Re: Remove Users From Local Admin Group


Torgeir Bakken \(MVP\) wrote:
*Forest wrote:

Does anyone out there have a script that I can use in the login
script to
remove domain users from the local admin group? I want to lock down
the
local Admin group from the login script. Right now the domain user
has admin
access.
Hi

Below is a script that will remove all *user* accounts from the
Administrators group. Both local and domain users will be removed
(but not the builtin Administrator account). Any group accounts
will not be removed.


'--------------------8<----------------------

Set oWshNet = CreateObject("WScript.Network")
sComputer = oWshNet.ComputerName

' group to remove user from
Set oGroup = GetObject("WinNT://" & sComputer & "/Administrators")


' suppress errors, e.g. trying to remove the builtin Administrator
' account from the Administrators group will fail.
On Error Resume Next

' loop through all members of the Administrators group of type users
For Each oMember In oGroup.Members
If oMember.Class = "User" Then
' remove the user from Administrators group
oGroup.Remove oMember.ADsPath
End If
Next
'--------------------8<----------------------


--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
[url]http://www.microsoft.com/technet/scriptcenter/default.mspx[/url]
*



--
impu
------------------------------------------------------------------------
Posted via http://www.codecomments.com
------------------------------------------------------------------------

.

Relevant Pages

  • Re: Remove Users From Local Admin Group
    ... > local Admin group from the login script. ... Both local and domain users will be removed ... ' account from the Administrators group will fail. ... -- torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: ...
    (microsoft.public.scripting.vbscript)
  • Re: Script for creating a new user
    ... I want to create a local user. ... Creating a local user and adding it to the Administrators group ... ' Use error handling in case the account is a member already ... torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway ...
    (microsoft.public.scripting.vbscript)
  • Re: AD in Local Groups differente languajes?
    ... > the local Administrators group on every workstation, ... > have different languages on the workstation and the Administrators group ... To run this WMI query against NT4 computers, ... -- torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: ...
    (microsoft.public.windows.server.scripting)
  • Re: Registry Key
    ... > would like to add a new group to the administrators group ... (in a command prompt, run "net.exe help localgroup" for more information) ... The free command line utility Lg.exe on the free win32 c++ tools page of ... Microsoft MVP Scripting and WMI, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Display last login for user accounts
    ... > directory domain and the last time it was logged in. ... > accounts of past ex-employees. ... And if your domain functional level has been set to Windows Server 2003: ... -- torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: ...
    (microsoft.public.windows.server.scripting)