Logins with local administrator access report - Defender for Endpoint

localadmins.kql

DeviceLogonEvents
| where Timestamp >= ago(30d)  // last month
| where IsLocalAdmin == 1 
// number of machines connected to by the account
| summarize count() by DeviceName, AccountName,LogonType // ,AdditionalFields
| sort by AccountName
// also see https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes/
// https://blog.alexmags.com/tags/kql/

Thanks Alex for this,
it worked for me and i was looking for just users with interactive login so i add this to the Query but did not work
| where LoginType == Interactive

Cloud you help with this please?

Hi Mo
Interactive is a string value so try put it in quotes.
Run the first few lines (before the sumarize command) to get the whole dataset.
Then make it look pretty with project, summarize, sort commands.
Line 3 could be
| where IsLocalAdmin == 1 and LoginType == 'Interactive'