Remove account from Administrators group via script

[Rick Corbett]

First, an apology. This is my first attempt at what I think (hope) may be a
cross-post. (I'm not that familiar with posting to newsgroups so please
don't flame me if I've done it incorrectly. I've tried posting to a single
newsgroup but haven't found the info I'm looking for... hence this first
attempt to post to multiple newsgroups at the same time. I understand this
is the 'proper' way to ask in various newsgroups, all at the same time,
rather than send the same query to individual newsgroups.)

Second - my problem...

Our cloned PC's include a 'Change Clone' script that lets our PC installers
change the IP address, subnet mask, gateway, computername and workgroup via
popup input boxes. So far, so good.

I need to add "remove the 'Windows User' account from the 'Administrators'
group' " to the "Change Clone" script. Up to now I've used AutoIt ('cos I
don't know any other way). It works but I realise it's a kludge.

Can anyone point me in the right direction, via a VBS/WMI (or whatever)
script, how I can remove a 'Windows User' account [Power User] from the
'Administrators' group and leave it as a Power User?

I've trawled the 'Google' group archives but can't find anything relevant
(we use Novell - not MS - so ADSI scripts aren't the answer).

PS - Is there a more appropriate newsgroup for queries about large-scale
setups and deployment than microsoft.public.windowsxp.setup_deployment?
I've seen so may queries re: individual users losing MS Product ID's, etc.
and wondered if there was a 'commercial/industrial/organisational' newsgroup
I would be better off following. I mean no disrespect to individual users
but some problems are different for larger-scale setups and deployment.

Any help would be greatly appreciated.

Rick

 

[Walter Schulz]

Can anyone point me in the right direction, via a VBS/WMI (or whatever)

script, how I can remove a 'Windows User' account [Power User] from the
'Administrators' group and leave it as a Power User?

Batch command:
net localgroup administrators <username> /del

Ciao, Walter

 

[Johan Arwidmark]

By using psexec from Sysinternals you can issue this command remote...

psexec \\<compname> net localgroup administrators <username> /del

Johan Arwidmark

Windows User Group - Nordic
http://wug.lutteman.se

Can anyone point me in the right direction, via a VBS/WMI (or whatever)
script, how I can remove a 'Windows User' account [Power User] from the
'Administrators' group and leave it as a Power User?

Batch command:
net localgroup administrators <username> /del

Ciao, Walter

 

[Ray at]

First, an apology. This is my first attempt at what I think (hope) may be a
cross-post. (I'm not that familiar with posting to newsgroups so please
don't flame me if I've done it incorrectly. I've tried posting to a single
newsgroup but haven't found the info I'm looking for... hence this first
attempt to post to multiple newsgroups at the same time. I understand this
is the 'proper' way to ask in various newsgroups, all at the same time,
rather than send the same query to individual newsgroups.)

Cross-posting is definitely preferred over multi-posting (where individual
messages with the same question to individual newsgroups). Cross-posting
usually isn't necessary, but if you're not sure where to post, as is the
case here, it's fine.

Second - my problem...

Our cloned PC's include a 'Change Clone' script that lets our PC installers
change the IP address, subnet mask, gateway, computername and workgroup via
popup input boxes. So far, so good.

I need to add "remove the 'Windows User' account from the 'Administrators'
group' " to the "Change Clone" script. Up to now I've used AutoIt ('cos I
don't know any other way). It works but I realise it's a kludge.

Can anyone point me in the right direction, via a VBS/WMI (or whatever)
script, how I can remove a 'Windows User' account [Power User] from the
'Administrators' group and leave it as a Power User?

Using standard shell scripting (like in .bat or .cmd files) you can do:

NET LOCALGROUP "Power Users" TheUsername /ADD
NET LOCALGROUP Administrators TheUsername /REMOVE


If the user executing this is the same user you're shifting around in these
groups, execute these commands in this order. I'm not sure without testing,
but if you first remove the user from the administratos group, the OS may
immediately see that and deny adding the user to the power users group.

Ray at home

 

[Walter Schulz]

By using psexec from Sysinternals you can issue this command remote...

psexec \\<compname> net localgroup administrators <username> /del

And by using Tip 4195 from www.jsiinc.com/reghack.htm it will be
executed on all workstations.

Ciao, Walter

 

[Rick Corbett]

I added:

oShell.Run "cmd /c NET LOCALGROUP Administrators " & """Windows User""" & "
/DELETE", 2, True

to the 'Change Clone' script and it worked like a dream.

Thanks all for the speedy responses and advice.

First, an apology. This is my first attempt at what I think (hope) may

be

a
cross-post. (I'm not that familiar with posting to newsgroups so please
don't flame me if I've done it incorrectly. I've tried posting to a single
newsgroup but haven't found the info I'm looking for... hence this first
attempt to post to multiple newsgroups at the same time. I understand this
is the 'proper' way to ask in various newsgroups, all at the same time,
rather than send the same query to individual newsgroups.)

Cross-posting is definitely preferred over multi-posting (where individual
messages with the same question to individual newsgroups). Cross-posting
usually isn't necessary, but if you're not sure where to post, as is the
case here, it's fine.

Second - my problem...

Our cloned PC's include a 'Change Clone' script that lets our PC installers
change the IP address, subnet mask, gateway, computername and workgroup via
popup input boxes. So far, so good.

I need to add "remove the 'Windows User' account from the 'Administrators'
group' " to the "Change Clone" script. Up to now I've used AutoIt ('cos I
don't know any other way). It works but I realise it's a kludge.

Can anyone point me in the right direction, via a VBS/WMI (or whatever)
script, how I can remove a 'Windows User' account [Power User] from the
'Administrators' group and leave it as a Power User?

Using standard shell scripting (like in .bat or .cmd files) you can do:

NET LOCALGROUP "Power Users" TheUsername /ADD
NET LOCALGROUP Administrators TheUsername /REMOVE


If the user executing this is the same user you're shifting around in these
groups, execute these commands in this order. I'm not sure without testing,
but if you first remove the user from the administratos group, the OS may
immediately see that and deny adding the user to the power users group.

Ray at home