Local Admin Help

[__LEE__]

Can someone please give me some advice.

I have been tasked with creating a group/user contained in the local admin group on each PC. This group needs to be a local group added to each PC if possible using AD to deploy the group/user.

This is to enable our first line staff local admin rights on each PC they visit for installing software etc.

We don't want the first line staff to have any rights on the Network through AD except doing password resets etc, which I have already delegated to them.

I need to find a way of adding this group locally onto each PC in the local Admin group either through AD or a seperate tool/script.

Any help would be gratefully received.

Lee.

[aldi]

Just to be clear... you want to add a domain group containing all your first line support staff to the local administrators group on each machine? Ibeleive you can use the 'Restricted Groups' computer policy, as per http://support.microsoft.com/?kbid=279301

The only problem with that is I think it removes anyone from that group that you haven't explicitly defined, so if you've got something set up on a machine running an app/service as a certain user thats in the local admins group, it might break it.

HTH

[__LEE__]

Thanks for that Aldi.

I think this would cause a lot of problems.

My manager would like me to try and achieve this using a policy in AD if possible or if not using a script/app.

So I need each local machine to have my firstline group in the Administrators local group.

I have tried to use the command: net localgroup test(OU) rial (name of group) /add mydomain /domain.

It comes back reporting it has connected to the domain but cannot find the user.

There is no such global user or group: test rial

System error 1317.

Thanks,

Lee.

[BliarOut]

Have you tried adding the user(or group) through the GUI interface, hit check names and then use that name in the syntax?

Just a thought.

[__Lee__]

BliarOut said:

Have you tried adding the user(or group) through the GUI interface, hit check names and then use that name in the syntax? Just a thought.

Thanks for the reply BlairOut.

I found the problem was if you are on a W2K Domain and and specify the domain switch with your domain in it, it does not work.

The switch is for only XP machines!, which is just silly!.

I spent most the day pulling my hair out!.

Just need to write a script now and test it.

There is a app you can get from MCSE World that does it for you but the boss wasn't very keen on using it.

[_DeeJay_]

__Lee__ said:

BliarOut said: Have you tried adding the user(or group) through the GUI interface, hit check names and then use that name in the syntax? Just a thought. Thanks for the reply BlairOut. I found the problem was if you are on a W2K Domain and and specify the domain switch with your domain in it, it does not work. The switch is for only XP machines!, which is just silly!. I spent most the day pulling my hair out!. Just need to write a script now and test it. There is a app you can get from MCSE World that does it for you but the boss wasn't very keen on using it.

How about using a machine startup script (set using group policy).

As you suggested, it should be as simple as using NET LOCALGROUP within that script.

As for names, the easiest way to avoid any confusion is to use a shortname for the domain group (as the net use command has a limit of 14 chars or something similar).

d

[__Lee__]

[redacted]