Introduction

This article outlines how to get, add and remove users of a local administrator group on SharePoint servers using a PowerShell script.

Local Administrators

The script does the following functionality.

  1. Gets the local administrators of the machine.
  2. Adds a user to the local administrator of the machine (the user must enter the user details into the AddUsers.csv file and place it under the folder where the PowerShell script exists).
  3. Removes a user from the local administrator of the machine (the user must enter the user details into the RemoveUsers.csv file and place it under the folder where the PowerShell script exists).

Get the local administrators of the machine

The following piece of code gets the users under the local administrator group of the machine.

  1. Function GetServerAdministrators([Microsoft.SharePoint.Administration.SPFarm]$farm)
  2. {
  3. write-host ""
  4. write-host "Preparing to collect SP server administrator details" -fore magenta
  5. $output = $scriptbase + "\" + "ServerAdminDetails.csv"
  6. "ServerName" + "," + "AdminMember" | Out-File -Encoding Default -FilePath $Output;
  7. foreach($server in $farm.Servers)
  8. {
  9. foreach($instance in $server.ServiceInstances)
  10. {
  11. if($instance.TypeName -eq $timerServiceInstanceName)
  12. {
  13. [string]$serverName = $server.Name
  14. write-host "Collecting administrator details for the server " $servername -fore yellow
  15. $admins = invoke-command {net localgroup administrators | where {$_ -AND $_ -notmatch "command completed successfully"} | select -skip 4} -computer $serverName
  16. foreach($admin in $admins)
  17. {
  18. write-host $admin " is member of administrator group in server " $serverName -fore cyan
  19. $serverName + "," + $admin | Out-File -Encoding Default -Append -FilePath $Output;
  20. }
  21. write-host "Administrator details for the server " $serverName " has been collected" -fore green
  22. }
  23. }
  24. }
  25. Write-host "Administrator details collected for all the SP servers in the farm" -fore green
  26. }
Add users to the local administrator of the machine

The following piece of code helps to add the users to the local administrator group on the SharePoint servers.
  1. Function AddUserToServerAdminGroup([String]$AdminMember, [String]$ServerName)
  2. {
  3. $ans = read-host "Do you want to add user $AdminMember to server $ServerName (y/n)? "
  4. if($ans -eq 'y')
  5. {
  6. write-host "Adding user " $AdminMember " to administrator group on server " $ServerName -fore yellow
  7. $AdminMember1 = $AdminMember.split("\")
  8. $AdminMember2 = $AdminMember1[0] + "/" + $AdminMember1[1]
  9. $GroupObj = [ADSI]"WinNT://$ServerName/Administrators"
  10. $GroupObj.Add("WinNT://$AdminMember2")
  11. write-host $AdminMember " added to the local administrator group on the server " $ServerName -fore green
  12. }
  13. else
  14. {
  15. write-host "User choose not to add user " $AdminMember " to the server " $ServerName " administrator group" -fore cyan
  16. }
  17. }
Remove users from local administrator of the machine

