How to make domain User LOCAL ADMIN????

[fasolaomotomilola]

Hi All,

How can I configure GROUP POLICY to make domain users local administrator on their system.

Thank you.

 

[Roadki11]

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

 

[Cstorms]

Well I have a script that adds their domain user account but in order to do this I had to make the group of users I wanted to add to the domain admins group since this is the only group that gets prepopulated to the machines. I added them to the group for the 20 minutes it would take for them to show up and start their machines, ran the script in the background, removed their accounts...

Not the most amazing security ever for those 20 minutes but security through obscurity worked for my situation. Let me know if you want the script I used.

Cory

 

[fasolaomotomilola]

Thanks you Roadki11,

Cstorm, pls give me the script.

Thank you

 

[Cstorms]

I cant take credit for it but here it is..


Set objWshNet = CreateObject("WScript.Network")

' // ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
' // Configure basic script variables

strDomain = objWshNet.UserDomain
strComputer = objWshNet.ComputerName
Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators,group")


' // ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
' // Configure to add a domain user to the Local Administrators Group


strUser = objWshNet.UserName
Set objUser = GetObject("WinNT://" & strDomain & "/" & strUser & ",user")


' // ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
' // Configure to add a domain group to the Local Administrators Group

'strUser = "domaingrouphere'
'Set objUser = GetObject("WinNT://" & strDomain & "/" & strUser & ",group")


' // ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
' // We actually add the user or group here, if not already a member of the local
' // Administrators group:

If Not objGroup.IsMember(objUser.ADsPath) Then
objGroup.Add(objUser.ADsPath)
End If


Cory

 

[fasolaomotomilola]

Thank you bros,

I dont know scripting.

Kindly show me what to modify and how to apply it???

Thank you.

 

[Cstorms]

Well for this one, as long as the particular users are part of the domain admins group, simply running this on the client machine will add the logged in domain user account to the local admins group. Nothing comes up so you would need to verify that it worked, but that was kind of the point. What I did was just put the group of each set of users I needed at the time into the domain admins group for the limited amount of time, then immedialetly got rid of them after I was sure that this ran...

Remember in any real scenario this is a huge, gaping, security hole.

Cory