Create a local user account on Windows 10 with Microsoft Intune

After last weeks blog post about restricting which users can logon into a Windows 10 device, today another post about managing local users and local rights. In this post I show how we can create a local user account on a Windows 10 device with Microsoft Intune. Optional we can assign the local account Administrator rights.

Like in the previous post we need to use a Configuration Service Provider (CSP) policy and a Custom configuration profile to get the job done. This time we need to use the Accounts CSP.

All info we need can be found at the Microsoft docs here.

Configure the Custom Configuration profile

• Sign-in to the Endpoint Manager admin center
• Browse to Devices – Windows
• On the Configurations profiles tab click + Create profile

• Choose Windows 10 and later as Platform
• Choose Custom as Profile type
• Click Create

• Give the configuration profile a Name
• Enter a Description (optional)
• Click the Settings tab
• Click Add

A part of the OMA-URI contains the username for the local account we create: Users/{UserName}/LocalUserGroup
Replace UserName with the username of your choice. In my example I create a new user account with the username LocalUser.
The Data type is String.
As value we need to provide the password of the local user account.

In my example I create a local user account with the username LocalUser.

Enter below information to the policy;
Name: RestrictedGroups – ConfigureGroupMembership
OMA-URI: ./Device/Vendor/MSFT/Accounts/Users/LocalUser/Password
Data Type: String
Value: Your Password

Click OK.

Optional is the second Row we can add to assign the local user Administrator rights on the device. If this setting is not set, the user account will be a standard user account.

Click Add.

Enter below information to the policy if you want to assign Administrator rights;
Name: RestrictedGroups – ConfigureGroupMembership
OMA-URI: ./Device/Vendor/MSFT/Accounts/Users/LocalUser/LocalUserGroup
Data Type: Integer
Value: 2

Click OK (twice) and click Create.

Assign the profile to a security group and we`re ready to check the end result.

End result

When we check the local Users via Computer Management, we see a new local user account is created. In this example LocalUser.

And I have added a second row to assign the new local user account Administrator rights. The local user account is member of the local Administrators group.

NB: If you want to sign-in with a local account into a Windows 10 Azure AD joined device, as with a AD joined device, put “.\” before the username.

That`s it for this post, thank you for reading!

NB: In the Endpoint Manager admin center, the policy shows an Error state even if the policy is applied successful.