Re: Add a domain user group to local computer administrator group

Hi Jim

I searched in the group policy for those Restricted groups, but I couldn't
find the place where they are !

Can you tell me the complete location (ex: computer policy/windows
component/...)
--
Jack


"Jim Vierra" wrote:

> Add the group to "Restricted Groups" in group policy. It's easier and more
> secure and reliable. That is exactly what "Restricted Groups" were designed
> for.
>
> --
> Jim Vierra
>
> "papejack" <papejack@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
> news:0BA91CDF-D24D-4CDD-B865-90C81B809398@xxxxxxxxxxxxxxxx
> > HI,
> >
> > I used a script like the one you gaves, but the script didn't work on
> > Windows XP Pro SP2
> >
> > Situation: on a domain, we want every computer to automatically add a
> > domain
> > group to a local administrator group. To do this, we put the following
> > script
> > in the machine startup script in the GPO :
> >
> > -----------------------
> > Dim Ordinateur, GroupeLocal, GroupeAD, Domaine, objetGroupeLocal,
> > objetGroupeAD
> >
> > Ordinateur = "."
> > GroupeLocal = "Administrateurs"
> > GroupeAD = "AD-Group"
> > Domaine = "domain"
> >
> > Set ObjetGroupeLocal = GetObject("WinNT://" & Ordinateur & "/" &
> > GroupeLocal)
> > Set ObjetGroupeAD = GetObject("WinNT://" & Domaine & "/" & GroupeAD)
> > ObjetGroupeLocal.Add(ObjetGroupeAD.ADsPath)
> >
> > Set ObjetGroupeLocal = Nothing
> > Set ObjetGroupeAD = Nothing
> > -----------------------------------
> >
> > The script run fine on Windows 2000, but on Windows XP, we get an error
> > message on the line where we try to connect to the domain group.
> >
> > do you have an idea ?
> >
> > thanks
> > --
> > Jack
> >
> >
> > "DataDoug" wrote:
> >
> >> SORRY, cut & pasted the wrong script (too much caffeine!!)
> >> This is the script you need, it copies a domain user GROUP called
> >> CNPROGRAMMING to the local DEBUGGER USERS group.
> >>
> >> '*******************************************************************************
> >> '* File: CNAddDebuggerUser.vbs
> >> '* Purpose: Adds CNProgramming (domain Group) to local Debugger
> >> Users
> >> group.
> >> '*
> >> '* Usage: Double Click Script from desired PC
> >> '* Version: 1.0 (02Feb05)
> >> '* Technology: VBSCRIPT
> >> '* Requirements:
> >> '*
> >> '* History:
> >> '*******************************************************************************
> >>
> >> ' Set the workstation for this action. Replace the "." with a computer
> >> name
> >> for remote access.
> >> strComputer = "."
> >>
> >> ' Bind to local admin group.
> >> Set objGroup = GetObject("WinNT://" & strComputer & "/Debugger
> >> Users,group")
> >>
> >> ' Bind to domain user CNProgramming
> >> Set objUser = GetObject("WinNT://isd535/CNProgramming,group")
> >>
> >> ' Pass path value to local computer
> >> objGroup.Add(objUser.ADsPath)
> >>
> >>
> >>
> >> "DataDoug" wrote:
> >>
> >> > The following puts domain user BDPA in the local admin group:
> >> >
> >> > '*******************************************************************************
> >> > '* File: AddBDPAUser.vbs
> >> > '* Purpose: Adds BDPA (domain USer) to local admin group.
> >> > '*
> >> > '* Usage: Double Click Script from desired PC to run local or
> >> > edit
> >> > strComputer = "." with remote PC name
> >> > '* Version: 1.0 (22 Oct 04)
> >> > '* Technology: VBSCRIPT
> >> > '* Requirements:
> >> > '* Author: By DataDoug
> >> > '* History:
> >> > '*******************************************************************************
> >> >
> >> > ' Set the workstation for this action. Replace the "." with a computer
> >> > name
> >> > for remote access.
> >> > strComputer = "."
> >> >
> >> > ' Bind to local admin group.
> >> > Set objGroup = GetObject("WinNT://" & strComputer &
> >> > "/Administrators,group")
> >> >
> >> >
> >> > ' Bind to domain user BDPA
> >> > Set objUser = GetObject("WinNT://isd535/BDPA,user")
> >> >
> >> > ' Pass path value to local computer
> >> > objGroup.Add(objUser.ADsPath)
> >> >
> >> >
> >> >
> >> > "MJG" wrote:
> >> >
> >> > > Hi,
> >> > >
> >> > > I was wondering if there is a way to script adding a domain user
> >> > > group to
> >> > > the local administrator group to workstations on our domain. Thanks
> >> > > for you
> >> > > help.
>
>
>
.

Relevant Pages

  • Re: Making a domain account a local admin wherever it is used?
    ... There are a couple of ways to do this - using Group Policy Restricted Groups ... adds the domain user to the administrators group. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Removing everyone group from Administrator group
    ... > the administrators group. ... You could do it in a computer startup script that runs ... Restricted Groups enforced with Group Policy is maybe an option: ...
    (microsoft.public.windowsxp.general)
  • Re: Logon Scripts Acrossed VPN
    ... What does GPMC GPREsults show under the Group Policy Infrastructure Component Status for one of those machines? ... I think this error is related to computer processing rather than your logon script issue but still probably worth figuring out if there is a problem. ... Darren Mar-Elia ... > This same error seems to be on every system in my remote offices. ...
    (microsoft.public.windows.group_policy)
  • Re: Group Policy Timeout on one server in an OU.
    ... Deny Apply for the GPO that defines the login script ... On Error GoTo 0 ... Group Policy Management solutions athttp://www.sdmsoftware.com ...
    (microsoft.public.windows.group_policy)
  • Re: Local Policy Logoff/Shutdown scripts
    ... Now, I know you set the logoff/shutdown script thru the local group policy, ... Microsoft CSS Online Newsgroup Support ... | Thread-Topic: Local Policy Logoff/Shutdown scripts ...
    (microsoft.public.windows.server.sbs)