Windows Forum

Ask something
Discussion Locked

DomainAdmin Rights without DomainAdmins

0 helpful
4 replies

by james richardson

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I would like to create a local group on our workstations, similar to LOCALMachine\Administrators with DOMAIN\Domain Admins as the group. Are there any tools that would acomplish this. I ideally then want to remove the majority of our 2ndline support from DOMAIN Admins and leave the core techies within.
Would the net group add command be of use here?
Any links or other ideas would be appreciated.

4 replies

by james richardson

Ok, having trawled through the and found this.. I now have the problem of doing it remotely. Here is a copy of the script.. I have 1200+ workstations to do this on, and so far it only works if I use individual wrkstn names. I would like to use something like a variable from a csv file of our network or a "for" command that works through the list of names? Any suggestions?

Copy of Script!

Dim DomainName
Dim UserGroup
Set net = WScript.CreateObject("WScript.Network")
local = "WORKSTATION" ******
DomainName = "DOMAIN"
UserGroup = "TEST01" 'replace it with yours Group Name

set group = GetObject("WinNT://"& local &"/Administrators")

on error resume next
group.Add "WinNT://"& DomainName &"/"& UserGroup &""
CheckError

sub CheckError
if not err.number=0 then
set ole = CreateObject("ole.err")
MsgBox ole.oleError(err.Number), vbCritical
err.clear
else
MsgBox "Done."
end if
end sub

by joseph moore

Ok, since you have the script ready to do this, and all you need is something that can run through a file list of machine names, try this BAT file:

@echo off
net view >systems.txt
for /f "tokens=1 skip=4 delims=\ " %%a in (systems.txt) do call scriptfile.exe %%a

All that does is it runs a NET VIEW to get the names of all machine names in your Windows domain. It pipes this info to the text file SYSTEMS.TXT

Then, the FOR statement parses the text file, extracts the machine name (removing the "\\" in front of each name), and saves that in the variable %a.
You have to use %% for variables in FOR statements in BAT files.
Once the %a variable contains the machine name, a CALL is done to the name of your script file, and it passes the machine name as a variable.
IF your script file were to run as a BAT file, in your script file you would then be working with %1 as the variable that equals each individual machine name.

hope this helps

This discussion is closed to new replies.