Windows Server / Services, IIS & Secure Operations
Review local administrative membership without granting broad access
A support request can expose an unexpected local administrator or a missing approved group. Inspect membership before changing it.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
Get-LocalGroupMember -Group 'Administrators'Read the result
In an appropriate Windows PowerShell process, this lists local group members. The group name is localized and domain-controller account management differs.
Resolve and verify
Compare each principal with the approved server access design and managed policy. Investigate unresolved identities and request only the required delegated access.
Before changing production
Do not add application accounts to Administrators or remove recovery access without understanding management and rollback requirements.