Temporary Admin Access with PowerShell

Every IT administrator has faced the challenge of granting users temporary administrator rights. This might be necessary for instances when users are traveling and may need to install software or troubleshoot issues on their company computers. While this can be a necessity, it’s also a potential security risk. The trick is to provide admin rights in a controlled and temporary manner.

In this blog post, we’ll walk you through a PowerShell script that accomplishes exactly that. This script grants a user administrator access for a specified number of days and then automatically revokes the access when the time period expires.

Why I Would Implement This Differently in 2026

My original script added the well-known INTERACTIVE identity. That identity represents interactive logons generally, not the one person I meant to help. It also assembled commands as text for Invoke-Expression. I now pass an explicit account through PowerShell remoting and call the local-account cmdlets directly. Microsoft well-known SID documentation

Temporary local admin is privilege expansion. I use a named account, the shortest practical duration, and verify the removal task before considering the job complete.

This version requires PowerShell remoting and administrator access to the target. It does not require PsExec.

The Script

param(
    [Parameter(Mandatory)] [string] $ComputerName,
    [Parameter(Mandatory)] [ValidatePattern('^[A-Za-z0-9_.-]+$')] [string] $User,
    [Parameter(Mandatory)] [ValidateRange(1, 30)] [int] $Days
)

Invoke-Command -ComputerName $ComputerName -ArgumentList $User, $Days -ScriptBlock {
    param($User, $Days)

    $account = Get-LocalUser -Name $User -ErrorAction Stop
    $existingMember = Get-LocalGroupMember -Group 'Administrators' |
        Where-Object SID -EQ $account.SID
    if ($existingMember) {
        throw "$User is already an administrator; refusing to schedule its removal as temporary access."
    }

    $expires = (Get-Date).AddDays($Days)
    $taskName = "Remove temporary admin - $User"
    $sid = $account.SID.Value
    $removeCommand = "Remove-LocalGroupMember -Group 'Administrators' -Member '$sid'; " +
        "Unregister-ScheduledTask -TaskName '$taskName' -Confirm:`$false"

    $added = $false
    try {
        Add-LocalGroupMember -Group 'Administrators' -Member $account -ErrorAction Stop
        $added = $true
        $action = New-ScheduledTaskAction -Execute 'powershell.exe' `
            -Argument "-NoProfile -NonInteractive -Command `"$removeCommand`""
        $trigger = New-ScheduledTaskTrigger -Once -At $expires
        $settings = New-ScheduledTaskSettingsSet -StartWhenAvailable
        $principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' `
            -LogonType ServiceAccount -RunLevel Highest

        Register-ScheduledTask -TaskName $taskName -Action $action `
            -Trigger $trigger -Settings $settings -Principal $principal -Force -ErrorAction Stop
    }
    catch {
        if ($added) {
            Remove-LocalGroupMember -Group 'Administrators' -Member $account -ErrorAction SilentlyContinue
        }
        throw
    }

    Get-LocalGroupMember -Group 'Administrators' | Where-Object Name -Like "*$User"
    Get-ScheduledTask -TaskName $taskName
}

StartWhenAvailable runs the removal after a missed start, for example when the laptop was off at expiry. The task removes only the selected member and then removes itself. Scheduled-task settings and local-group cmdlets

Wrapping Up

This script simplifies the process of providing users with temporary administrative rights on their company computers. It allows IT administrators to safely give users the access they need while ensuring that this access is revoked automatically after a specific period.

As always, it’s important to remember that even temporary administrative rights can be a significant security risk if misused. Therefore, only grant such access to users you trust, and monitor the system during the period they have this access.