How to script adding global groups to local groups on multiple computers

Posted on 2006-04-05
Last Modified: 2008-02-01
Hello everyone.

I'm not scripting expert like most of you in here and thus could use your help.

I'm trying to add a domain global group and several other user accounts to the the local administrators group on several servers.  I know how to add one group to one server using the command below.

net localgroup administrators domain\group /add

This works great.  My question is how would I word a script/batch file to do that plus several other domain groups and users and then be able to apply that to a list of servers?

Let me know if you need further explanation.  I would prefer a solution using some form of script and not group policy.


Question by:mkbean
    LVL 17

    Assisted Solution

    Open up Notepad and use that command several times to add each group you are wanting to add.  Just put each one on a separate line.  When you are finished, save the file as Whatever.bat and make sure you change the "Save as type" from Text to All Files.

    Now you should have an automated batch file that will add the groups to whatever computer it is run on.

    Then create a Group Policy Object with Active Directory Users and Computers.   In the "Computer Configuration" section go to Windows Settings>scripts>Startup and add the batch file you just created.

    You can then change the security permissions on the GPO to only apply to the computers you are wanting it to touch.
    LVL 23

    Expert Comment

    LOL, I was all ready to say use Restricted Groups in Group Policy (since you can add groups and users without disrupting the existing ones in the local admins group), which is much easier, then I saw your final statement.

    But like Eagle6990 said, so the script would look something like:

    @echo off
    net localgroup administrators domain\group /add
    net localgroup administrators domain\username /add
    net localgroup administrators domain\group#2 /add
    net localgroup administrators domain\username#2 /add

    Note like Eage said, you have to apply it to the Compuer Configuration section in GP, not the User configuration.
    LVL 23

    Expert Comment

    oops...I should read just want to run the script to apply it remotely to a list of servers, right?

    LVL 9

    Assisted Solution

    You can use the net localgroup /add command in conjuntion with psexec (  Psexec allow you to run the command on the remote machine and have your output piped back to you from wherever you're running the command.
    LVL 23

    Accepted Solution

    Here's a script for you (I'm not that great, but it should do):


    On Error Resume Next

    Const ForReading = 1

    Set objFSO = CreateObject("Scripting.FileSystemObject")
    Set objTextFile = objFSO.OpenTextFile("c:\scripts\servers.txt", ForReading)

    Do Until objTextFile.AtEndOfStream
        strComputer = objTextFile.Readline

        ' =====================================================================
        ' =====================================================================

                      Set oLocalGroup = GetObject("WinNT://" & strComputer & _
                Set oDomainUser1 = GetObject("WinNT://DOMAIN/TESTUSER,user")
                                    Set oDomainUser2 = GetObject("WinNT://DOMAIN/TESTUSER2,user")
                                    Set oDomainGroup1 = GetObject("WinNT://DOMAIN/TESTGROUP1,group")
                                    Set oDomainGroup2 = GetObject("WinNT://DOMAIN/TESTGROUP2,group")
                On Error Resume Next
                On Error Goto 0
        ' =====================================================================
        ' End
        ' =====================================================================




    What this will do is take the input from c:\scripts\servers.txt (put each server in a separate line)

    then it will get the local Admins group

    then it will add the 2 user accounts and the 2 groups to the local admins group of the server, then move on to the next server in servers.txt

    Let me know if that works for you.

    LVL 23

    Expert Comment

    Thanks for the points...glad the script worked for you.

    Featured Post

    Highfive + Dolby Voice = No More Audio Complaints!

    Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

    Join & Write a Comment

    It is a known fact that servers reach the end of their lives. Some get there quicker than others, based on age, manufacturer, usage and several other factors. However, if your organization has spent time deploying Microsoft's Active Directory server…
    by Batuhan Cetin In this article I will be guiding through the process of removing a failed DC metadata from Active Directory (hereafter, AD) using the ntdsutil tool in a Windows Server 2003 environment. These steps are not necessary in a Win…
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

    729 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now