how do I add a global security group to the local administrators group?

Security

Collapse -

Use GPO

by A_L_E_X30 · 11 years ago In reply to how do I add a global sec ...

Tye to run this script within GPO and run it under computer start up script
This scripts are running under the system account and not under user rights
You are wellcome
Alex

Collapse -

Run the script as a startup, not login, script.

by Team503 · 11 years ago In reply to how do I add a global sec ...

When you run a script as a login script, it executes with the user's permissions set. IE, if the user is not a local or domain admin, this command will fail. However, if you run the script as a startup script, it will run within the context of the SYSTEM account (which has administrative access) and execute successfully.

You should create a new Group Policy Object, add the script to the Computer Settings section of the GPO, then apply the GPO to the OU(s) containing your computer accounts. The script will take effect at reboot.

That should resolve your issue.

Collapse -

PSTools

by rpugh6 · 9 years ago In reply to Run the script as a start ...

You can also download PSTools. You can run psexec with the "net -----" command line. This will let you push this to a list of machines, domain machines or an individual machine.

Collapse -

Reply on PSTools

by Grego1 · 9 years ago In reply to PSTools

Can PSTools also push a user to an individual machine? In the local admin group? or is there another way to do this.

Collapse -

Here is a simple vbs script

by john_e_wagner · 9 years ago In reply to Reply on PSTools

Add this as a startup group policy script.

'Script to add Admin Group to Local Admin Group
'John Wagner
'20061120
'
'Beginning Of the Script

On Error Resume Next

'get main objects/variables

Set ws = WScript.CreateObject ( "WScript.Shell" )
compname = ws.ExpandEnvironmentStrings ( "%COMPUTERNAME%" )
Set AdminGroup = GetObject ( "WinNT://" & compname & "/Administrators,group" )

'add domain groups to local admin group
AdminGroup.Add ( "WinNT://domain/Desktop_Admin,group" )
'End of the Script

Collapse -

well this seems to be nothing more than

by CG IT · 9 years ago In reply to Here is a simple vbs scri ...

allowing local machine admin rights for domain users. Using a Global Security group to set permissions for users to gain administrative access to the local machine doesn't seem such a good idea. That means that anyone that is a member of the global security group has admin access locally provided that other permissions do not conflict. If they do, the most restrictive apply.

Security

Question