windows 10 local users and groups missing

That’s a completely different role used for completely different purposes. They do not have the ability to manage devices objects in Azure Active Directory.ĭo not confuse Azure AD device administrators with the Cloud Device Administrator RBAC role. Users with this role become local machine administrators on all Windows 10 devices that are joined to Azure Active Directory.

Those are all fairly self-explanatory, but what’s this Azure AD device administrator? This role is available for assignment only as an additional local administrator in the Azure AD Device settings. The initial user of the device before it is joined to Azure AD will be present as well if you didn’t join Azure AD as part of the OOBE experience. The account that joins the device to Azure AD.By default, these accounts will be present in the local Administrators group for Azure AD joined devices: Who’s an admin by default?īefore we start updating local administrator accounts on managed devices, it might help to understand who is supposed to be there in the first place. With that scenario in mind, let’s see how we can manage the local Administrator group membership for Azure AD joined Windows 10 devices. OK, that’s fine for end users, but what if you need elevated permissions to do your job? For example, help desk administrators will generally need admin rights on managed Windows 10 devices to do what needs to be done when responding to requests for assistance from our non-admin end users. I don’t think anyone would take exception to me saying that it’s important to manage who is in the local Administrators group on Windows 10 devices, but what does that mean? According to the principle of least-privilege, it means that you should ensure users are logging on with a user account that has the absolute minimum permissions necessary to complete the current task and nothing more.

Windows 10 local users and groups missing