Re: How to determine if logged on user is an Administrator?

Would this work if the logged on user is not explicitly a member of the
local Administrators group? In my case, 99% of the time even though a
person may be an administrator, they aren't actually listed in the
Administrators group. The local administrators group contains the
following:
DOMAIN\Domain Admins
DOMAIN\Workstation Admins
Administrator

I'd like to be able to test to see if the logged on user has Administrative
rights on the machine, not if they are an explicit member of the
Administrators group. Most likely this'd be more of a test to see if the
logged on user is a member of the Workstation Admins domain group.

In the meantime, my workaround is to have a .txt file on the HD that is
readable only by Administrators. If the script can open the file, the user
is an Administrator in name or by group membership, and if not, it can
silently fail and exit the script.

Garrick

"Umesh Thakur" <ucthakur-NOSPAM@xxxxxxxxxxxxxxxxxx> wrote in message
news:7598E300-2857-4AB3-B9CC-F6D8DB55E1F6@xxxxxxxxxxxxxxxx
I couldn't find anything that looked suitable on the TechNet script
center,
nor in the Win2000 scripting guide.

Here is Technet Script Center link to find out members of local
Administrators
(or any other) group:
http://www.microsoft.com/technet/scriptcenter/scripts/ds/local/groups/logpvb08.mspx

and you wrote it right, you need to get a list of members who belongs to
local Administrators group. once you got it, loop through it, comparing it
with logged-on user's name.

Here is modified sample code (you may need to remove/comment un-needed
lines):

Set objNetwork = CreateObject("WScript.Network")
strComputer = objNetwork.ComputerName
strUser = objNetwork.userName 'logged-on user
strGroup = "Administrators"
WScript.Echo "Computer: " & strComputer
wscript.echo
Set objGroup = GetObject("WinNT://" & strComputer & "/" & strGroup &
",group")
WScript.Echo " Administrators group members:"
For Each objMember In objGroup.Members
WScript.Echo " " & objMember.Name
if lcase(objMember.Name) = lcase(strUser) then
wscript.echo "Logged-on user is an administrator on this PC"
'write your code here that you want to execute for
'administrator users-only.
end if
Next

and yes, please post your comments/questions/replies to newsgroup only.

-----
Umesh

"Old programmers never die. They just terminate and stay resident."



"Garrick Strom" wrote:

I would like to know if it easy or possible to determine if the logged in
user is an administrator. I would like to put a script in the all-users
startup folder, that would only run if the user was an administrator, and
if
not it would exit siliently. Administrative users would not be just the
local Administrator account, but could also be domain users that have
group
memberships that give them administrative privs on the machine. It all
comes down to determining if the user is somehow a member of the local
Administrators group directly or through nested groups.

I couldn't find anything that looked suitable on the TechNet script
center,
nor in the Win2000 scripting guide. Thanks for any help anyone can
provide.

To email me directly, take the junk out of my address.





.

Relevant Pages

  • Re: Allowing a Domain User Admin Rights to a Couple of Domain Servers
    ... There are only few differences between a Power Users member ... and an Administrators group member, ...
    (microsoft.public.windows.server.security)
  • Re: User.IsInRole
    ... member of the local Administrators group on another machine on the network ... how can I tell if I am a member of the ... Domain Admins group on another domain? ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Local Administrator on laptop has too much access
    ... The allows domain administrators to also be administrators on ... Being in the local administrators group on any domain ... laptops that has the same user logon name/password as their domain account ...
    (microsoft.public.win2000.security)
  • Re: Local Administrator on laptop has too much access
    ... The allows domain administrators to also be administrators on ... Being in the local administrators group on any domain ... laptops that has the same user logon name/password as their domain account ...
    (microsoft.public.win2000.security)
  • Re: Default Shares on Member Servers
    ... On the client, there are no persistent shares, and no stored credentials. ... On the member servers, the local Administrators group contains Domain\Domain ...
    (microsoft.public.windows.server.security)
Loading