Direct answer
A local administrator review identifies accounts and groups that can administer a Windows device, checks why they need that access and reduces unnecessary standing privilege without removing the organisation's recovery path.
Enumerate the local group
On an authorised device, inspect members of the local Administrators group and record each principal's name, source and business owner. Get-LocalGroupMember can list local group members; its SID parameter avoids relying on a localised group name. The built-in Administrators group has the well-known SID S-1-5-32-544.
Reference: Microsoft: Get-LocalGroupMember.
Resolve indirect access
A listed directory group may contain multiple people or nested groups. Ask the identity administrator to review the relevant directory membership and any device-management assignments. The local list by itself is not a complete list of everyone who can obtain elevated access. Distinguish named administrator accounts, managed service accounts and emergency access accounts.
- Record why access is required, who approved it and when it should be reviewed.
- Review departed staff and groups with broad or unclear membership.
- Check whether administrative work has an approved separate account or elevation process.
Plan a safe reduction
Suppose a support group was added for a migration that has ended. Confirm its use with support and device owners, identify any automation that depends on it, and arrange a managed change. Preserve a verified recovery method and test it before removal. Limit the duration of exceptions and avoid placing recovery passwords in shared documents.
Verify and monitor
After a change, verify the group membership and test both the intended administrative workflow and a standard user's normal work. A device-management policy can restore membership later, so check the source of the assignment and collect another snapshot after policy refresh. Schedule periodic review and after staff or role changes.
- Keep the before-and-after membership record in an access-controlled location.
- Record unresolved principals for follow-up rather than silently treating them as safe.
Assessment limits
Local group membership is only one route to privilege. Directory nesting, delegated rights, elevation tools, policy and available permissions affect the result. This review does not establish the complete effective privileges of every user.
Frequently asked questions
Does a directory group in Administrators represent one person?
No. A group can contain many users and nested groups. Review its membership and assignment separately with the identity owner.
Can I remove every local administrator?
Keep an approved and tested administrative recovery path. Coordinate membership changes with device management and support owners to avoid losing access.
Does User Account Control remove administrator membership?
No. Membership and elevation behaviour are distinct questions; review both the assigned access and how elevated tasks are approved.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.