Adding the local SYSTEM account to a local group

[scriptlin]

Hi all,

I'm tyring to limit the amount of people in my company who have access to fiddle with their Sophos AV clients. To do this, I've created a script which removes the ready-created "SophosAdministrator" group from local machines, and then recreating it with the members I deem fit.

(I'm using code as referenced in thread329-1255263).

The only problem I'm having is adding the local SYSTEM account for each machine to the group - it needs this for the on-access & scheduled scans. I'm guessing the cause is that the "NT AUTHORITY\SYSTEM" account isn't a "user", but a "built-in security principal".

Can anyone help with this?

Much appreciated...

 

[dm4ever]

Try this...

strComputer = "."
Set objLocalGroup = GetObject("WinNT://" & strComputer & "/Administrators,group")
objLocalGroup.add("WINNT://NT-AUTHORITY/SYSTEM")

--------------------------------------------------------------------------------
dm4ever
My philosophy: K.I.S.S - Keep It Simple Stupid

 

[scriptlin]

Thanks for replying, dm4ever.

Sadly, it hasn't worked, though.

Here's the affected piece of code:

Set objSophosLocal = GetObject("WinNT://" & strComputer & "/SophosAdministrator,group")
'If the local SYSTEM account isn't a member, make it one:
If Not objSophosLocal.isMember("WinNT://NT-AUTHORITY/SYSTEM") Then
	objSophosLocal.Add("WinNT://NT-AUTHORITY/SYSTEM")
	'If added, make a note if it in the output file:
	objTSout.WriteLine strComputer & ": Local SYSTEM account added to Sophos admin group"
	objTSout.Close
End If

I can't see any errors myself, so peer review might help!
Can anyone point me to any reference material which outlines how objects are referenced in the "WinNT://..." namespace (if that's the right term)?