Deploying a Local Admin Account to Multiple Targets

Hello, 

Thanks for this forum and your time.

I recently started using Intune to manage mobile devices for an organization.

I recently went to do some admin work on intuned laptops and found that I could not make administrative changes even with a domain admin account. 

I learned that the way our Intune is set up if I want to make admin changes on a device, I have to set the device to an admin device for admin users.

Then, when finished, set it back to a user device for standard users.

I'm new to Intune but this seems a bit convoluted, so my first thought was how can I make it possible to do admin work on an Intune device without needing to change those settings each time?

I decided the best way would be to use Intune to add local admin accounts on all the devices.

Researching this, I found there are two common ways to do this. 1. Add a Powershell script that will create a local admin account on the device/s of my choice. Though my Powershell script worked when I ran it on the local machine, it wouldn't work using Intune. Either it would deploy but no admin account was created on the target machine, or it just wouldn't deploy.

Because of this, I tried the other way of doing it which is Intune's LAPS (Local Administrator Password Solution).

But after setting this up, it would never enable to built-in admin account, nor could I find any system-generated password in Intune for that account.

In the end, I just want local admin accounts on all our surface pros deployed en masse.