Re: Remove users fom all Local Administrators!!

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Ahmad Sabry wrote:

I've alot of clients who their domain account is added to local
administrator group.. . it will take alot of time to remove one by one ,
so if there are a script to remove all accounts from local Administrator
group on each machine & keep the local administrator ?

You will want to keep both the local Administrator user and the "Domain
Admins" group. A VBScript program can do this remotely, assuming you have
sufficient permissions (are a member of "Domain Admins"). You bind to the
local Administrators group with the WinNT provider and use the Remove method
of the group object to remove unwanted members. For one computer:
==============
Option Explicit
Dim objAdmGrp, strComputer, objMember, strName

' Specify NetBIOS name of computer.
strComputer = "MyComputer"
' Bind to local Administrators group on the computer.
Set objAdmGrp = GetObject("WinNT://" & strComputer _
& "/Administrators,group")

' Enumerate members.
For Each objMember In objAdmGrp.Members
strName = LCase(objMember.Name)
' Remove non-admin members.
If (strName <> "administrator") And (strName <> "domain admins") Then
objAdmGrp.Remove(objMember.AdsPath)
End If
Next
=======
You could use ADO to retrieve all computer objects in the domain and perform
the above. However, it might be better to enumerate the computer objects in
a container. Since the WinNT provider is blind to OU's, I would use the LDAP
provider to enumerate the computers, then retrieve the sAMAccountName
attribute of each. This attribute is the NetBIOS name of the machine with
"$" appended on the end. You can remove the trailing "$" from the value of
sAMAccountName and use this to bind to the local Administrators group (you
must use the WinNT provider for local objects). For example:
==============
Option Explicit
Dim objAdmGrp, strComputer, objMember, strName
Dim objOU, objComputer

' Bind to container/OU.
Set objOU = GetObject("LDAP://ou=Sales,dc=MyDomain,dc=com";)

' Filter on computer objects.
objOU.Filter = Array("computer")

' Enumerate all computers in the container.
For Each objComputer In objOU
' Retrieve the NetBIOS name of the computer.
strComputer = objComputer.sAMAccountName
' Remove trailing "$".
strComputer = Left(strComputer, Len(strComputer) - 1)

' Bind to local Administrators group on the computer.
Set objAdmGrp = GetObject("WinNT://" & strComputer _
& "/Administrators,group")

' Enumerate members.
For Each objMember In objAdmGrp.Members
strName = LCase(objMember.Name)
' Remove non-admin members.
If (strName <> "administrator") And (strName <> "domain admins")
Then
objAdmGrp.Remove(objMember.AdsPath)
End If
Next
Next
==========

--
Richard
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net


.

Relevant Pages

  • Re: WSS and Active Directory Account Creation Mode
    ... Add your domain users to the local Administrators group of the server ... WSS security will apply. ... I haven't tested adding groups to the local Administrators group. ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: restricted groups for local admin rights
    ... I'm referring to local administrators and not domain administrators?) ... > describe you want to use the "member of" option for restricted groups. ... > way you can add a global group to the administrators group without affecting ...
    (microsoft.public.windows.group_policy)
  • Re: Forcing groups into the local admin account
    ... Does this remove the local Administrative account for the ... machine as being part of the local Administrators group? ... >of the GPO that you use. ...
    (microsoft.public.windows.group_policy)
  • GPO Application
    ... there's no policy affecting them after said policy, ... and removing them from the local administrators group (this is an attempt to ... I even remember once within a server 2000 environment I locked down my own ...
    (Security-Basics)
  • Re: Rid AD of Circular Group Membership
    ... and have use on members if it is used there. ... Administrators group is still intact), nor do they have empowerments over ... Admins is being used for by the 30+ can be delegated I(ex. ... The quess is each has an account and uses it, ...
    (microsoft.public.windows.group_policy)