I need some help here folks, in order to save a visit to more than 500 desktop computers.

I need to remove through some kind of dos batch file the "Domain Users" AD group from the local desktop "administrators" group.

At the same time, I need to add a specific AD security group to the same desktop local "administrators group".

The desktops all run XP, and all users run a login script.

I have found this vbscript, but dont know what to change to make it work, or how to execute it.

Dim strLocalAdminGroup 
Dim strComputer 
Dim remadmins 

Set WshShell = Wscript.CreateObject("Wscript.Shell") 
Set WshSysEnv = WshShell.Environment("SYSTEM") 
Set WshUserEnv = WshShell.Environment("User") 
Set WshProEnv = WshShell.Environment("Process") 

strComputer = WshProEnv("COMPUTERNAME") 
remadmins = array("DomainName\UserID","Everyone") 
strLocalAdminGroup = "Administrators" 


For i = lbound(remAdmins) to ubound(remAdmins) 
Set grp = GetObject("WinNT://" & strComputer & "/" & strLocalAdminGroup) 
member = "WinNT://" & remAdmins(i) 
if grp.Ismember(member) = True then 
grp.Remove(member) 
end if 
next

I'm not very good at scripting but I've just had a look at that script and I can't guess what to change either. Just found another script online and I'm just testing it to see if I can make it work and post a solution

Can you not just use the 'net localgroup' command? Try 'net help localgroup'. In conjunction with a FOR loop and a text file with all the workstation names it should be able to do that.

You'll need to run the script with admin privileges though, whatever method you use.

OK, this script works for removing the group, let's worry about the adding seperately and then try to converge them.

Save the following into a .vbs file:

Set objNetwork = WScript.CreateObject("WScript.Network")

Set objGroup = GetObject("WinNT://" & objNetwork.ComputerName & "/Administrators,group")

DNPath = "WinNT:///Domain Users"

On Error Resume Next

If objGroup.IsMember(DNPath) Then objGroup.Remove(DNPath)

On Error Goto 0

Set objGroup = Nothing

set objNetwork = Nothing

Use group policy to apply this to the computers on the network as a startup script (under Computer Configuration). This is important because if you run it as a logon script it won't run administratively and therefor won't work. I'll have a look into adding the other group now and repost once I've got a working solution.

Loops? Workstation names??

Use AD for what it was built to do, managing your domain!

I'll give that a go on Monday using doing a quick test before running it across the whole domain.

Two things:

1. Shouldn't the group name in the script at DNPath = "WinNT:///Domain Users" say "Domain Admins"?

2. How should he do this task using AD then? (I wish I knew something about AD - my expertise ended with domains)

I think the loop in the first script is to remove anybody from the local admins group.

PS does he need to run the script with cscript or will it just run if put in as a startup script?

Two things:

1. Shouldn't the group name in the script at DNPath = "WinNT:///Domain Users" say "Domain Admins"?

Nope, mannyo's post said he wanted to remove "Domain Users" and add "Domain Admins"

This script just deals with removing, I'm just testing the adding now.

2. How should he do this task using AD then? (I wish I knew something about AD - my expertise ended with domains)

I think the loop in the first script is to remove anybody from the local admins group.

PS does he need to run the script with cscript or will it just run if put in as a startup script?

Already posted above but you'd run the .vbs script using a Group Policy Object. When setting up a GPO there are two ways to execute a script, one is under User Configuration and will run as the User. In this case I guess it doesn't matter as "Domain Users" are in the local Adminstrators group and so they'll have admin rights, but it's better practise to run it under Computer Configuration as a Startup script as that way it will be run administratively anyway.

User Configuration = runs as the user and is dependant on their user privs

Computer Configuration = runs before logon and is run administratively, therefore generally much better to do configuration tasks

No need for cscript.

HTH

OK, adding groups is pretty simple by switching things around in the original removal script.

Set objNetwork = WScript.CreateObject("WScript.Network")

Set objGroup = GetObject("WinNT://" & objNetwork.ComputerName & "/Administrators,group")

DNPath = "WinNT:///Domain Admins"

On Error Resume Next

If Not objGroup.IsMember(DNPath) Then objGroup.Add(DNPath)

On Error Goto 0

Set objGroup = Nothing

set objNetwork = Nothing

Tested and works for me. Let me know if you have any trouble running/implementing them and I'll try to help where I can