1

I'm trying to delete all users from the Group Users from the computer except the NT Authority accounts. I want to get the list of users from the Group Users, and use that list to delete the profiles from the computer.

I'm not an PowerShell expert, so this is not my strong side.

$users = Get-LocalGroupMember Users
ForEach ($user in $users) {
     Remove-LocalUser -Name $user
}

Only the names from Get-LocalGroupMember don't seem to match with what Remove-LocalUser will delete, any solution?

SimonS
  • 9,869
Jordi van Deerse
  • 21

1 Answers1

2

If you run Get-LocalGroupMember Users | fl * you can see all the properties that the cmdlet returns.

PS C:\WINDOWS\system32> Get-LocalGroupMember Users | fl *

Name            : NT-AUTORITÄT\Authentifizierte Benutzer
SID             : S-1-5-11
PrincipalSource : Unknown
ObjectClass     : Gruppe


Name            : NT-AUTORITÄT\INTERAKTIV
SID             : S-1-5-4
PrincipalSource : Unknown
ObjectClass     : Gruppe


Name            : SimonS\abctest
SID             : S-1-5-21-3159913292-2406416548-3156803696-1008
PrincipalSource : Local
ObjectClass     : Benutzer

And if you run Get-Help Remove-LocalUser you can see in the syntax section, that there is one ParameterSet that accepts an SID, which fits our needs because we got that in our return.

PS C:\WINDOWS\system32> Get-Help Remove-LocalUser

SYNTAX
    Remove-LocalUser [-InputObject] <LocalUser[]> [-Confirm] [-WhatIf] [<CommonParameters>]


Remove-LocalUser [-Name] &lt;String[]&gt; [-Confirm] [-WhatIf] [&lt;CommonParameters&gt;]

Remove-LocalUser [-SID] &lt;SecurityIdentifier[]&gt; [-Confirm] [-WhatIf] [&lt;CommonParameters&gt;]

What this means is that we can take the SID that Get-LocalGroupMember returns, and use it on Remove-LocalUser

So This should do the trick (run it in an elevated PowerShell):

Get-LocalGroupMember Users | Where { $_.PrincipalSource -eq 'Local' } | Foreach { Remove-LocalUser -SID $_.SID }

As you can see I have a Where-Object in the command above. This should make sure, that you only delete Local Users, so the NT-Authority ones should not be deleted. Anyhow I don't assume you could even delete them that easily.

As to Why it does not work with the Name Property: Get-LocalGroupMember seems to return the Name in this format Computer\UserName while Remove-LocalUser seems to only accept the format UserName

SimonS
  • 9,869