Here's a script to create a report of all local administrators on your domain. It gets the computer names from AD and sends a ping to each computer, and if it gets a reply it will interrogate the local administrators group using WMI to get the list of members. The Domain Admins group is ignored. Run at a sensible time when most computers will be turned on.
Edit the SMTP server and strSender values to something appropriate. Also edit line 37 with the name of your domain. You will need to create the folder C:\scripts for this to work, or edit line 8 with a new location for the csv file.
The outputted file is a bit messy, but gets the job done.
SMTPServer = "mail.yourdomain.corp"
strSender = "name@yourdomain.corp"
strRecipient = InputBox("Enter the email address for report or" & vbcrlf & "press cancel to just generate a local file.", "Input required")
Const ForAppending = 8
Set WshNetwork = WScript.CreateObject("WScript.Network")
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set WshShell = CreateObject("WScript.Shell")
strFileName = "C:\scripts\LocalAdminsReport.csv"
If objFSO.FileExists(strFileName) Then
objFSO.DeleteFile(strFileName)
End If
Set objFile = objFSO.OpenTextFile(strFileName, ForAppending, True)
objFile.WriteLine "ComputerName,Administrators"
GetLocalAdmins
msgbox Counter & " computers were counted." & vbcrlf & "See " & strFileName & " for details."
If strRecipient = False then
'user didn't enter an email address
wscript.quit
Else
SendEmail
End If
Private Function GetLocalAdmins
Const ADS_SCOPE_SUBTREE = 2
Set objConnection = CreateObject("ADODB.Connection")
Set objCommand = CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objCOmmand.ActiveConnection = objConnection
objCommand.CommandText = "Select Name from 'LDAP://DC=yourdomain,DC=corp' " & "Where objectClass='computer'"
objCommand.Properties("Page Size") = 1000
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE
Set objRecordSet = objCommand.Execute
objRecordSet.MoveFirst
Do Until objRecordSet.EOF
name = objRecordSet.Fields("Name").Value
PINGFlag = Not CBool(WshShell.run("ping -w 500 -n 1 " & name,0,True))
If PINGFlag = False Then
objFile.WriteLine name & ",Did Not Ping"
Else
'Get the local administrators
Set objGroup = GetObject("WinNT://" & name & "/Administrators,group")
For Each objMember In objGroup.Members
If objMember.Name <> "Administrator" and objMember.Name <> "Domain Admins" Then
objFile.WriteLine name & "," & (objMember.Name)
End If
Next
End If
objRecordSet.MoveNext
Loop
End Function
Private Function SendEmail
Set objEmail = CreateObject("CDO.Message")
objEmail.From = strSender
objEmail.To = strRecipient
objEmail.Subject = "Local Admins Account"
objEmail.Textbody = Counter & " computers were counted. See attached log file for details."
objEmail.AddAttachment(strFileName)
objEmail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
objEmail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpserver") = SMTPServer
objEmail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
objEmail.Configuration.Fields.Update
objEmail.Send
End Function

