Add Signed-In User to Local Admin via PowerShell & Intune

ℹ️

Use case: Instead of targeting a specific user or group, this script dynamically detects whoever is currently signed in and elevates them to local admin. Useful for shared devices, field technicians, or scenarios where the user varies per machine.

Contents

Step 1 — Understand the script
Step 2 — Save the script as a .ps1 file
Step 3 — Deploy via Intune
Step 4 — Sync the policy to the device
Step 5 — Verify on the local system

Step 1

Understand the Script

Before deploying, it helps to understand what the script actually does. There are three key actions:

→

Detects the signed-in user's UPN

whoami /upn returns the Azure AD User Principal Name of whoever is currently logged in — for example john.doe@company.com. This means the script works for any user without any hardcoding.

→

Builds the AzureAD identity string

Windows identifies Azure AD accounts locally as AzureAD\UPN, so the script constructs that string — e.g. AzureAD\john.doe@company.com — which is what net localgroup expects.

→

Adds them to the local Administrators group

Runs net localgroup administrators to add the user. Handles three outcomes cleanly: success, already a member (no error), or failure — with a clear message for each.

Here is the full script:

# Get the Azure AD UPN of the logged-in user
$UPN = (whoami /upn).Trim()

# Build the AzureAD identity string
$AzureADUser = "AzureAD\$UPN"
Write-Host "Detected AzureAD User: $AzureADUser"

# Add to local Administrators group
$Result = net localgroup administrators "$AzureADUser" /add 2>&1

if ($LASTEXITCODE -eq 0) {
    Write-Host "SUCCESS: '$AzureADUser' added to Administrators group." -ForegroundColor Green
} elseif ($Result -match "already a member") {
    Write-Host "INFO: '$AzureADUser' is already in Administrators group." -ForegroundColor Yellow
} else {
    Write-Host "ERROR: Failed to add '$AzureADUser'. Details: $Result" -ForegroundColor Red
}

⚠️

Important: The script must run in the context of the logged-on user (not SYSTEM) so that whoami /upn returns the correct Azure AD UPN. Make sure this is set correctly in Intune — covered in Step 3.

Step 2

Save the Script as a .ps1 File

Copy the script above into a plain text editor (Notepad, VS Code) and save it with a .ps1 extension.

→

Suggested filename

Add-SignedInUser-LocalAdmin.ps1

→

Encoding

Save as UTF-8. In Notepad: File → Save As → Encoding: UTF-8. In VS Code it shows in the bottom-right status bar.

Step 3

Deploy via Intune

Upload the script to Intune and configure the correct execution settings.

3.1

Open Platform Scripts

Sign in to endpoint.microsoft.com → Devices → Scripts and remediations → Platform scripts → click + Add → Windows 10 and later.

3.2

Basics Tab

Name: Add SignedIn User to Local Admin
Description: Detects the Azure AD signed-in user and adds them to the local Administrators group.
Click Next.

3.3

Script Settings — upload and configure

Click Select file and upload your Add-SignedInUser-LocalAdmin.ps1 file, then set the following:

Setting	Value
Run this script using the logged on credentials	Yes ✅
Enforce script signature check	No
Run script in 64-bit PowerShell host	Yes ✅

ℹ️

Run using logged on credentials must be Yes — this is the critical setting. If left as No (SYSTEM context), whoami /upn will not return a valid Azure AD UPN and the script will fail.

3.4

Scope Tags

Skip or add scope tags as needed. Click Next.

3.5

Assignments

Assign to the device group or user group containing your target machines. Pilot with one device or a small group first before a broad rollout. Click Next.

3.6

Review + Add

Review the summary and click Add. The script is now deployed and will run at the next device check-in.

Step 4

Sync the Policy to the Device

Trigger a manual sync on the target device to speed up script delivery rather than waiting for the standard check-in cycle.

→

Option A — Settings app

Settings → Accounts → Access work or school → click the account → Info → Sync

→

Option B — PowerShell (run as admin)

Forces the Intune Management Extension to check in immediately:

Get-ScheduledTask | Where-Object {$_.TaskName -like "*PushLaunch*"} | Start-ScheduledTask

→

Option C — Restart the device

A reboot triggers Intune check-in automatically. Simplest option if you're not in a hurry.

After sync, check the script execution log to confirm it ran:

# IME agent execution log — check for your script name and result
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\AgentExecutor.log

Step 5

Verify on the Local System

Confirm the signed-in user has been successfully added to the local Administrators group using any of these methods.

→

Method 1 — PowerShell (quickest)

Run this in a PowerShell window on the device. You should see the AzureAD\ account listed under Administrators:

Get-LocalGroupMember -Group "Administrators"

Expected output (the AzureAD account should appear):

ObjectClass Name                              PrincipalSource
----------- ----                              ---------------
User        AzureAD\john.doe@company.com      AzureAD
User        BUILTIN\Administrator             Local

→

Method 2 — Computer Management (GUI)

Press Start → search Computer Management → Local Users and Groups → Groups → double-click Administrators. The AzureAD user should appear in the members list.

→

Method 3 — Command Prompt

Alternatively, run this in an elevated Command Prompt:

net localgroup administrators

💡

Not showing up? Check the IME log at C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\AgentExecutor.log — search for your script name. If the log shows the script ran as SYSTEM, go back to Step 3 and confirm Run using logged on credentials is set to Yes.

Add the Signed-In User to Local Admin via PowerShell & Intune