AdminDrift
Monitor local Windows administrator membership and get notified when privileged access changes.
This is currently a concept, not downloadable software.
The proposal
The problem
A familiar source of friction.
Direct membership of the local Windows Administrators group can change without you noticing. Checking the group by hand makes it difficult to spot new privileged members and follow changes over time.
The proposed solution
A focused way forward.
Know when local administrator access changes on your Windows PC. AdminDrift is a proposed lightweight, local-first utility that would baseline direct local Administrators membership and compare actual membership snapshots to detect additions, removals, re-additions and name/SID resolution changes. Members would be classified as Approved, Unexpected or Unknown / unresolved. You could approve an expected member, receive Windows notifications on new state transitions and keep local history without repeat alerts for unchanged state. For domain or Entra identities, it would show the name Windows can resolve, otherwise the SID; it would not require a directory, recursively expand nested groups or reveal every effective privilege path. Optional Security Event Log context, such as events 4732 / 4733 when available, could enrich history. Snapshot monitoring would remain useful without those events; actor attribution and root cause would remain unknown when evidence is unavailable. This is monitoring and awareness, not automatic security remediation: it would not change group membership, remove users, disable accounts, detect malware or prove a change malicious. The ConceptForge video visualizes a fully local synthetic scenario, not shipping functionality: DemoUser is added and removed externally, while AdminDrift observes the changes and the return to two approved administrators and no unexpected members.
Concept capabilities
What this idea could help with.
- Monitor direct membership of the local Windows Administrators group
- Baseline members and detect additions, removals and re-additions
- Receive Windows alerts on new privileged-access state transitions
- Approve expected members and highlight unexpected or unresolved identities
- Show account SIDs when Windows cannot resolve friendly names
- Keep local change history with optional Windows audit-event context
Help shape what comes next
Would you use this app?
This is not a purchase or pre-order. It simply tells Fixletto that you would like to see this concept built.
Loading interest…
Availability
Not commercially available
A release has not been announced.