Check administrator accounts
fleet__audit_admin_usersThe administrator accounts of each chosen site (user_id, display name, roles, registered_at in UTC, extra_caps, and new: registered in the last 7 days; Royal MCP leaves out usernames and email addresses), users_with_extra_caps (users holding capabilities granted directly beyond their role, with roles, capabilities, registration date and powerful: the capabilities amount to administrator access for a user who is not an administrator), extra_caps_checked (all_users where the site offers Royal MCP's security check, administrators where it does not, not_reported on an older Royal MCP), flags (one sentence per new administrator or user with extra capabilities, most serious first), and where GuardPress is active, the account changes it logged recently (new or deleted users, role changes, email and two-factor changes, emergency unlocks) and the latest sign-in. Optional site_ids (default every connected site). Sites without GuardPress say account changes were not checked. Read only; it raises no alerts itself. Royally also checks the accounts of every connected site with Royal MCP every hour, with or without a security plugin, and raises an alert for a new administrator, which stays open after the account's first 7 days until a person acknowledges, resolves or dismisses it or the account is removed or is no longer an administrator (the 7 days only decide which accounts are flagged as new), and for extra capabilities, which closes once they are gone; these come from the security sweep (source royally_security_sweep) on sites whose security plugin it reads and from the account check (source royally_account_check) on the others, never both. Use it to spot an administrator nobody recognises, a recent role change or a hidden administrator.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| site_ids | No | Restrict to these site ids. Omit for every eligible site. |