Demote all admin users to standard users, excluding a specified exempt local admin user

demoteUsers.sh

#!/bin/bash

localAccts=$(dscl . list /Users UniqueID | awk '$2>500{print $1}' | grep -v <exempt username>)

while read account; do
    echo "Making sure $account is not an admin"
    dseditgroup -o edit -d $account admin
done < <(echo "$localAccts")

exit 0