I need to find who all users do not have Domain Admin rights on the computer.Some users remove the Domain Admin rights from the Administrator/Username.Please guide to to find a way who all have removed it or a way to give these rights remotely.
Sharath,
Another case for Hyena.
You can use it to 'push' the addition of any account (or User Group) to the local Administrator Group on the individual host.
If the account or group is already there, it will just continue to the next computer on the list.
It will also 'log' the activity and give you a report of the results.
Save this as FindAdmins.vbs and run it by double-clicking it.
The only piece that needs to be changed is
'LDAP://dc=fabrikam,dc=com - to match your domain...
On Error Resume Next
Const ADS_SCOPE_SUBTREE = 2
Dim objFSO:Set objFSO=CreateObject("Scripting.FileSystemObject")
Dim objOutput: Set objOutput=objFSO.CreateTextFile("C:\AdminReport.txt")
Set objConn = CreateObject("ADODB.Connection")
Set objCmd = CreateObject("ADODB.Command")
objConn.Provider = "ADsDSOObject"
objConn.Open "Active Directory Provider"
Set objCmd.ActiveConnection = objConn
objCmd.Properties("Page Size") = 1000
objCmd.Properties("Searchscope") = ADS_SCOPE_SUBTREE
objCmd.CommandText = _
"SELECT Name, distinguishedName FROM 'LDAP://dc=fabrikam,dc=com' " _
& "WHERE objectCategory='computer'"
Set objRS = objCmd.Execute
objRS.MoveFirst
Do Until objRS.EOF
Set objGroup = GetObject("WinNT://" & objRS.Fields("Name") & "/Administrators")
objOutput.WriteLine "Administrators on " & objRS.Fields("Name")
For Each objUser in objGroup.Members
objOutput.WriteLine vbTab & objUser.Name
End If
Next
objRS.MoveNext
Loop
objOutput.Close
Set objOutput=Nothing
Set objFSO=Nothing
11 appears to be...objCmd.Properties("Searchscope") = ADS_SCOPE_SUBTREE
This should be the full code...
'Start copying here...
On Error Resume Next
Const ADS_SCOPE_SUBTREE = 2
Dim objFSO: Set objFSO = CreateObject("Scripting.FileSystemObject")
Dim objOutput: Set objOutput = objFSO.CreateTextFile("C:\AdminReport.txt")
Set objConn = CreateObject("ADODB.Connection")
Set objCmd = CreateObject("ADODB.Command")
objConn.Provider = "ADsDSOObject"
objConn.Open "Active Directory Provider"
Set objCmd.ActiveConnection = objConn
objCmd.Properties("Page Size") = 1000
objCmd.Properties("Searchscope") = ADS_SCOPE_SUBTREE
objCmd.CommandText = _
"SELECT Name, distinguishedName FROM 'LDAP://dc=fabrikam,dc=com' " _
& "WHERE objectCategory='computer'"
Set objRS = objCmd.Execute
objRS.MoveFirst
Do Until objRS.EOF
Set objGroup = GetObject("WinNT://" & objRS.Fields("Name") & "/Administrators")
objOutput.WriteLine "Administrators on " & objRS.Fields("Name")
For Each objUser In objGroup.Members
objOutput.WriteLine vbTab & objUser.Name
Next
objRS.MoveNext
Loop
objOutput.Close
Set objOutput = Nothing
Set objFSO = Nothing
The Microsoft Server topic includes all of the legacy versions of the operating system, including the Windows NT 3.1, NT 3.5, NT 4.0 and Windows 2000 and Windows Home Server versions.
Another case for Hyena.
You can use it to 'push' the addition of any account (or User Group) to the local Administrator Group on the individual host.
If the account or group is already there, it will just continue to the next computer on the list.
It will also 'log' the activity and give you a report of the results.
Vic