Re: VBScript to verify is user is local admin

I believe the script posted using WMI addresses one complication with the
task of determining who has administrative rights on a computer, which is
that the local Administrators group can be renamed. The script finds the
group using the "well-known SID". However, it still does not reveal
membership due to nesting. Both scripts, the one by the original poster, and
the WMI script, only reveal direct membership.

I have a sample VBScript program linked here that attempts to determine
membership in a local group, including due to nesting, both of local groups
and nesting of domain groups. The program is linked here:

http://www.rlmueller.net/IsMember9.htm

This program reveals membership in any local group, but if the local
Administrators group is renamed, you have to know that. The task is not
easy.

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--

"Fredrik Wall" <wall.fredrik@xxxxxxxxx> wrote in message
news:B1350D1F-676F-4B50-8612-A914DD7A85B1@xxxxxxxxxxxxxxxx
Hi,

I think this script can help you:

Dim strUser

Set objNetwork = CreateObject("Wscript.Network")

strComputer = objNetwork.ComputerName

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colAccounts = objWMIService.ExecQuery _
("Select * From Win32_Group Where LocalAccount = TRUE And SID =
'S-1-5-32-544'")

For Each objAccount in colAccounts

strUser = "testuser"

Set objGroup = GetObject("WinNT://" & strComputer & "/" &
objAccount.Name)
For Each objUser in objGroup.Members
Wscript.Echo objUser.Name
If objUser.Name = strUser Then
wscript.echo strUser & " is a local administrator."
End If
Next


Next


"Flash08" <stuart.karp@xxxxxxxxx> wrote in message
news:1174687820.364368.24540@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hi all,

I wrote a script to verify if a user is a local admin or not, however
right now it only works if the username is a local admin. If the
username is part of a group that's a local admin it does not work.

Here's my script:

Dim strUser
Set objNetwork = CreateObject("Wscript.Network")

strComputer = objNetwork.ComputerName
strUser = "testuser"

Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators")
For Each objUser in objGroup.Members
Wscript.Echo objUser.Name
If objUser.Name = strUser Then
Msgbox strUser & " is a local administrator."
End If
Next


I also don't like the fact that it only checks the username and not
the domain as well. If someone know how to do that I'd appreciate it
as well. So if testuser was a member of the Administrators group it
would work. However if testuser was a member of a group called
testGroup and testGroup was an Administrator on this machine it would
not work.

Does anyone know a better way to verify if a useraccount is a local
admin on a machine? Thanks.




.

Relevant Pages

  • Re: AD group logon script question
    ... like I described our logon script: ... If individuals need special access to certain resources, ... and each group must be protected from the administrators of the other. ... membership as required. ...
    (microsoft.public.scripting.vbscript)
  • Re: Finding multiple memgers of a group
    ... someone point me to a sample script or discussion on finding multiple ... This script will tell me if JoeUser is a memger of the Administrators ... Dim objGroup, strComputer, objFSO, objTextFile ... which will be checked for membership. ...
    (microsoft.public.scripting.vbscript)
  • Re: User type
    ... This does help Mike - thanks ... > If the computer is member of domain then you should use domain user ... > After you have this account and group created you can write a short script ... > administrator and make your users local administrators. ...
    (microsoft.public.windows.server.setup)
  • Re: Local account creation
    ... What I want to do is to use the script in a startup GPO so that there a generic local admin account on all computers for the helpdesk staff to logon to and perform troubleshooting/etc. ... Dim objNetwork, strComputer, strUser ... ' Specify name of local user account to be created. ...
    (microsoft.public.windows.server.scripting)
  • Re: User type
    ... I miss-read you message - I now know that I must handle this in the startup ... >> After you have this account and group created you can write a short ... >> in local administrator and make your users local administrators. ... >> Put above command in batch file and run it as startup script (not logon ...
    (microsoft.public.windows.server.setup)