Powershell script help

[maxrebo]

Hi,

I need to run a PS Script to find which computers on our Domain have a local account (for example called, "Test") on them.

 

Long story.....when I deployed W11 in the Summer I left a local account on there

 

Could any one help me write one?

 

Regards

[6Foot3]

Is this with intune?

[Olliedawg]

Someone with more powershell knowledge could write something much more fancy.. but this will work, if the account doesn't exist it will return no result.

 

get-localuser | where-object {$_.name -like "*test*"}

 

[mbedford]

Simple enough to achieve on the local machine.  How you get that data back to you in a useful form is a little more complex.

$searchAccountName = "test"
$searchResults = Get-LocalUser | where {$_.Name -like $searchAccountName}

if ($searchResults){
	[pscustomobject]@{
    	Name = $searchResults.Name
    	PCName = $env:computername
	}
}

 

 

 

 

This will list any users that have user display names like "test" (case insensitive) and also the hostname of the machine the script was ran on

 

Personally I would run this as a shutdown script for the next machine reboot, add a bit of code to write the output to a SQL table, or depending on how many results you are expecting, an email ?

 

Hope this helps.

Edited November 14, 2025 by mbedford

[machy]

$Computers = Get-ADComputer -SearchBase "OU=School,DC=domain,DC=uk" -filter * | select -ExpandProperty Name
$User = "Test"

foreach ($Computer in $Computers){
    Invoke-Command -ComputerName $Computer -ScriptBlock {
        if (Get-LocalUser $User -ErrorAction SilentlyContinue){
            Write-host $env:COMPUTERNAME "Has account" (get-localuser $User)
        }else {
            write-host $env:COMPUTERNAME "Does not have account"
        }
    }
}

If you have PS Remoting Turned on this should be able to do it based on OU

Adjust line 2 to your account and the search base to the OU You want to scan 

 

 

Edit:

A note for others "get-localuser" has a username pass through as one of its arguments, so if you know exactly what the username is you can pass it through to the command, and not have to faff about messing with the output. "get account x vs get all accounts and filter by x" 

Edited November 14, 2025 by machy

[maxrebo]

Thanks all!.

@machy Can I run this from my PC and output all result from all devices in a OU, to a CSV?

 

Regards

[maxrebo]

Just a quick basic question on PS, when you execute the script, it seems to run (doesnt throw up an error) but sits there with a flashing white cursor.

Does this mean its running (but taking a while to pull the information in) ?

[dmj]

1 hour ago, machy said:

$Computers = Get-ADComputer -SearchBase "OU=School,DC=domain,DC=uk" -filter * | select -ExpandProperty Name
$User = "Test"

foreach ($Computer in $Computers){
    Invoke-Command -ComputerName $Computer -ScriptBlock {
        if (Get-LocalUser $User -ErrorAction SilentlyContinue){
            Write-host $env:COMPUTERNAME "Has account" (get-localuser $User)
        }else {
            write-host $env:COMPUTERNAME "Does not have account"
        }
    }
}

If you have PS Remoting Turned on this should be able to do it based on OU

Adjust line 2 to your account and the search base to the OU You want to scan 

 

 

Edit:

A note for others "get-localuser" has a username pass through as one of its arguments, so if you know exactly what the username is you can pass it through to the command, and not have to faff about messing with the output. "get account x vs get all accounts and filter by x" 

 

I don't do much (any) powershell these days as we're a python shop, but I don't think $User can be used inside a scriptblock like this. This will always be null AFAICT. I think you need $using:User for this 

        if (Get-LocalUser $using:User -ErrorAction SilentlyContinue){

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/invoke-command?view=powershell-7.5#example-9-include-local-variables-in-a-command-run-on-a-remote-computer

 

God I hate Powershell

[machy]

6 minutes ago, dmj said:

 

I don't do much (any) powershell these days as we're a python shop, but I don't think $User can be used inside a scriptblock like this. This will always be null AFAICT. I think you need $using:User for this 

        if (Get-LocalUser $using:User -ErrorAction SilentlyContinue){

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/invoke-command?view=powershell-7.5#example-9-include-local-variables-in-a-command-run-on-a-remote-computer

 

God I hate Powershell

Whoops yup, my bad, remote ps doesn't work here so i forgot that bit

 

i need to not PS when i am hungry 

 

 

25 minutes ago, maxrebo said:

Thanks all!.

