How to Export a List of Users With Administrator Access on Devices in JumpCloud

Overview

Local administrator rights are one of the most useful things to audit and one of the harder things to see at a glance in the JumpCloud admin console. Bindings are visible per device or per user, but there is no built-in view that answers the question auditors and security teams actually ask: which users currently hold administrator access on a managed device, across the whole fleet?

The JumpCloud PowerShell module answers it in a single command. This guide covers installing the module on Windows and macOS, authenticating with an API key, and exporting the results to CSV.

Who this is for: IT administrators, security engineers, and compliance teams performing local admin audits, access reviews, or privilege reduction exercises across a JumpCloud-managed estate.

Prerequisites

• JumpCloud administrator account

• A JumpCloud API key with permission to read systems and system users

• PowerShell — pre-installed on Windows; installed separately on macOS (covered in Step 1)

• Local administrator rights on the machine running PowerShell, for module installation

Security note: The JumpCloud API key authenticates as your administrator identity. Store it in a secrets manager or password manager rather than a script, a shared drive, or a ticket comment. Anyone holding it can read your directory.

Step 1: Install the JumpCloud PowerShell Module

On Windows

1. Open PowerShell as Administrator

2. Set the execution policy to allow signed remote modules:

powershell

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned

3. Install the module:

powershell

Install-Module JumpCloud

On macOS

1. Download and install PowerShell for macOS — the version matching your device architecture

2. Open PowerShell and install the module:

powershell

Install-Module JumpCloud

Note: PowerShell is not included with macOS and must be installed before the module. Apple Silicon and Intel machines require different builds.

If you get stuck at either stage, refer to the JumpCloud PowerShell module documentation, or contact support@netnxt.com.

Step 2: Connect PowerShell to JumpCloud

1. Open PowerShell as Administrator

2. Authenticate:

powershell

Connect-JCOnline

3. Provide your API key when prompted

A successful connection confirms the organisation you are authenticated against. In multi-tenant or MSP contexts, verify this is the correct tenant before running the export.

Step 3: Run the Export

powershell

Get-JCSystem | Get-JCSystemUser | Where-Object Administrator -eq $true | Export-Csv AdminDevices.csv

What each stage does:

The file is written to whatever directory PowerShell is currently in. Run Get-Location first if you need to confirm where it will land.

Validation: Expected Output

AdminDevices.csv should contain one row per user–device binding where administrator access is granted, with columns including:

Two things to expect in the raw file, both normal PowerShell behaviour rather than errors:

• The first line reads #TYPE System.Management.Automation.PSCustomObject. This is a type header Export-Csv writes by default. It shifts your column headers down a row in Excel and Google Sheets.

• BindGroups displays as System.Object[]. The column holds an array, and CSV export renders it as the object type rather than its contents.

Both are addressed in Troubleshooting below.

Common Issues and Troubleshooting

CSV opens with a #TYPE line above the headers

Export-Csv writes a type header by default. Suppress it with -NoTypeInformation:

powershell

Get-JCSystem | Get-JCSystemUser | Where-Object Administrator -eq $true | Export-Csv AdminDevices.csv -NoTypeInformation

This matters if the CSV feeds a reporting pipeline or import process — the stray first line breaks header detection.

BindGroups column shows System.Object[] instead of group names

The property is an array, which Export-Csv cannot flatten on its own. Expand it before export:

powershell

Get-JCSystem | Get-JCSystemUser | Where-Object Administrator -eq $true |
    Select-Object DisplayName, HostName, SystemID, Username, Administrator, DirectBind,
        @{Name='BindGroups';Expression={$_.BindGroups -join '; '}} |
    Export-Csv AdminDevices.csv -NoTypeInformation

This is worth doing for an access review, where knowing why someone holds admin rights — direct grant versus group inheritance — is usually the point of the exercise.

Install-Module fails on Windows

Confirm the execution policy was applied and that PowerShell was opened as Administrator. If the machine is behind a proxy or the PowerShell Gallery is unreachable, the install will fail at the repository stage rather than the module stage.

Connect-JCOnline rejects the API key

Regenerate the key in the JumpCloud admin console and retry. Keys are tied to the administrator account that created them — a key from a deactivated or permission-reduced admin will fail.

Export runs but returns no rows

Either no administrator bindings exist, or the authenticated API key lacks read permission on systems or system users. Run Get-JCSystem alone to confirm systems are returned before assuming the filter is at fault.

Export is slow on a large fleet

Get-JCSystemUser is called once per system, so runtime scales with device count. This is expected. On large estates, run it outside working hours rather than interrupting it partway.

Security and Operational Considerations

Treat the output as sensitive. AdminDevices.csv is a map of privileged access across your estate — precisely what an attacker performing reconnaissance would want. Store it with the same controls you would apply to a privileged access review, and delete working copies when the review is complete.

Rotate or revoke the API key when finished. If the key was generated specifically for this audit, remove it afterwards rather than leaving a long-lived credential in place.

Use the output to reduce standing privilege, not just to document it. The DirectBind and BindGroups columns tell you whether admin rights were deliberately granted or inherited by group membership. Inherited administrator access that nobody consciously assigned is the most common finding in this kind of audit and the easiest to remediate.

Re-run it on a schedule. A one-off export answers today's audit question. Running it monthly and diffing the results turns it into a detection control for unexpected privilege grants.

Auditing local admin rights across a JumpCloud fleet, or planning a privilege reduction exercise? Talk to NetNXT →

FAQs

1) How do I export a list of JumpCloud users with admin access on their devices?

Install the JumpCloud PowerShell module, authenticate with Connect-JCOnline, then run Get-JCSystem | Get-JCSystemUser | Where-Object Administrator -eq $true | Export-Csv AdminDevices.csv.

2) How do I install the JumpCloud PowerShell module?

On Windows, run Set-ExecutionPolicy -ExecutionPolicy RemoteSigned followed by Install-Module JumpCloud in an elevated PowerShell session. On macOS, install PowerShell first, then run Install-Module JumpCloud.

3) Why does my JumpCloud CSV export start with a #TYPE line?

Export-Csv writes a type header by default, which shifts column headers down a row. Add -NoTypeInformation to the command to suppress it.

4) Why does the BindGroups column show System.Object[]?

The property is an array and CSV export cannot flatten it automatically. Use Select-Object with a calculated property joining the values — for example $_.BindGroups -join '; '.

5) Can I see JumpCloud device administrator access without PowerShell?

The admin console shows bindings per device or per user, but has no fleet-wide administrator view. The PowerShell module is the practical route to a complete exportable list.