Is it possible to write a script to go onto a domain login script that can create or disable local users on these domain machines.. (or just disable would do)

problem is, theres a redundant local user loginname, that details are getting round our userbase that people can use as "unrestricted" login.

as metioned previously.. as theres no way to disable the "logon to" box, its a bit of an issue.

all this is coz of our it manager who doesnt have a grip on it stuff, and gave us a mere 5 days to design and configure a std profile and group policy to be rolled out across our branches!

Download an evaluation copy of hyena

There's an MS resource kit tool - cusrmgr.exe - if you fancy doing some DOS stuff :-)

I started looking for that but couldn't be @rsed to dig round and find a copy of the reskit - so since I couldn't remember what it was called I left it. If you do find that Col, you can do something like:

for /f %i in (filename with list of machines.txt) do cusrmgr -xyz \\%i

and hit them all in one go. Hyena will do similar multiples though.

Can you not have:

NET LOCALGROUP /REMOVE

(Rough guess at syntax after looking at the help...)

in a batch file that gets run at login? (We have something similar here to make sure the techies are in the local admin groups on all PCs...)

Er - problem I see with login scripts is that the user logging in won't have permissions to disable other users, or if they're logging in as the user that needs removing, surely Windahs isn't gonna let you delete yourself?

Well... yes, that is a problem... Although eventually the user account in question would be removed from most machines...

Scripts get run here on all accounts to add people into the local admin group, so normal permissions must be bypassed somehow?

Also - Kix (http://www.kixtart.org/) gets used here as well, so that may elevate permissions??

Urm - if a user is a member of local admin they normally are able to add users with local admin rights that bypass security