Re: Domain user to local administrators group

Tech-Archive recommends: Fix windows errors by optimizing your registry


Richard Mueller [MVP] <rlmueller-nospam@xxxxxxxxxxxxxxxxxxxx> wrote:
"Lanwench [MVP - Exchange]"
<lanwench@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:udvAj7RQKHA.3876@xxxxxxxxxxxxxxxxxxxxxxx
alimk <alimk.3z507c@xxxxxxxxxxxxx> wrote:
Hi Everyone,

I need a VB Script for adding domain users to be a member of local
administrators group.

Thanks in Advance.

Why does it especially need to be vbscript? A simple batch file
startup script in a GPO will do this. My advice would be to set up a
universal security group called LocalAdmin in AD. Add the users you
wish to it Use this in a batch file assigned as a startup script via
GPO...

net localgroup administrators DOMAIN\localadmin /add

I would recommend that this not be done in a logon script,

Nor I - that's why I suggested a startup script. Users will never see it.
(and this wouldn't work in a login script anyway because it would run in the
user context, and require that the user have admin rights). It isn't the
most elegant solution, but it sure is simple.

whether
batch file or VBScript, because normal users should not have
permission and administrator credentials should not be exposed in a
logon script. Also, if done in a logon script the task can be
repeated over and over, and yet you don't know when the task is
complete for each computer.

Yes, true for a startup script as well, but this is such a simple thing that
it doesn't hurt anything to re-add. The only thing that will happen when you
run the command is that it will say (not visible to anyone) that the group
is already a member of the group, and move on. It takes no time at all. And
it ensures that any new PC added to the domain will get this setting.

The VBScript program has the advantage of
checking first to see if the user/group needs to be added, but unless
it logs to a shared file, you still don't know when the task is
complete.
Better is to add the user or group to the local Administrators group
remotely yourself. The VBScript example I posted can be run remotely,
as long as the person is a member of the Domain Admins group, which
by default should be a member of the local Administrators group for
all computers joined to the domain. You could code a script to do
this in bulk for all computers, or computer names read from a text
file.
An even better solution is to use the Restricted Groups feature of
Group Policy. Again, a domain group should be added to all local
Administrators groups, so it can be managed easily in AD. See these
links for details:

Yes, that's a very good option. The reason I don't generally use it is that
I
sometimes want different PCs to have different local group membership.

http://support.microsoft.com/kb/279301

http://technet.microsoft.com/en-us/library/cc785631(WS.10).aspx

http://support.microsoft.com/kb/810076

--
Richard Mueller
MVP Directory Services
Hilltop Lab - http://www.rlmueller.net

BTW, I generally bow before your scripting prowess, you know. :-)




.

Relevant Pages

  • Re: Login Script group membership
    ... Would it be more managable to write this as a vbs instead of a batch file? ... script, as not all o/s's can run a .vbs file directly as a logon script. ... - you'd need to write a wrapper function to invoke ifmember and return the ... In the general case a user can be a member of any number of ...
    (microsoft.public.windows.server.scripting)
  • Re: I need to change the group membership using a logon script
    ... admins group in order to run the script. ... I believe users need to be members of the local Administrators group to run ... "Domain Admins" is made a member of the local Administrators group on the ... Administrators groups on the computers. ...
    (microsoft.public.scripting.vbscript)
  • Re: Add domain group to local group question
    ... Running the script remotely will not work for 2 reasons. ... alternate credentials. ... ' Bind to the local Administrators group with alternate credentials. ... ' Check if already a member. ...
    (microsoft.public.scripting.vbscript)
  • RE: How to remove a computer object from a group via a batch script?
    ... Write a batch file like: ... > I need to remove a computer object from a group so it is not a member ... > of the computers (e.g. the computer I run the script on gets removed). ...
    (microsoft.public.windows.server.active_directory)
  • Re: Use the "Managed By" field in AD to set as local Admin
    ... I think the way must be in the logon script. ... Administrators group, you can run it repeatedly until there is no message ... "Domain Admins" should be a member of the local Administrators group on ... Dim strComputerDN, strComputer, strManagerDN ...
    (microsoft.public.windows.server.active_directory)