Re: Local Administrators

From: Administrator (administrator_at_arciris.co.uk)
Date: 12/31/03

  • Next message: noir noir: "Re: Cryptography/Cryptanalysis" 
    To: "Van Meter, John" <John.VanMeter@ost.dot.gov>, <security-basics@securityfocus.com>
Date: Wed, 31 Dec 2003 11:37:24 -0000

    John:

    How about "net localgroup administrators" at a command prompt

    It doesn't include the local computername in the output, which is
    unfortunate, so I would recommend also running a "net config workstation"
    and capturing the output of both these commands to a file using
    commmand-line redirection.

    If your client machines are part of a windows domain, these commands might
    be embedded into a login script to execute on all client machines next time
    they log in. This login script could execute these two commands, and
    redirect the output to a common shared file on your network somewhere.
    Something like:

    net config workstation >> \\computer\share\filename
    net localgroup administrators >> \\computer\share\filename

    Its then just a matter of waiting for a couple of days (or however long
    needed to be sure all your client machines have logged out and in at least
    once) then collating the information in this common shared file (probably
    easier said than done)

    *** N.B. Bear in mind that to automate this task in this way does mean that
    the local user may be able to cheat the output: for the login script to be
    able to write to the file, the logged on user must have write permission to
    the file - if they were so inclinded, and if they realised what had been
    done, they may be able to track down the file, and maually edit it.

    I hope this helps.

    Kind regards.
    Duncan Gray

    ----- Original Message -----
    From: "Van Meter, John" <John.VanMeter@ost.dot.gov>
    To: <security-basics@securityfocus.com>
    Sent: Tuesday, December 30, 2003 10:46 AM
    Subject: Local Administrators

    Is there an easy way to find out what users are in the local admin group?
    The workstations are Win2k Pro SP4, I was thinking about using adduser from
    the resource kit, but it takes several lines of code to do it that way.

    Thank You
    John van Meter

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------

  • Next message: noir noir: "Re: Cryptography/Cryptanalysis"

    Relevant Pages

    • Re: How can I use my Expect script to login to multiple devices.
      ... I have a working login script (something like the below and shortened ... device, run the command, then when it exits to the unix prompt, log ... when you have the same commands to run for each device. ... then use the router login script to telnet into device. ...
      (comp.lang.tcl)
    • RE: Set home and temp path in Terminal Server
      ... These commands only work for the current window, ... There is also a Terminal Services home folder location in the Active Directory User Properties, if you need a different home folder when users logon to a TS than their normal home folder. ... the set commands in a login script and it doesn't work. ... after I've logged in and run the set commands, ...
      (microsoft.public.windows.terminal_services)
    • script question...
      ... Does anyone know the commands that are used or know where I can get information ... about creating a login script that would connect to a network share that contains a file, ... copy it to a specific directory and have it overwrite an existing file on the clients machine? ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Need to map drives for all users
      ... Typical job for a login script. ... for it is a sequence in a .bat of commands of form ... a one-time execution of the .bat ... > it without logging on as each individual user? ...
      (microsoft.public.windowsxp.security_admin)