Help, need a VBScript

Hey everyone,

We are running a Windows 2003 domain and Win2k and Win2k3 workstations. I
need a vbscript to add a domain acct. to the LOCAL Admin acct. to ALL of our
workstations. Can anyone help by pointing me in the right direction where I
can download that type of script?


TIA,


Clayton

configure a temp group policy at the domain level. make everyone log
off/on

Hey RC,

Thanks for the reply. However, can you explain a little more? I know how
to do GPOs, I just need a little more info. from you.


Clayton



"RC" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) ups.com...
> configure a temp group policy at the domain level. make everyone log
> off/on
>

Where would I do it at?


Clayton


"Clayton Sutton" <(E-Mail Removed)> wrote in message
news:Tt7Zg.65785$(E-Mail Removed). ..
> Hey RC,
>
> Thanks for the reply. However, can you explain a little more? I know how
> to do GPOs, I just need a little more info. from you.
>
>
> Clayton
>
>
>
> "RC" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed) ups.com...
>> configure a temp group policy at the domain level. make everyone log
>> off/on
>>
>
>

In news:cI6Zg.142655$(E-Mail Removed),
Clayton Sutton <(E-Mail Removed)> typed:
> Hey everyone,
>
> We are running a Windows 2003 domain and Win2k and Win2k3
> workstations. I need a vbscript to add a domain acct. to the LOCAL
> Admin acct. to ALL of our workstations. Can anyone help by pointing
> me in the right direction where I can download that type of script?
>
>
> TIA,
>
>
> Clayton

You can either use restricted groups (see
http://www.jsifaq.com/SF/Tips/Tip.aspx?id=5319 for some help)

....or you could use a computer startup script assigned via group policy -
such as a simple batch file using
net localgroup Administrators DOMAIN\user_or_group /add

You could use the restricted user group gpo setting

computer configuration \ windows settings \ restricted groups

group = your group to be made local admins
member of = BUILTIN\Administrators

http://www.windowsecurity.com/articl...ed-Groups.html
http://www.microsoft.com/technet/pro...a15c18f6a.mspx
http://www.microsoft.com/resources/d...ictgroups.mspx

There is absolutely nothing that has to be done on the client side.

Create the gpo in the ou where the Computers reside (NOT the users), go to
computer configuration/windows settings/security settings/restricted groups,
right click on restricted groups and select new group (For the local
computers, this group name should be - administrators) and key in the group
you want auto populated. Select add on the Members of this group and then
add the members you want populated.


--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2003, 2000 (Early Achiever), NT

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

"Clayton Sutton" <(E-Mail Removed)> wrote in message
news:cI6Zg.142655$(E-Mail Removed). ..
> Hey everyone,
>
> We are running a Windows 2003 domain and Win2k and Win2k3 workstations. I
> need a vbscript to add a domain acct. to the LOCAL Admin acct. to ALL of
> our workstations. Can anyone help by pointing me in the right direction
> where I can download that type of script?
>
>
> TIA,
>
>
> Clayton
>

Howdie Clayton!

Clayton Sutton wrote:
> Where would I do it at?

I wrote an article about this:
http://www.frickelsoft.net/blog/?p=13

cheers,

Florian
--
Nachwuschsadmin aus dem Süddeutschen/Germany.
eMail: Vorname [bei] frickelsoft [Punkt] net.
blog: http://www.frickelsoft.net/blog.

There's a bunch of choices, as others have mentioned. Two are covered here:
-- http://www.msresource.net/content/view/45/47/


There's also CUSRMGR (resource kit I think).

--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net

How about "except" servers? What if I only want to do this to Workstations?
That way I can just setup an acct. for our help desk that they could use to
log into workstations but NOT be able to log into my servers!


Clayton



"Paul Williams [MVP]" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> There's a bunch of choices, as others have mentioned. Two are covered
> here:
> -- http://www.msresource.net/content/view/45/47/
>
>
> There's also CUSRMGR (resource kit I think).
>
> --
> Paul Williams
> Microsoft MVP - Windows Server - Directory Services
> http://www.msresource.net | http://forums.msresource.net
>
>
>

No problem. Scope and/ or filter the GPO to only apply to computers.

Also consider modifying the logon locally right on the servers in question
as by default a user can logon to a member server interactively.

--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net