Re: Login script to add a user as an Administrator.




I agree with Ramon, I hope that's not what Steve is asking for. If that's
the case, just add Authenticated Users to every machine's Administrators
group and cross you fingers no one gets mischievous or gets a worm virus.

Steve, please explain who will get added to which machines? Elaborate more
than "Currently all the users added to every machine are added as
administrators". Are you adding only the primary user of the system to the
Administrators group, or are you planning on adding everyone in the company
to every machine's admin group?


"Ramon Jimenez [MVP]" <rjimenezm@xxxxxxxxxxxxxxxxxx> wrote in message
news:OifG86RxGHA.428@xxxxxxxxxxxxxxxxxxxxxxx
I do not recommend that solution.

With this solution, ALL users would be administrators of ALL machines in
the Domain, so everyone would be able to map the C$ of your CIO, HR or
whoever and access sensitive data stored in the lcoal hard drive.

Adding each user separately in a Startup Script is very simple (just need
a CSV or Access file)

Ramon,

"Bruno" <Bruno@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:A5EF84B8-AF7E-4BE9-B4F4-F4095507679A@xxxxxxxxxxxxxxxx
Hi,
If you have AD you could create a startup script that adds a global group
to
the local admin group, then you put the users in this group.
This can also be achieved via a script that you would run as domain
admin.
[I guess Adding a group to local administrators is easier than trying to
add
each user separately].
hope it helps

bruno

"Dundee" wrote:

You could use AutoIT (http://www.autoitscript.com/autoit3/)

With AutoIT you can use this command
RunAsSet ( ["user", "domain", "password" [, options]] )
RunWait(@ComSpec & " /c " & 'WSCRIPT.EXE\YOURSCRIPT', "", @SW_HIDE)
RunAsSet()






steve.mccall1@xxxxxxxxxxxxxx wrote:
Hi,

I'm looking to write a script that will automatically add a user as an
administrator to a computer the 1st time the user logs on the pc.

Currently, a user with an account in the AD can log onto any pc, but
needs to be added (by me logging in as an administrator and physically
adding them as a user on the domain) before the user can utilise the
companies software.

This is a security problem I know and the software is in the process
of
being re-written.

What would be the best way to get around this problem? I was thinking
a login script within the OU might work but I'm not sure how to start.

Steve






.



Relevant Pages

  • Re: User type
    ... This does help Mike - thanks ... > If the computer is member of domain then you should use domain user ... > After you have this account and group created you can write a short script ... > administrator and make your users local administrators. ...
    (microsoft.public.windows.server.setup)
  • Re: VBScript to verify is user is local admin
    ... I believe the script posted using WMI addresses one complication with the ... the WMI script, only reveal direct membership. ... Administrators group is renamed, ... Dim strUser ...
    (microsoft.public.scripting.vbscript)
  • Re: User type
    ... I miss-read you message - I now know that I must handle this in the startup ... >> After you have this account and group created you can write a short ... >> in local administrator and make your users local administrators. ... >> Put above command in batch file and run it as startup script (not logon ...
    (microsoft.public.windows.server.setup)
  • Re: User type
    ... Domain Administrators group (actually you only leave it in default group -- ... Add this computer account to new domain group called e.g. ... After you have this account and group created you can write a short script ... group where your users who need to be local admins are located. ...
    (microsoft.public.windows.server.setup)
  • Re: Can not install applications using any admin account
    ... You could try if it works without those restrictive policy ... I also have a vbscript running at logon ... these Computer Policy Settings: ... restrictions is *not* applied to Administrators. ...
    (microsoft.public.windows.terminal_services)