Request : User device Affinity to validate admin rights

[floppy69]

Hi, hope you're good,

can we use sccm user device affinity to allow only primary user to add admin rights ?

regard and thanks in advance

[pseymour]

You can find the top console user via WMI, at ROOT\CIMV2\sms. The class name is SMS_SystemConsoleUsage. I'm not sure that always corresponds to the primary user set via affinity in the ConfigMgr database, but I think most people would assume it's the same user.

[joegasper]

We use the following in an SCCM Configuration Item/Baseline to enable the top user for RDP access - easy to adapt.

(Get-CimInstance -Namespace root\cimv2\sms -ClassName SMS_SystemConsoleUsage).TopConsoleUser | Add-LocalGroupMember -Group "Remote Desktop Users"

[pseymour]

There you go 👆🏻

There is a branch in the code for this, but I could never get testers to confirm.

[floppy69]

Thanks for all your answers. In fact i already use a script that fetch from cmdb primary user of computers and add it in sccm.

based on you replies, i'll create a baseline that create localgroup member of sccm primary user.

Thanks