Re: How to make a AD group member of the local administrators grou

Thanks for reaction, but I need two AD groups to become a member of the local
administrators group.

Can I use your script and replace the user ingo with the group info or do I
need something else??

with kind regards

Clemens de Brouwer

"Richard Mueller [MVP]" wrote:

You can, of course, make the two users members of a domain group and add
that group to the local Administrators group. This gives more flexibility,
for example if jobs change. That said, you must use the WinNT provider when
dealing with local accounts. For example:
================
' Bind to domain objects.
Set objDomainUser = GetObject("WinNT://MyDomain/JSmith,user")
Set objDomainGroup = GetObject("WinNT://MyDomain/TestGroup,group")

' Bind to local group.
strComputer = "WST231"
Set objLocalGroup = GetObject("WinNT://" & strComputer &
"/Administrators,group")

' Check if user already a member.
If (objLocalGroup.IsMember(objDomainUser.AdsPath) = False) Then
' Add user to group.
objLocalGroup.Add(objDomainUser.AdsPath)
End If

' Check if group already a member.
If (objLocalGroup.IsMember(objDomainGroup.AdsPat) = False) Then
' Add group to group.
objLocalGroup.Add(objDomainGroup.AdsPath)
End If
=============
This can be done remotely (If you are a member of Domain Admins and this
group is still a member of the local Administrators group). It cannot be
done in a logon script, as most users should not have permission. It could
be done in a Startup script, as they run with System privileges on the local
computer.

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--

"Clemens de Brouwer" <clemens66@xxxxxxxxxxxxx> wrote in message
news:4C0169DD-35CC-441C-AA60-D727FF32F470@xxxxxxxxxxxxxxxx
Because in a GPO this is done using the restricted group option. And we
need
to also add local users to the administrator group which will be deleted
by
the GPO when we use the restricted group option.

And we need two domain groups to be member of the local administrators
group.

I'm creating a vbscript which creates the local users, set there passwords
and makes them member of the local administrators group. This script also
has to add the two domain groups to the local administrators group

I hope this makes it clear to you why we needs this to a script.

with kind regards

--
Clemens de Brouwer
LogicaCMG
Eindhoven (the Netherlands)


"Kenneth Bess" wrote:

Hi,

Why not creating a GPO instead - I think that is the best thing to do in
this case.

Regards,
Kenneth

"Clemens de Brouwer" <clemens66@xxxxxxxxxxxxx> wrote in message
news:91D93564-C5E8-4CA6-ADE2-A91960891656@xxxxxxxxxxxxxxxx
I need to make a vbscript which makes two groups present in an Active
Directory Domain member of the computers local Administrators group.

Any sugestions?

--
Clemens de Brouwer
LogicaCMG
Eindhoven (the Netherlands)






.

Relevant Pages

  • Re: Use the "Managed By" field in AD to set as local Admin
    ... I think the way must be in the logon script. ... Administrators group, you can run it repeatedly until there is no message ... "Domain Admins" should be a member of the local Administrators group on ... Dim strComputerDN, strComputer, strManagerDN ...
    (microsoft.public.windows.server.active_directory)
  • Re: Use the "Managed By" field in AD to set as local Admin
    ... I think the way must be in the logon script. ... Administrators group, you can run it repeatedly until there is no message ... "Domain Admins" should be a member of the local Administrators group on ... Dim strComputerDN, strComputer, strManagerDN ...
    (microsoft.public.windows.server.active_directory)
  • Wired error of get-credential for non-privilege user
    ... If login as a member of Administrators group, ... Second time you run script: ...
    (microsoft.public.windows.server.scripting)
  • Re: I need to change the group membership using a logon script
    ... admins group in order to run the script. ... I believe users need to be members of the local Administrators group to run ... "Domain Admins" is made a member of the local Administrators group on the ... Administrators groups on the computers. ...
    (microsoft.public.scripting.vbscript)
  • Re: Add domain group to local group question
    ... Running the script remotely will not work for 2 reasons. ... alternate credentials. ... ' Bind to the local Administrators group with alternate credentials. ... ' Check if already a member. ...
    (microsoft.public.scripting.vbscript)