Add global group to local power users on all machines

[bofhrevenge2]

I've had a search of the forums and can't find any info on how to add a group to the local power users group on all stations, i was hoping for a policy that i could set at OU level but i can't see one
(I'm sure i saw a thread on this once but i can't find the damn thing now).
Can anyone help here i have an app that simply won't run unless the user is a power user and i don't want to visit hundreds of PC's.


Thanks.

 

[bcastner]

Net localgroup /add

http://www.microsoft.com/resources/...03/standard/proddocs/en-us/net_localgroup.asp

 

[bofhrevenge2]

Thanks for the reply Bill, i seem to have a problem with this it keeps replying with "There is no such user or group: power."

This is what i typed into the CMD prompt

net localgroup powerusers \bcsteachers /add

Is this correct.

Thanks.

 

[bcastner]

For a local workstation add:
To add a local group called bcsteachers to the local user accounts database, type:

net localgroup bcsteachers /add

To add a local group called bcsteachers to the domain user accounts database, type:

net localgroup bcsteachers /add /domain

It is completely possible I am missing something important in your original question.

 

[ReddLefty]

You CAN do it directly threw policies if you have an AD present.

see thread96-581777



"In space, nobody can hear you click..."

 

[tsuji]

Hello all,

My understanding would be
[1] The cmdline is executed on a workstation meaning local.
[2] On this workstation, there is already a localgroup called powerusers.
[3] on the same, an existing user account named bscteachers which is itself a local group.
[4] Inject the local group bscteachers into the local powerusers group:
net localgroup powerusers bscteachers /add

If however
[3a] bscteachers is a domain (global) group from the domain called bizschool, then the cmdline would be
net localgroup powerusers bizschool\bscteachers /add

- tsuji

 

[bcastner]

I suspect what is wanted is to add a user created group "bcsteachers" to the local workstation, and not as limited users.

But the question still remains unclear to me.

 

[bofhrevenge2]

Sorry Bill, yes our student management software will only run if the user is a local power user so the domain group bcsteachers needs to be in the local power users group on all stations.

Thanks.

 

[tsuji]

Correction (tsuji)

Just want to correct my posting above despite helpful or not.

[3] On the same [blue]domain[/blue], an existing user account named bscteachers which is itself a [red]global[/red] group.
[4] Inject the [red]global[/red] group bscteachers into the local powerusers group:
net localgroup powerusers bscteachers /add

If however
[3a] bscteachers is a domain (global) group from the domain called bizschool [blue]which is not the same domain of the workstation[/blue], then the cmdline would be
net localgroup powerusers bizschool\bscteachers /add


- tsuji

 

[bofhrevenge2]

The problem is when i do this i receive the error "there is no such group powerusers" is i put a space in "power users" i receive the error "no sure group power"

This is what i type, bcsteachers is a domain global group in the same domain as the workstation.

net localgroup powerusers bcsteachers /add

Thanks.

 

[bofhrevenge2]

Thanks all, in the end i used the AD option and it has worked very well.

 

[ReddLefty]

"In space, nobody can hear you click..."

 

[bcastner]

The whole issue of creating a new group, whether Workrgroup setting or AD, strikes me as a far too obscure an issue.

. the new group creation process right now has 4 formal group types. MCSE level question: name all 4 group types under AD.

. The thread above discusses several approaches to a new group add to power user. Is anybody happy with this? It strikes me that this is just too hard.

 

[tsuji]

I think why the advice is met with negative reception is that bofhrevenge2 has to make sure his local group which he/she qualifies as "power user" or "poweruser" and I use the figurative powerusers as its literal group name.

This script can enumerate all the local group on the workstation. Seeing its actual name would make the issue clear!

shost="a1b2c3"    'your computer name
set ohost=getobject("WinNT://& shost")
ohost.filter=array("group")
for each ogroup in ohost
    wscript.echo ogroup.name
next
set ohost=nothing

I do not feel very good as we turn out learning nothing from other's experience only making confusing reading for other readers.

- tsuji

 

[tsuji]

Correction:

The corresponding line should be read as:
[tt] set ohost=getobject("WinNT://[red]" & shost[/red])[/tt]

- tsuji

 

[bofhrevenge2]

I agree bcastner when I set out to do this I was convinced there would be a simple GP to set that would alter local group membership on workstations, it turned out to be a faff and a very obscure GP setting.

I had never seen this option in AD and i've taken the MS AD exams, i seems like an oversite in their part.

 

[bcastner]

Thank you tsuji.

It just strikes me that this problem is harder to resolve than it has to be.

 

[bofhrevenge2]

Mabe if enough people mention it MS will add an easier option at a later date, altho it would be a start if people would write software that will run as a basic user.

Thanks.

 

[bofhrevenge2]

Hmmm well it was all going swimmingly but some of my stations refuse to pick up the policy (They are all in the same OU).

Has anyone got any ideas on this, my AD usually works very well, the stations are picking up all their apps and desktop settings and I have tried refreshing the policy and rebooting.

I was so close too how annoying :-(

Thanks all.

 

[bofhrevenge2]

Ok a bit more info here

http://support.microsoft.com/default.aspx?kbid=810076

I noticed that rebooting then seemed to have no effect, but telling them to stand in a corner like naughty kids untill they do as they are told worked very well.