• Find all machines on the current domain where the current user has local admin access

Find-LocalAdminAccess –Verbose

• This function queries the DC of the current or provided domain for a list of computers (GetNetComputer) and then use multi-threaded Invoke-CheckLocalAdminAccess on each machine.

• This can also be done with the help of remote administration tools like WMI and PowerShell remoting. Pretty useful in cases ports (RPC and SMB) used by Find-LocalAdminAccess are blocked.

• See Find-WMILocalAdminAccess.ps1 and Find-PSRemotingLocalAdminAccess.ps1

• Find local admin access on the current domain by using powerview.ps1

Find-LocalAdminAccess

• Find local admin access on the current domain by using Find-WMILocalAdminAccess.ps1

Find-WMILocalAdminAccess

• Find computers where a domain admin (or specified user/group) has sessions

Find-DomainUserLocation -Verbose

Find-DomainUserLocation -UserGroupIdentity "<Group Name>"