Making Domain Users Local Administrators

[dspent]

How can I add the group DOMAIN USERS to the LOCAL ADMINISTRATORS group on all workstations?

[keilamym]

you can use the restricted groups option in the group policy, or use "net localgroup" administrators /add "adgroupname"

keilamym

[dspent]

so in order to use this in an autoit3 script how do I code this...?

I know extremely little about scripting. Just what I pick up from this forum.

[ZenKensei]

I'm not able to test it right now but you may be able to use something like:

RunWait ( @Comspec & ' /C Net localgroup administrators "Domain Users" /add' )

If you try this and it doesn't work let me know and I will work on it tomorrow when I'm on a network.

Z/K

[dspent]

Thanks a million.....to both of you.

Zen...It works without a hitch.

One more question though....once it runs, if the domain users group is already added how do I skip this step?

[keilamym]

as a batch file

NET LOCALGROUP ADMINISTRATORS /ADD "DOMAIN USERS"

works great.

I'll have to work on the scripting part

[keilamym]

oh cool... somebody posted it already.. i went home for the day

[redndahead]

My suggestion is go with restricted groups. You will have an easier time removing it when you need to. If you need help doing this feel free to ask.

red

[keilamym]

i'd have to agree...

if workstations on sp3, the restricted groups policy overwrites local settings. in sp4, this option is appended.

good luck

[redndahead]

i'd have to agree...

if workstations on sp3, the restricted groups policy overwrites local settings. in sp4, this option is appended.

good luck

hmm..my workstations are on SP4 and they are still overwritten.

red

[keilamym]

redndahead

thanks for the info.. this was supposed to be changed in sp4 but i guess microsoft didn't get to it. we're still on sp3