List Macs with local users that have admin privelages when every Mac has a hidden admin account

Here is how I've done it:

Settings>Computer Management>Extension Attributes

Display Name:
Local Admin Check

Description:
This Extension Attribute lists local administrators of the computer

Data Type:
String

Inventory Display:
Extension Attributes

Input Type:
Script

#!/bin/bash

####################
### March 9, 2020
### This Extension Attribute will list accounts with admin rights
### This Extension Attribute is used with a saved search to output list of mobile admin accounts
### for more information visit https://www.jamf.com/jamf-nation/feature-requests/2065/smart-group-for-local-users-marked-as-admin
####################

allLocalAccts=$(dscl . list /Users UniqueID | awk '$2>500 {print $1}')

while read userAcct; do
    if [[ $(dseditgroup -o checkmember -m $userAcct admin) =~ "yes" ]]; then
        Admin="Admin"
    else
        Admin="Regular"
    fi

    if [[ $(dscl . read /Users/$userAcct OriginalAuthenticationAuthority 2>/dev/null) != "" ]]; then
        Domain="Domain"
    else
        Domain="Local"
    fi

    userList+=("${userAcct}:   $Admin, $Domain")

done < <(echo "$allLocalAccts")

echo "<result>$(printf '%s
' "${userList[@]}")</result>"

I have a small number of devices and deal with them individually (total 12)
Perhaps you can use this as a new starting point?

@atomczynski I will give this a shot. To add some more info the hidden user account is named 'Admin' so I'm wondering will this attribute ignore that account?

I have a saved search with the following:
Criteria: Local Admin Check
Operator: like
Value: Admin, Domain

@atomczynski thank you for the input. I setup an extension attribute using the script you provided and I created a smart group, however i'm getting zero results. All user accounts are currently local (both the hidden admin, and the end user's account). The UIDs are generall admin = 501 and the user's account = 502, 503, etc.

What is your time window for check in and update inventory?

One suggestion would be on a computer you have access to create a mobile account with admin rights or change current mobile account so it has rights, then recon and policy and check the device object again.

hi @atomczynski I was tried in my machine getting result fine but where I'm putting to JAMF as Extension Attribute getting empty result is there any i need to do any missup.