All Forums >> [Scripting] >> WSH & Client Side VBScript >> Script: Manage Local Groups on Mixed Domain Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks!
Posts: 3
Score: 0
Joined: 9/22/2004
From: USA
Status: offline
Hi All.
Looking for some direction on managing the Local Groups (Admin!) on workstations in my domain. I would like to be able to run a script that will configure these local groups to my liking without touching each machine directly.
Here is the scenario:
NT Domain (no AD): WINNT Workstation WIN2K Pro (Majority)
Administrators: Admin Team - seperate admin accounts added to Domain Admin group Client User Admins - Emergency Access regulated through Domain Group Membership for workstation access only Client Server Admins - Webserver admins (no workstation access)
The client requires me to allow these users elevated rights under certain circumstances. This is not my option, but it has become my problem and it is getting worse.
I would like to run a script from my workstation that will read through a list of workstations and perform the following: 1. Delete all Users from Local Admin Group except the Local Administrator 2. Delete all Local Groups from Local Admin Group 3. Delete all Domain Groups from Local Admin Group EXCEPT specific domain groups and service accounts. 4. Add Authorized Domain Groups and Service Accounts
I have tried modifying some of the Technet scripts but couldn't get anything to "reset" the local admin group the way I need.
What scripting method would best help me to reach my goal? I have reviewed ADSI, WSH, VBScript, and WMI but haven't been able to get a clue.
Posts: 3
Score: 0
Joined: 9/22/2004
From: USA
Status: offline
kmahlangu,
Thank you for your reply!
I have not found anything in PSTOOLS v2.06 that will allow me to "reset" the Local Administrators Group on each machine in my domain. I know that I can change the local admin password, but that is not quite what I am attempting.
Active Directory would simplify my life greatly, but, I can't implement it on this domain. If you have any other suggestions, I am certainly listening! :)