Re: Remove domain user from local administrators group

From: Micheal Patterson (micheal_at_tsgincorporated.com)
Date: 10/13/04

  • Next message: Paul Aviles: "Remote connections" 
    To: "chang zhu" <cyz2000@yahoo.com>, <focus-ms@securityfocus.com>
Date: Wed, 13 Oct 2004 13:44:27 -0500

    ----- Original Message -----
    From: "chang zhu" <cyz2000@yahoo.com>
    To: <focus-ms@securityfocus.com>
    Sent: Tuesday, October 12, 2004 10:17 AM
    Subject: Remove domain user from local administrators group

    > Hi,all
    >
    > I just went to this new company and found out that
    > each domain user is assigned to local administrators
    > group.
    >
    > We need to remove domain user from local
    > administrators group. Is there any MS utility that
    > allows to do this instead of going to each workstation
    >
    > to remove and assign them to Power Users group?
    >
    > The environment is Win2K and XP.
    >
    > Thanks always,
    >
    > Chang
    >
    > __________________________________________________
    > Do You Yahoo!?
    > Tired of spam? Yahoo! Mail has the best spam protection around
    > http://mail.yahoo.com
    >

    I would think that a login script containing the net localgroup directive
    would help here.

    The syntax of this command is:

    NET LOCALGROUP [groupname [/COMMENT:"text"]] [/DOMAIN]
                  groupname {/ADD [/COMMENT:"text"] | /DELETE} [/DOMAIN]
                  groupname name [...] {/ADD | /DELETE} [/DOMAIN]

    As an example, what I've added in the past to "add" certain users and groups
    to another group:

    net localgroup administrators "mydomainname\Domain Admins" /ADD
    :end

    This should be just as easy to run to remove someone:

    net localgroup administrators "mydomainname\Domain Users" /delete
    :end 

    --
Micheal Patterson
Senior Communications Systems Engineer
405-917-0600
Confidentiality Notice:  This e-mail message, including any attachments,
is for the sole use of the intended recipient(s) and may contain
confidential and privileged information. Any unauthorized review, use,
disclosure or distribution is prohibited. If you are not the intended
recipient, please contact the sender by reply e-mail and destroy all
copies of the original message.
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Paul Aviles: "Remote connections"

    Relevant Pages

    • Re: User type
      ... This does help Mike - thanks ... > If the computer is member of domain then you should use domain user ... > After you have this account and group created you can write a short script ... > administrator and make your users local administrators. ...
      (microsoft.public.windows.server.setup)
    • Re: desktop level support
      ... You can delegate any domain user the right to add workstations to the ... the Organizational Unit [NOT domain or you will add to administrators group ... Assuming your computers are SP4 you can user ...
      (microsoft.public.win2000.security)
    • Re: Workaround for 0x8007045A (!)
      ... client machine but does not run on a domain user account of the same machine. ... This seems to me to mean that SBS ... but if you put that in the Administrators ...
      (microsoft.public.windowsupdate)
    • Re: Domain Users with Administor Rights to XP
      ... Add the Domain Users group to the Administrators group on each workstation. ... I need> them to login to any Windows XP Pro workstation with a NT> 4.0 Domain account. ... How can I> automaticly make every domain user have administrator> rights on XP workstations. ...
      (microsoft.public.windowsxp.security_admin)
    • Re: where is that policy that prevents the administrator hiding??
      ... First off, if at all possible, you want to prevent regular users from being members ... difficult to restrict them - particularly as local administrators. ... There are many Group policy settings to restrict users. ...
      (microsoft.public.win2000.security)
    Loading