Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations TouchToneTommy on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

a new local admin group on XP machines thru GP 1

Status
Not open for further replies.

vostok1

MIS
Feb 15, 2005
50
US
I need to drop a local admin group to XP workstations.

All relevant computers are in an OU. What GP settings do I use?
 
Anybody?


This group shall be local Administrators. It cannot
be in Domain Admin group though. It cannot have access to the servers neither any priviledges, but it needs to have full rights to the local workstations.
 
Do you just want to add users to the local admins group already on the XP machines? If so, you can use RESTRICTED GROUPS to do this. You could also use that if you wanted to add people/groups to say, the POWER USERS group on the machines.

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)
 
Thank you. It works pretty good but has a downside. It
removes all user or group accounts from the Administrators group except the local Administrator account replacing it with the new settings, in my case with this one group (our techs) that need full access.

Certain software we run requires Administrator privileges (so far no decent workaround), and so I have the local Administrators group occasionally populated with various user accounts that have to stay. Only the new group has to be added
everywhere.


 
You can use the "Net Localgroup" command to add the group you need to the systems.

The easiest way to use it remotely would be to use the PSExec command from
Simply
psexec \\computer net localgroup Administrators /ADD "yourdomain\your global group"

Good luck!

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers
 
Hey - that's pretty slick. I haven't seen "net localgroup" before. A star for you!

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)
 
PSC,

thanks for your excellent advice; however, I had to take your hint little further.

When looking for a reference how to deploy the new “Admins” group to a GROUP of
computers with psexec (which is not possible), I found a utility doing exactly the same job using a text file.

1) I extracted all computers from the given OU with dsquery into an Excel file
2) I created a text file with only the computer names: one name, one line
3) beyondexecv2.exe -g computers.grp net localgroup Administrators /add "domain\Admins"

The group had about 150 stations, and it worked like a charm!

Petr Sklenar
Orlando
 
Cool glad you got it to work. I actually tested it with psexec before I posted. I ran it from a server where I was logged in with admin credentials. Don't know what went wrong.

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top