Cubert has created another simple auditing script for Kaseya Agent procedures. This script grabs all the users and groups in the Local Administrators Group of any Windows system and saves then to a file on the Kserver. Every time the script runs it will upload and compare the files for differences. If it finds that a user or group was added or removed it will alert the Kserver. If you have a GetFile Alarm rule setup in the Monitor Menu -> Alerts -> GetFile to create a ticket or email you then you will receive an alert anytime the script is run and changes are seen.
Download and unzip the XML file and import it in to Kaseya Agent Procedures. There is no scripts or extra files needed with this guy so you only need the XML file inside the zip.
Download here -> Procedure-LocalAdminAudit
Enjoy
Cubert 😎
A simple and elagant solution. Worked flawlessly. Would like to see some suggestions from others as to how to include the server name in the info collected as for the initial audit I could see us loosing track of which TXT file came from which server.