@machy Can I run this from my PC and output all result from all devices in a OU, to a CSV?

 

Regards

i'd have to rewrite it to do that, but it should output in the terminal nicely if PS remoting is turned on in your site 

Edited November 14, 2025 by machy

[djm968]

This will export to a CSV file:

 

$Computers = Get-ADComputer -SearchBase "OU=School,DC=domain,DC=uk" -Filter * |
    Select-Object -ExpandProperty Name

$User = "Test"

$Results = foreach ($Computer in $Computers) {
    Invoke-Command -ComputerName $Computer -ScriptBlock {
        $acct = Get-LocalUser -Name $using:User -ErrorAction SilentlyContinue

        [PSCustomObject]@{
            ComputerName = $env:COMPUTERNAME
            UserName     = $using:User
            Exists       = if ($acct) { $true } else { $false }
        }
    }
}

$Results | Export-Csv -Path ".\LocalUserReport.csv" -NoTypeInformation

[Techyboy19]

Slightly different answer to the question but are you just wanting a list of the devices so you can go around and remove the user that was left behind. 

 

If so could a startup .bat script be an option to simply delete the user assuming you have another local admin account in that Machine. 

For example the script below deletes the specified local user and creates a flag file once completed. This could just run on all pcs as long as that local username isn’t needed anywhere for anything on any of them devices.  
 

@echo off

set FLAG=C:\ImageDeployAccountRemove.flag

REM Check if we've already run
if exist "%FLAG%" (
    echo ImageDeployAccountRemove already processed. Exiting.
    exit /b 0
)

REM Delete the local user account
net user test /delete

REM Create the flag file to prevent reruns
echo done > "%FLAG%"

exit /b 0

 

 

On line net user test /delete you would replace test with the username in question. 

I would then remove the policy once I’m happy that the account has left all the PCs it needs to

Edited November 14, 2025 by Techyboy19

[penfold]

On 14/11/2025 at 12:29, maxrebo said:

Hi,

I need to run a PS Script to find which computers on our Domain have a local account (for example called, "Test") on them.

 

Long story.....when I deployed W11 in the Summer I left a local account on there

 

Could any one help me write one?

 

Regards

Are you looking to get a list of the machines or you want to manage the local accounts?

 

In my last place we created a GPO with settings to remove all local accounts except the ones we specified. We found over time, people were being a little lazy and adding people to local admin group so we set a policy via GPP which removed everything and set a standard across the domain.

[chazzy2501]

you can create a GPP and have it delete the local accounts. I did this for a flub many years ago

 

 

[psydii]

On 14/11/2025 at 23:40, Techyboy19 said:

Slightly different answer to the question but are you just wanting a list of the devices so you can go around and remove the user that was left behind. 

 

If so could a startup .bat script be an option to simply delete the user assuming you have another local admin account in that Machine. 

For example the script below deletes the specified local user and creates a flag file once completed. This could just run on all pcs as long as that local username isn’t needed anywhere for anything on any of them devices.  
 

@echo off

set FLAG=C:\ImageDeployAccountRemove.flag

REM Check if we've already run
if exist "%FLAG%" (
    echo ImageDeployAccountRemove already processed. Exiting.
    exit /b 0
)

REM Delete the local user account
net user test /delete

REM Create the flag file to prevent reruns
echo done > "%FLAG%"

exit /b 0

 

 

On line net user test /delete you would replace test with the username in question. 

I would then remove the policy once I’m happy that the account has left all the PCs it needs to

That script is so backward compatible it would run on OS/2 LAN Manager v1.0!

Edited November 17, 2025 by psydii