Is there a policy that prevents admins from removing admin accounts from a Mac?

Thank you for this. We do have a separate local admin account, this was the account I was actually referring to. How can I use Casper to give the local admins account rights back?

You can run the command:

/usr/sbin/dseditgroup -o edit -a localadminname -t user admin

If you create a policy, in the Files and Processes payload, add it to the "Execute Command" section at the bottom.

You could go a step further, create an extension attribute that picks up if the user is an admin or not:

#!/bin/sh

adminCheck=$(/usr/sbin/dseditgroup -o checkmember -m localadminname admin)

echo "<result>$checkAdmin</result>"

exit 0

Then create a smart group that checks for "yes localadminname is a member of admin", targeting the policy to the group on an ongoing basis.

How about just hide the local admin account from users &groups... You can also move the hidden admin's home directory to a place not visible from Finder.. I currently created a policy and running it, to hide the admin account, and it's working like a charm..

The only time the user will know an admin account is on there, is at the login window..

You can go here to get the commands to hide the admin account, and create a script from it..

Thanks everyone. I should be good with your suggestions!