IT Employment

Ask something
Discussion Locked

Active Directory dilemma

0 helpful
1 reply

by timmitchell 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hey folks, help me out here. I've been tasked with 2 issues and I'm stumped.

I've got to add a global group (support personnel) to the local administrators group on 4000 Windows 2000 client machines. I have no interest in doing this manually oneach one of the 4000 machines, and I know there's a way to automate this.

Also, I would like to change the local administrator password on all those same machines. I've found that AD will allow changing the local administrator account name, but nothing about remotely changing the password for that account.

I don't have SMS, so I'll have to use AD's native features to complete these tasks. I'm sure that I can configure a GPO to accomplish this, but I can't find it anywhere. Any suggestions?

thanks.....

1 reply

by chris_beegle

Walk in the park. Create a text file list with the machine names, in the format of:
machine1
machine2
call it machlist.txt(or whatever)
Create another 1 line batch file, please if you are running NT4 or Win2k don't call it .bat! Call it .cmd.
for /f %%i in (machlist.txt) do @
cusrmgr -m \\%%i -u "domain_name\domain admins" -alg administrators & cusrmgr -m \\%%i -u administrator -P gnupassword

The cusrmgr is part of the Win2k Reskit. This should bring the Donkey Kong hammer to a few thousand.

You can also get fancy with exception processing: IE:

for /f %%i in (machlist.txt) do @ call :machine_slam
goto :eof

cusrmgr -m \\%1 -u "domain_name\domain admins" -alg administrators || ECHO %1 Cornholed >> Errorlog.log
cusrmgr -m \\%1 -u administrator -P gnupassword || ECHO %1 Cornholed >> Errorlog.log

This discussion is closed to new replies.