# Registering user should not be added as local administrator on the device during Microsoft Entra join

The 'Registering user is added as local administrator on the device during Microsoft Entra join' setting determines if the registering user is added to…

Source: https://maester.dev/docs/tests/MT.1091

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/nicolonsky" title="Nicola Suter · Original author"><img src="https://github.com/nicolonsky.png" alt="Nicola Suter" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/nicolonsky">Nicola Suter</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Device identity · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1091
```

## Overview

The 'Registering user is added as local administrator on the device during Microsoft Entra join' setting determines if the registering user is added to the local administrators group. This setting applies only once during the actual registration of the device as Microsoft Entra join.

#### Remediation action

Within the [Entra Portal - Device Settings](https://entra.microsoft.com/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/DeviceSettings/menuId/Overview) set _'Registering user is added as local administrator on the device during Microsoft Entra join'_ to *None*.
This one setting is the fix for this test. It applies to devices joined from then on. Devices that were joined earlier keep the users who are already local administrators; to remove them, you can use an Intune account protection policy that manages the built-in Administrators group (see the links below).

#### Related links

* [Intune - Manage local groups on Windows devices](https://learn.microsoft.com/intune/intune-service/protect/endpoint-security-account-protection-policy#manage-local-groups-on-windows-devices)
* [Microsoft Learn - Device Settings](https://learn.microsoft.com/entra/identity/devices/manage-device-identities#configure-device-settings)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1091 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Device identity |
| Area | Privileged access |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-6 |
| PowerShell test | [Test-MtDeviceRegistrationLocalAdminsRegisteringUser](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1091.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1091.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1091.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1091.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1091.md)