Login Script

[scott]

I'm trying to add the current user (member of DOMAIN USER GROUP) to the
LOCAL ADMINISTRATORS group with below code in FIGURE 1, but get error in
FIGURE 2.

Do I need to add any extra credentials?


FIGURE 1

Net Localgroup Administrators "mydomain\myUser" /Add


FIGURE 2

System error 5 has occurred.
Access is denied.

 

[Oli Restorick [MVP]]

You're very close. If you do this from a user login script, the user is not
likely to have the required permissions to make the change.

What you need to do is to use Group Policy to run this as a computer startup
script. This runs in the context of the machine and it will work nicely.
Use "net" as the command and the rest of the string as the parameter.

I would, however, recommend that you create a group (e.g. "Workstation
Admins") and make this a member of the local group and make the user a
member of the "workstation admins" group.

Regards

Oli

 

[scott]

Can you write the "net" syntax and where to put the parameter? I'm confused.

 

[Deji Akomolafe]

the variable is %username%. So your syntax would be:

net localgroup administrators yourdomainname\%username% /ADD

That would add ANY user that logs into the computer into the administrators'
group IF you are using Machine Startup Script through a GPO as suggested by
Oli. This may be something you want to do in a controlled fashion.

You can set a day when you will tell your users "if you want to get admin
rights on your computer, please reboot your computer at 10 am tomorrow and
log back in, etc, etc". Then you will enable this policy at, say, 9am on
that date and take it off at 11am.

--


Sincerely,

Dèjì Akómöláfé, MCSE+M MCSA+M MCP+I
Microsoft MVP - Directory Services
www.readymaids.com - we know IT
www.akomolafe.com
Do you now realize that Today is the Tomorrow you were worried about
Yesterday? -anon

 

[Herb Martin]

the variable is %username%. So your syntax would be:

net localgroup administrators yourdomainname\%username% /ADD

That would add ANY user that logs into the computer into the administrators'
group IF you are using Machine Startup Script through a GPO as suggested by
Oli. This may be something you want to do in a controlled fashion.

Sorry, this will not work as expected.

At the time that a Computer Startup Script runs, there is
NO user and the %username% variable is holds no value.

 

[Deji Akomolafe]

Ah, you are correct. Missed that

--


Sincerely,

Dèjì Akómöláfé, MCSE+M MCSA+M MCP+I
Microsoft MVP - Directory Services
www.readymaids.com - we know IT
www.akomolafe.com
Do you now realize that Today is the Tomorrow you were worried about
Yesterday? -anon

 

[scott]

what about a group instead of a user?

what would that look like syntax wise?

 

[Herb Martin]

what about a group instead of a user?

what would that look like syntax wise?

Let's go back to your original request and consider
what you really wish to accomplish:

I'm trying to add the current user (member of DOMAIN USER GROUP) to the
LOCAL ADMINISTRATORS group with below code in FIGURE 1, but get error in

IF someone should be a member of the Local Admistrators
group then YOU (or a script on the DCs) should be adding
them to the appropriate group.

This isn't appropriate for a Startup or Logon script.
(The user cannot add himself nor can the computer startup
add a user who has not yet logged onto the computer -- as
discussed above)

If ALL users should be Admins of ALL machines (which
is essentially what you were really going to allow -- If
I COULD log onto a machine you were going to make me
an Admin -- then just do that by making such a group or
assigning the Domain Admins.

Although I see this, and the original request, as poor
practice, you likely also will likely also recognize this
when stated as such.

We could build a Startup script that would do this IF
you can identify the users who work at each machine.

 

[scott]

My goal is to have a user account just be a member of "DOMAIN USERS" but
still be a "LOCAL ADMINISTRATOR".

Basically, I'd want the user to be able to install/uninstall programs on
their PCs.

Do you have a better suggestion?

 

[Oli Restorick [MVP]]

As understood the question, Scott wanted a particular user (I'm assuming a
helpdesk person) to not be a member of "Domain Admins", but to be able to be
an administrator of workstations. If so, a computer startup script is a
perfectly reasonable way of achieving a perfectly reasonable thing.

Perhaps I'm misreading the question.

Oli

 

[Oli Restorick [MVP]]

Sorry -- I did indeed miss "the current user" in the original question.

Scott, what you're trying to do is not a good practice. What you may want
to consider doing, though, is to add the "INTERACTIVE" group (users logging
in at the console) to the local administrators group.

The following command will do this and must be done either manually or
through a computer startup script. Users, of course, will not have the
required permissions to make the change.

net localgroup administrators interactive /add

This will mean that any user who logs into such a machine will be an
administrator of that box, but they will not be able to do administrative
tasks to other machines across the network.

Hope this helps

Oli

As understood the question, Scott wanted a particular user (I'm assuming a
helpdesk person) to not be a member of "Domain Admins", but to be able to
be an administrator of workstations. If so, a computer startup script is
a perfectly reasonable way of achieving a perfectly reasonable thing.

Perhaps I'm misreading the question.

Oli

 

[Herb Martin]

My goal is to have a user account just be a member of "DOMAIN USERS" but
still be a "LOCAL ADMINISTRATOR".

You are making ALL users essentially admins of every
workstations so why not just ASSIGN (restricted group)
Domain Users to Computer: Administratos.

It is a terrible practice, I don't recommend it, but it is
essentially equivalent to your intention to make them
an admin just for logging on.

Basically, I'd want the user to be able to install/uninstall programs on
their PCs.

Generally ordinary users CAN install ordinary software
UNLESS the software is dangerous (drivers, services,
old crappy programs that violate good security practices.)

Do you have a better suggestion?

Install software through GPO->Compuer->Software
IF you have or can build an MSI file for it.

Have the Startup script for the computer do such installs
IF you have no MSI but can FULLY automate the install.

What specific software will not install for the Users?

Making users Power Users or reducing security with the
CompatWS.inf template (through Group Policy) might
be sufficient to solve the problem.

 

[scott]

where does the COMPUTER ADMINISTRATORS group reside?

 

[scott]

If userA is a member of DOMAIN USERS and is a LOCAL ADMINISTRATOR to userA's
box, how can userA get access to other PCs on the network?

I'm just trying to limit regular users to only access his own pc and just
certain network shared folders on a server. I do want them to be able to do
anything to their own pc.

i'm really getting confused. i've never heard of the INTERACTIVE group
before.

if you can give more guidance, i'd appreciate you staying with me on this.

 

[Herb Martin]

where does the COMPUTER ADMINISTRATORS group reside?

On the individual Computers, it is the Administrators group.

I believe it is the group you to which you have been trying
to add the current User.

The more I think about it, adding Interactive (Oli's idea) to
this group does (almost exactly, not quite) what you original
asked.

It's still a bad idea, but it accomplishes you stated goal.

 

[Herb Martin]

If userA is a member of DOMAIN USERS and is a LOCAL ADMINISTRATOR to userA's
box, how can userA get access to other PCs on the network?

I'm just trying to limit regular users to only access his own pc and just
certain network shared folders on a server. I do want them to be able to do
anything to their own pc.

But any user can walk up to any PC, logon, and
become the Admin there, so you really have no
effective limitation.

Oli's idea at least REQUIRES them to physically
logon (or TS etc) to the machine in question.

 

[scott]

Where is the INTERACTIVE group located? I can't find it.

 

[Herb Martin]

Where is the INTERACTIVE group located? I can't find it.

It is a Special Group -- you should be able to find it
in most any group list.

Special Groups are those "automatic" groups such as
Everyone, Authenticated Users, TS Users, Dialup, etc.