Create AD Auditable Local Admins

Create-ADAuditable-LocalAdmins.ps1

break # To prevent accidental example script execution
Import-Module ActiveDirectory

# Create all groups for serverset1
$FirstServerSet = Get-Content "serverset1.txt"
$FirstOU = "OU=Loc1,OU=Groups,DC=contoso,DC=com"
foreach ($Server in $FirstServerSet) {
  New-ADGroup "$Server.AdminGroup" -Path $FirstOU -GroupScope Global
}

# Create all groups for serverset2
$SecondServerSet = Get-Content "serverset2.txt"
$SecondOU = "OU=Loc2,OU=Groups,DC=contoso,DC=com"
foreach ($Server in $SecondServerSet) {
  New-ADGroup "$Server.AdminGroup" -Path $SecondOU -GroupScope Global
}

# Add members to all groups, and all groups to appropriate servers
$AllServers = $FirstServerSet
$AllServers += $SecondServerSet
$Members = "serviceaccount1","serviceaccount2"
foreach ($Server in $AllServers) {
  Add-ADGroupMember -Identity "$Server.AdminGroup" -Members $Members
  Invoke-Command -ComputerName $Server -ScriptBlock {
    $LocalAdmin = [ADSI]"WinNT://$($ENV:ComputerName)/Administrators,group" 
    $LocalAdmin.psbase.Invoke("Add",([ADSI]"WinNT://CONTOSO/$($ENV:ComputerName).AdminGroup").path)
  }
}