = $AdminMember.split("\")
        $AdminMember2 = $AdminMember1[0] + "/" + $AdminMember1[1]

        $GroupObj = [ADSI]"WinNT://$ServerName/Administrators"
        $GroupObj.Add("WinNT://$AdminMember2")
        write-host $AdminMember " added to the local administrator group on the server " $ServerName -fore green
    }
    else
    {
        write-host "User choose not to add user " $AdminMember " to the server " $ServerName " administrator group" -fore cyan
    }

}


Function RemoveUserFromServerAdminGroup([String]$AdminMember, [String]$ServerName)
{

    $ans = read-host "Do you want to remove user $AdminMember from server $ServerName (y/n)? "
    if($ans -eq 'y')
    {
        write-host "Removing user " $AdminMember " from administrator group on server " $ServerName -fore yellow

        $AdminMember1 = $AdminMember.split("\")
        $AdminMember2 = $AdminMember1[0] + "/" + $AdminMember1[1]

        $GroupObj = [ADSI]"WinNT://$ServerName/Administrators"
        $GroupObj.Remove("WinNT://$AdminMember2")
        write-host $AdminMember " removed from the local administrator group on the server " $ServerName -fore green
    }
    else
    {
        write-host "User choose not to remove user " $AdminMember " from the server " $ServerName " administrator group" -fore cyan
    }

}

write-host "########################################################################################################" -fore cyan
write-host "Enter 1 to get the SP server administrator details" -fore green
write-host "Enter 2 to add users to local administrator group" -fore green
write-host "Enter 3 to remove users from local administrator group" -fore green
write-host "########################################################################################################" -fore cyan


$option = read-host "Enter the option "

switch($option)

{

    1{
        GetServerAdministrators $farm
      }

    2{
        write-host "Preparing to add users to the server administrator group" -fore magenta
        $csvfile = $scriptbase + "\" + "AddUsers.csv"
        import-csv $csvfile | where {
        AddUserToServerAdminGroup $_.AdminMember $_.ServerName
        }
        write-host "Users has been added to local administrators group" -fore green
      }

    3{
        write-host "Preparing to remove users from the server administrator group" -fore magenta
        $csvfile1 = $scriptbase + "\" + "RemoveUsers.csv"
        import-csv $csvfile1 | where {
        RemoveUserFromServerAdminGroup $_.AdminMember $_.ServerName
        }
        write-host "Users has been removed from local administrators group" -fore green
      }

}

stop-transcript

Execution Procedure

1. Download and copy the script folder to the SharePoint server.
2. Launch the SharePoint management shell.
3. Navigate to the script path and execute the script.
   
   

Enter the desired option.

Conclusion

Thus this article outlines how to get, add and remove users of the local administrator group on SharePoint servers using a PowerShell script.