Cubert has created another simple auditing script for Kaseya Agent procedures. This script grabs all the users and groups in the Local Administrators Group of any Windows system and saves then to a file on the Kserver. Every time the script runs it will upload and compare the files for differences. If it finds that a user or group was added or removed it will alert the Kserver. If you have a GetFile Alarm rule setup in the Monitor Menu -> Alerts -> GetFile to create a ticket or email you then you will receive an alert anytime the script is run and changes are seen.
Download and unzip the XML file and import it in to Kaseya Agent Procedures. There is no scripts or extra files needed with this guy so you only need the XML file inside the zip.
Download here -> Procedure-LocalAdminAudit