I can not find documentation on how to use ARM to create local accounts but I see some posts suggesting it is possible. How is this done?
I tried creating my own script to accomplish this without ARM but with powershell script block auditing turned on, the password shows up cleartext in the remote computer logs.
$Password = ConvertTo-SecureString -String "password" -AsPlainText -Force
$ScriptBlock = {
$Name = "notadmin"
$Description = "Local SysAdmin Account"
New-LocalUser -Name $Name -FullName $Name -Description $Description -Password $Password -AccountNeverExpires:$True -PasswordNeverExpires:$True -Disabled:$False -Confirm:$False
Add-LocalGroupMember -Group "Administrators" -Member "notadmin" -Confirm:$False
}
$OULocation = "OU=test,DC=ARM"
$Servers = Get-ADComputer -Filter * -SearchBase $OULocation
ForEach ($Server in $Servers)
{
$Server.Name
Invoke-Command -ComputerName $Server.Name -ScriptBlock $ScriptBlock
}