Re: I need to change the group membership using a logon script



Jay wrote:

I am using a vbs script to run the " net time command" using an object
created from the Wscript.shell. Everytime I run the script I am getting a
group membership error stating that the user is not part of a group that
has
specific privileges to run the command. When researching the problem, I
found out that the user has to be apart of the domain administrator group
in
order to run the command. I dont want to make this user apart of the
domain
admins group in order to run the script. I want to be able to find another
group with limited privleges in order to run the command. Is there also a
way
to change group membership using logon script where in the script the user
gets changed from one group and then back to the previous group once the
script is completed.

I believe users need to be members of the local Administrators group to run
net time. By default, when computers are joined to the domain, the group
"Domain Admins" is made a member of the local Administrators group on the
machine. That's why Domain Admins can run net time.

A better solution is make another domain group a member of the local
Administrators groups on the computers. This can be done with a GPO or with
restricted groups. Making your users a member of this new domain group will
make them members of Administrators on all computers, but not Domain Admins.
A startup script (configured in GPO) can add a domain group to the local
Administrators group. Have the script check membership (using the IsMember
method of the group object) before adding the domain group (with the Add
method of the group object). The WinNT provider must be used. Or check
documentation for Restricted Groups.

An even better solution would be to determine what permissions are needed on
the local computer, then creating as local group with these permissions.
Again you can make a domain group a member of this new local group. Maybe
someone else knows what permissions are required, of if this can be done.

Another question is why you want users to run net time. Are your clients not
synchronizing time at startup?

Finally, maybe your task could be done in a Startup script. These run with
System privileges on the local computer, before any user authenticates.
Configure a Startup script in Group Policy.

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--


.



Relevant Pages

  • Re: Finding users in local admin groups
    ... > Here is a vbscript that you can run against a remote computer that moves ... > *local* users except 'Administrator) from the Administrators group to the ... You should also add to the script logging to a file of the ... > you moved on what computers. ...
    (microsoft.public.win2000.security)
  • Re: How to make a AD group member of the local administrators grou
    ... Can I use your script and replace the user ingo with the group info or do I ... Clemens de Brouwer ... that group to the local Administrators group. ... ' Check if user already a member. ...
    (microsoft.public.windows.server.scripting)
  • Re: Use the "Managed By" field in AD to set as local Admin
    ... I think the way must be in the logon script. ... Administrators group, you can run it repeatedly until there is no message ... "Domain Admins" should be a member of the local Administrators group on ... Dim strComputerDN, strComputer, strManagerDN ...
    (microsoft.public.windows.server.active_directory)
  • Re: Use the "Managed By" field in AD to set as local Admin
    ... I think the way must be in the logon script. ... Administrators group, you can run it repeatedly until there is no message ... "Domain Admins" should be a member of the local Administrators group on ... Dim strComputerDN, strComputer, strManagerDN ...
    (microsoft.public.windows.server.active_directory)
  • Wired error of get-credential for non-privilege user
    ... If login as a member of Administrators group, ... Second time you run script: ...
    (microsoft.public.windows.server.scripting)