Report for local admin users

InsightIDR
,
1

Hi.

Can I get a list of users who have local admin rights in either IDR or IVM?

2

Hey, but in the console, or in your monitored infraestructure?

3

In my monitored infrastructure. So all my endpoints, primarily Windows OS.

4

I don´t think you can do that using InsightIDR, you just can read LDAP properties.
In terms of InsightVM you can get all users from every machine using the right query, like exporting software or vulnerabilities.

5

Thanks Mike. LDAP properties won’t help with this. I guess getting the members of the local administrators group. I know there are many ways to do that but didn’t know if R7 had something in place already.

6

I ended up just running the following Velociraptor artifact on my Windows endpoints:
Windows.Sys.LocalAdmins