List Local Service Admins Using Alternate Credentials

Question

We're trying to write a script that will query a single server for a list of local server admins but want to pass alternate credentails.  In other words, we want users who do not have admin rights to the server to be able to list local admins using
this script.
Any thought on how this would be accomplished?

Answer 1

Here's one way you could do it in PowerShell. You can pass it a credential object with which to connect to the remote machine.
#Get-LocalAdmin.ps1
#requires -version 2
param(
[String] $ComputerName,
[System.Management.Automation.PSCredential] $Credential
$args = @{
"Class" = "Win32_Group"
"Computer" = $ComputerName
"Filter" = "Domain='$ComputerName' and SID='S-1-5-32-544'"
if ( $Credential ) { $args.Add("Credential", $Credential) }
get-wmiobject @args | foreach-object {
$args = @{
"Computer" = $ComputerName
"Query" = "associators of {$($_.Path.Path)} where AssocClass=Win32_GroupUser ResultRole=PartComponent"
if ( $Credential ) { $args.Add("Credential", $Credential) }
get-wmiobject @args | foreach-object {
$_.Caption
Example usage:
PS C:\> $cred = get-credential
PS C:\> Get-LocalAdmin.ps1 servername -credential $cred
Bill