Setting Local Power Users from a Login Script 1

[Albion]

I have a bunch of users on my domain (Linux Samba 3, so no Active Directory) who need to be members of the Local Power users group. Is there any way to add a domain user to the local power users or local admins group from a login script?

Thanks

-Al

 

[JFBouchard]

I since the login script is executed in the security context of the user, the user won't be able to elevate his privileges on his machine. sorry.

How many computer are we talking about?

Jeff

 

[Albion]

Between 75 and 100 or thereabout.

-Al

 

[bcastner]

Actually, logon scripts are executed in the security context of Local System.

In any case, two choices:

1. You can use WMI scripting:


'Beginning Of the Script

On Error Resume Next

'get main objects/variables

Set ws = WScript.CreateObject ( "WScript.Shell" )
compname = ws.ExpandEnvironmentStrings ( "%COMPUTERNAME%" )
Set adGrp = GetObject ( "WinNT://" & compname & "/Administrators,group" )

'add domain groups to local admin group: example
'example domain group is Domain Administrators:

adGrp.Add ( "WinNT://Main/Domain Admins,group" )
'
'
'add domain user to local admin group
'example domain user is jjones

adGrp.Add ( "WinNT://Main/jjones,user" )

'End of the Script

2. Use NET LOCALGROUP

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/net_localgroup.mspx

Example: >net localgroup "administrators" "bcastner\power users" /add

 

[Albion]

That's what I was looking for, thanks much.

-Al

 

[bcastner]

Sorry Jeff31, I errored in correcting you above. Logon/logoff scripts run in the logged-on user’s security context, and shutdown/startup scripts run in the system’s security context.

Brain freeze on my part. Time for coffee.

 

[JFBouchard]

No problem bcastner.

Have a nice day

Jeff

 

[bcastner]

Several other notes:

. If you want to create a text file and feed commands to make users/group to local group changes, the Win2k reskit has two different utilities to do this. See the command lines for ADDUSERS.EXE and USERTOGROUP.EXE

. You really must see this tool "A2A", as it is what I frequently use to handle this chore:

http://www.petri.co.il/a2a.htm

No logon scripts, nothing. This will change every turned on computer in a Domain.

 

[Albion]

It would be nice if a2a worked with Powerusers instead of just Administratior. Although, that is a nice tool. To be honest it would be nice if Samba would just hurry up and incorporate Active Directory and Group Policies.

-Al

 

[bcastner]

Yes, it would be nice of A2A gave you a local group option.