How to script adding global groups to local groups on multiple computers

Posted on 2006-04-05
Medium Priority
Last Modified: 2008-02-01
Hello everyone.

I'm not scripting expert like most of you in here and thus could use your help.

I'm trying to add a domain global group and several other user accounts to the the local administrators group on several servers.  I know how to add one group to one server using the command below.

net localgroup administrators domain\group /add

This works great.  My question is how would I word a script/batch file to do that plus several other domain groups and users and then be able to apply that to a list of servers?

Let me know if you need further explanation.  I would prefer a solution using some form of script and not group policy.


Question by:mkbean
  • 4
LVL 17

Assisted Solution

Eagle6990 earned 400 total points
ID: 16382263
Open up Notepad and use that command several times to add each group you are wanting to add.  Just put each one on a separate line.  When you are finished, save the file as Whatever.bat and make sure you change the "Save as type" from Text to All Files.

Now you should have an automated batch file that will add the groups to whatever computer it is run on.

Then create a Group Policy Object with Active Directory Users and Computers.   In the "Computer Configuration" section go to Windows Settings>scripts>Startup and add the batch file you just created.

You can then change the security permissions on the GPO to only apply to the computers you are wanting it to touch.
LVL 23

Expert Comment

ID: 16383519
LOL, I was all ready to say use Restricted Groups in Group Policy (since you can add groups and users without disrupting the existing ones in the local admins group), which is much easier, then I saw your final statement.

But like Eagle6990 said, so the script would look something like:

@echo off
net localgroup administrators domain\group /add
net localgroup administrators domain\username /add
net localgroup administrators domain\group#2 /add
net localgroup administrators domain\username#2 /add

Note like Eage said, you have to apply it to the Compuer Configuration section in GP, not the User configuration.
LVL 23

Expert Comment

ID: 16383577
oops...I should read better...you just want to run the script to apply it remotely to a list of servers, right?

Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.


Assisted Solution

by:Jeff Beckham
Jeff Beckham earned 200 total points
ID: 16383815
You can use the net localgroup /add command in conjuntion with psexec (http://www.sysinternals.com/Utilities/PsExec.html).  Psexec allow you to run the command on the remote machine and have your output piped back to you from wherever you're running the command.
LVL 23

Accepted Solution

TheCleaner earned 1400 total points
ID: 16384067
Here's a script for you (I'm not that great, but it should do):


On Error Resume Next

Const ForReading = 1

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTextFile = objFSO.OpenTextFile("c:\scripts\servers.txt", ForReading)

Do Until objTextFile.AtEndOfStream
    strComputer = objTextFile.Readline

    ' =====================================================================
    ' =====================================================================

                  Set oLocalGroup = GetObject("WinNT://" & strComputer & _
            Set oDomainUser1 = GetObject("WinNT://DOMAIN/TESTUSER,user")
                                Set oDomainUser2 = GetObject("WinNT://DOMAIN/TESTUSER2,user")
                                Set oDomainGroup1 = GetObject("WinNT://DOMAIN/TESTGROUP1,group")
                                Set oDomainGroup2 = GetObject("WinNT://DOMAIN/TESTGROUP2,group")
            On Error Resume Next
            On Error Goto 0
    ' =====================================================================
    ' End
    ' =====================================================================




What this will do is take the input from c:\scripts\servers.txt (put each server in a separate line)

then it will get the local Admins group

then it will add the 2 user accounts and the 2 groups to the local admins group of the server, then move on to the next server in servers.txt

Let me know if that works for you.

LVL 23

Expert Comment

ID: 16395905
Thanks for the points...glad the script worked for you.

Featured Post

Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This may not be a text book method to resolve VSS backup issues but it seemed to have worked on few of the Windows 2003 servers we had issues while performing a Volume Shadow Copy backup. If you have issues while performing a shadow copy backup usin…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
this video summaries big data hadoop online training demo (http://onlineitguru.com/big-data-hadoop-online-training-placement.html) , and covers basics in big data hadoop .
Look below the covers at a subform control , and the form that is inside it. Explore properties and see how easy it is to aggregate, get statistics, and synchronize results for your data. A Microsoft Access subform is used to show relevant calcul…

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question