The following piece of code helps to remove the users from the local administrator group on the SharePoint servers.
  1. Function RemoveUserFromServerAdminGroup([String]$AdminMember, [String]$ServerName)
  2. {
  3. $ans = read-host "Do you want to remove user $AdminMember from server $ServerName (y/n)? "
  4. if($ans -eq 'y')
  5. {
  6. write-host "Removing user " $AdminMember " from administrator group on server " $ServerName - fore yellow
  7. $AdminMember1 = $AdminMember.split("\")
  8. $AdminMember2 = $AdminMember1[0] + "/" + $AdminMember1[1]
  9. $GroupObj = [ADSI]"WinNT://$ServerName/Administrators"
  10. $GroupObj.Remove("WinNT://$AdminMember2")
  11. write-host $AdminMember " removed from the local administrator group on the server " $ServerName -fore green
  12. }
  13. else
  14. {
  15. write-host "User choose not to remove user " $AdminMember " from the server " $ServerName " administrator group" -fore cyan
  16. }
  17. }
Complete Code
  1. $LogTime = Get-Date -Format yyyy-MM-dd_hh-mm
  2. $LogFile = ".\GetServerAdministratorsPatch-$LogTime.rtf"
  4. # Add SharePoint PowerShell Snapin
  7. if ( (Get-PSSnapin -Name Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue) -eq $null ) {
  8. Add-PSSnapin Microsoft.SharePoint.Powershell
  9. }
  10. import-module WebAdministration
  12. $scriptBase = split-path $SCRIPT:MyInvocation.MyCommand.Path -parent
  13. Set-Location $scriptBase
  15. write-host "TESTING FOR LOG FOLDER EXISTENCE" -fore yellow
  16. $TestLogFolder = test-path -path $scriptbase\Logs
  17. if($TestLogFolder)
  18. {
  19. write-host "The log folder already exist in the script location" -fore yellow
  20. $clearlogfolder = read-host "Do you want to clear the log folder (y/n)"
  21. if($clearlogfolder -eq 'y')
  22. {
  23. write-host "The user choosen to clear the log folder" -fore yellow
  24. write-host "Clearing the log folder" -fore yellow
  25. remove-item $scriptbase\Logs\* -recurse -confirm:$false
  26. write-host "Log folder cleared" -fore yellow
  27. }
  28. else
  29. {
  30. write-host "The user choosen not to clear the log files" -fore yellow
  31. }
  32. }
  33. else
  34. {
  35. write-host "Log folder does not exist" -fore yellow
  36. write-host "Creating a log folder" -fore yellow
  37. New-Item $Scriptbase\Logs -type directory
  38. write-host "Log folder created" -fore yellow
  39. }
  41. #moving any .rtf files in the scriptbase location
  42. $FindRTFFile = Get-ChildItem $scriptBase\*.* -include *.rtf
  43. if($FindRTFFile)
  44. {
  45. write-host "Some old log files are found in the script location" -fore yellow
  46. write-host "Moving old log files into the Logs folder" -fore yellow
  47. foreach($file in $FindRTFFile)
  48. {
  49. move-item -path $file -destination $scriptbase\logs
  50. }
  51. write-host "Old log files moved successfully" -fore yellow
  52. }
  54. start-transcript $logfile
  56. $global:timerServiceName = "SharePoint 2010 Timer"
  57. $global:timerServiceInstanceName = "Microsoft SharePoint Foundation Timer"
  59. # Get the local farm instance
  60. [Microsoft.SharePoint.Administration.SPFarm]$farm = [Microsoft.SharePoint.Administration.SPFarm]::get_Local()
  62. Function GetServerAdministrators([Microsoft.SharePoint.Administration.SPFarm]$farm)
  63. {
  65. write-host ""
  66. write-host "Preparing to collect SP server administrator details" -fore magenta
  68. $output = $scriptbase + "\" + "ServerAdminDetails.csv"
  69. "ServerName" + "," + "AdminMember" | Out-File -Encoding Default -FilePath $Output;
  71. foreach($server in $farm.Servers)
  72. {
  73. foreach($instance in $server.ServiceInstances)
  74. {
  76. if($instance.TypeName -eq $timerServiceInstanceName)
  77. {
  78. [string]$serverName = $server.Name
  79. write-host "Collecting administrator details for the server " $servername -fore yellow
  80. $admins = invoke-command {net localgroup administrators | where {$_ -AND $_ -notmatch "command completed successfully"} | select -skip 4} -computer $serverName
  81. foreach($admin in $admins)
  82. {
  83. write-host $admin " is member of administrator group in server " $serverName -fore cyan
  84. $serverName + "," + $admin | Out-File -Encoding Default -Append -FilePath $Output;
  85. }
  86. write-host "Administrator details for the server " $serverName " has been collected" -fore green
  87. }
  88. }
  89. }
  90. Write-host "Administrator details collected for all the SP servers in the farm" -fore green
  92. }
  95. Function AddUserToServerAdminGroup([String]$AdminMember, [String]$ServerName)
  96. {
  98. $ans = read-host "Do you want to add user $AdminMember to server $ServerName (y/n)? "
  99. if($ans -eq 'y')
  100. {
  101. write-host "Adding user " $AdminMember " to administrator group on server " $ServerName -fore yellow
  103. $AdminMember1 = $AdminMember.split("\")
  104. $AdminMember2 = $AdminMember1[0] + "/" + $AdminMember1[1]
  106. $GroupObj = [ADSI]"WinNT://$ServerName/Administrators"
  107. $GroupObj.Add("WinNT://$AdminMember2")
  108. write-host $AdminMember " added to the local administrator group on the server " $ServerName -fore green
  109. }
  110. else
  111. {
  112. write-host "User choose not to add user " $AdminMember " to the server " $ServerName " administrator group" -fore cyan
  113. }
  115. }
  118. Function RemoveUserFromServerAdminGroup([String]$AdminMember, [String]$ServerName)
  119. {
  121. $ans = read-host "Do you want to remove user $AdminMember from server $ServerName (y/n)? "
  122. if($ans -eq 'y')
  123. {
  124. write-host "Removing user " $AdminMember " from administrator group on server " $ServerName -fore yellow
  126. $AdminMember1 = $AdminMember.split("\")
  127. $AdminMember2 = $AdminMember1[0] + "/" + $AdminMember1[1]
  129. $GroupObj = [ADSI]"WinNT://$ServerName/Administrators"
  130. $GroupObj.Remove("WinNT://$AdminMember2")
  131. write-host $AdminMember " removed from the local administrator group on the server " $ServerName -fore green
  132. }
  133. else
  134. {
  135. write-host "User choose not to remove user " $AdminMember " from the server " $ServerName " administrator group" -fore cyan
  136. }
  138. }
  140. write-host "########################################################################################################" -fore cyan
  141. write-host "Enter 1 to get the SP server administrator details" -fore green
  142. write-host "Enter 2 to add users to local administrator group" -fore green
  143. write-host "Enter 3 to remove users from local administrator group" -fore green
  144. write-host "########################################################################################################" -fore cyan
  147. $option = read-host "Enter the option "
  149. switch($option)
  151. {
  153. 1{
  154. GetServerAdministrators $farm
  155. }
  157. 2{
  158. write-host "Preparing to add users to the server administrator group" -fore magenta
  159. $csvfile = $scriptbase + "\" + "AddUsers.csv"
  160. import-csv $csvfile | where {
  161. AddUserToServerAdminGroup $_.AdminMember $_.ServerName
  162. }
  163. write-host "Users has been added to local administrators group" -fore green
  164. }
  166. 3{
  167. write-host "Preparing to remove users from the server administrator group" -fore magenta
  168. $csvfile1 = $scriptbase + "\" + "RemoveUsers.csv"
  169. import-csv $csvfile1 | where {
  170. RemoveUserFromServerAdminGroup $_.AdminMember $_.ServerName
  171. }
  172. write-host "Users has been removed from local administrators group" -fore green
  173. }
  175. }
  177. stop-transcript
Execution Procedure
  1. Download and copy the script folder to the SharePoint server.
  2. Launch the SharePoint management shell.
  3. Navigate to the script path and execute the script.

Enter the desired option.

Conclusion

Thus this article outlines how to get, add and remove users of the local administrator group on SharePoint servers using a PowerShell script.