How to tell if a domain user is a local admin on the machine

I'd like to know if the user MYDOMAIN\SomeUser has local admin rights on the current machine.

I can see if a local user account has admin by using:

C:\>NET USER Mike
User name                    Mike
Full Name
...
Local Group Memberships      *Administrators

However, if I try:

C:\>NET USER MYDOMAIN\SomeUser

or:

C:\>NET USER "MYDOMAIN\SomeUser"

I get the standard syntax help screen.

I can check this from the "Computer Management" MMC snap-in, but that takes too long to load and I'd like to quickly do this from the command line. If someone has a VBS script that'd be fine too.

Note: If anyone has better tags for this question, please feel free to add them!

Mike Christensen

Posted 2013-10-21T17:51:20.397

Reputation: 3 299

You do understand that a domain level permission would override any local permissions you might assign a local profile right? – Ramhound – 2013-10-21T17:57:32.723

@Ramhound Seems like he's concerned with domain users, not local users. He understands how to check a local account, but not how to check if a domain account is a local admin from the command line. – Tanner Faulkner – 2013-10-21T19:44:27.943

Correct. I was just looking for command line shortcuts for things I was already doing. – Mike Christensen – 2013-10-21T20:03:47.753

Answers

Try net localgroup administrators instead. If you'd like a PowerShell command to check a specific user, take a look at this blog post. I would hope however that there aren't so many local administrators that you can't spot the user in question.

Tanner Faulkner

Posted 2013-10-21T17:51:20.397

Reputation: 11 948

Exactly what I was looking for! Thank you sir. – Mike Christensen – 2013-10-21T17:57:50.247

Try

C:\>NET USER SomeUser /domain

instead of

C:\>NET USER MYDOMAIN\SomeUser

memory

Posted 2013-10-21T17:51:20.397

Reputation: 67

Since this question has already has an accepted answer you need to give more detail as to why your method is a more suitable option. – Matthew Williams – 2014-10-21T14:03:26.553

Try this command to get all information of the user. it's a powershell command.

GPRESULT -Z /USER [username]

Sohail

Posted 2013-10-21T17:51:20.397

Reputation: 111