[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Clean local admin group with multiple domains

Posted on 2008-06-23
6
Medium Priority
?
445 Views
Last Modified: 2012-05-05
Hello everyone. I received some help earlier with a script that cleans up local admininstrator. I am working on modifying it to do multiple domains rather just one.

I added strDomain = "lab" to part of the If statement. I was thinking that I could use this method with all domains. However,  the script hangs on the second domain. I am assuming that I cannot have multiple items with the same name.

Do I need to create different variables? Thank you for any assistance.
strDomain = "lab"
 
arrGroups = Array("domain admins","SMS administrators")
 
Set WshShell = WScript.CreateObject("WScript.Shell")
strPrefix = Left(WSHShell.ExpandEnvironmentStrings("%computername%"), 4)
 
For Each strGroup in arrGroups
	If strPrefix <> "USATL" And strDomain = "lab" Then
		Set objLocalGroup = GetObject("WinNT://./Administrators")
		strADGroup = "WinNT://" & strDomain & "/" & strGroup
		Set objADGroup = GetObject(strADGroup)
		objLocalGroup.Remove(objADGroup.ADsPath)
		LogItem "domain admins" & " and " & "SMS administrators" & " were removed from the local administrator group."
	End If
Next
 
strDomain = "lab2"
 
arrGroups = Array("domain admins","SMS administrators")
 
Set WshShell = WScript.CreateObject("WScript.Shell")
strPrefix = Left(WSHShell.ExpandEnvironmentStrings("%computername%"), 4)
 
For Each strGroup in arrGroups
	If strPrefix <> "USATL" And strDomain = "lab2" Then
		Set objLocalGroup = GetObject("WinNT://./Administrators")
		strADGroup = "WinNT://" & strDomain & "/" & strGroup
		Set objADGroup = GetObject(strADGroup)
		objLocalGroup.Remove(objADGroup.ADsPath)
		LogItem "domain admins" & " and " & "SMS administrators" & " were removed from the local administrator group."
	End If
Next

Open in new window

0
Comment
Question by:Lorrec
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
6 Comments
 
LVL 24

Accepted Solution

by:
purplepomegranite earned 2000 total points
ID: 21850943
I think first you need to explain your domain set-up.  Are you trying to run this in a forest that comprises several domains?  There is nothing particularly wrong with the script as far as variables go, though the attached does tidy it up a little.

If it is hanging on the second domain part, I would imagine it is hanging trying to query AD, which is why I am interested in the network set-up.  Have you tried fully qualified domains? e.g. lab.local, lab2.local
arrGroups = Array("domain admins","SMS administrators")
 
Set WshShell = WScript.CreateObject("WScript.Shell")
strPrefix = Left(WSHShell.ExpandEnvironmentStrings("%computername%"), 4)
 
strDomain = "lab"
For Each strGroup in arrGroups
        If strPrefix <> "USATL" Then
                Set objLocalGroup = GetObject("WinNT://./Administrators")
                Set objADGroup = GetObject("WinNT://" & strDomain & "/" & strGroup)
                objLocalGroup.Remove(objADGroup.ADsPath)
                LogItem "domain admins" & " and " & "SMS administrators" & " were removed from the local administrator group."
        End If
Next
 
strDomain = "lab2"
For Each strGroup in arrGroups
        If strPrefix <> "USATL" Then
                Set objLocalGroup = GetObject("WinNT://./Administrators")
                Set objADGroup = GetObject("WinNT://" & strDomain & "/" & strGroup)
                objLocalGroup.Remove(objADGroup.ADsPath)
                LogItem "domain admins" & " and " & "SMS administrators" & " were removed from the local administrator group."
        End If
Next

Open in new window

0
 

Author Comment

by:Lorrec
ID: 21856779
My plan was to deploy the script through SMS to each system for cleanup. I was originally going to make a separate package for each domain. However, I thought I could combine them into one.

My previous example was not very good. I will be removing different groups from each domain. Below is a better example.

Now, I get an error message. Microsoft VBScript compilation error: Invalid 'for' loop control variable. It is at For Each strGroup in arrGroups. I assume I am getting this because I using arrGroups twice with different values.
arrGroups = Array("domain admins","SMS administrators")
 
Set WshShell = WScript.CreateObject("WScript.Shell")
strPrefix = Left(WSHShell.ExpandEnvironmentStrings("%computername%"), 4)
 
strDomain = "lab1"
For Each strGroup in arrGroups
        If strPrefix <> "USATL" Then
                Set objLocalGroup = GetObject("WinNT://./Administrators")
                Set objADGroup = GetObject("WinNT://" & strDomain & "/" & strGroup)
                objLocalGroup.Remove(objADGroup.ADsPath)
 
arrGroups = Array("USMEC_Domain Administrator","PC_TECH_USMEC")
 
Set WshShell = WScript.CreateObject("WScript.Shell")
strPrefix = Left(WSHShell.ExpandEnvironmentStrings("%computername%"), 4)
 
strDomain = "lab2"
For Each strGroup in arrGroups
        If strPrefix <> "USMEC" Then
                Set objLocalGroup = GetObject("WinNT://./Administrators")
                Set objADGroup = GetObject("WinNT://" & strDomain & "/" & strGroup)
                objLocalGroup.Remove(objADGroup.ADsPath)
                
        End If
Next

Open in new window

0
 
LVL 24

Expert Comment

by:purplepomegranite
ID: 21856875
I still don't understand your domain setup.  Are these for domains in separate forests, or domains within the same forest?  If they are separate domains, they will require separate scripts.  Ideally you'd probably want different scripts anyway, as a computer can only be a member of one domain - just deploy the relevant script in each domain.

Your for.. error is probably because you are missing a Next for the first loop.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:Lorrec
ID: 21857021
Thank you for the response.

They are domains within the same forest. I was hoping that I could get the script to see that the system is in one of the domains and perform cleanup. It would ignore the other domains because they did not match the criteria. That was why I originally had  If strPrefix <> "USATL"  and strDomain = "lab" Then. I thought with this present it would be ignored if it did not match and proceed to the next cleanup.

Basically, a system would only need to do cleanup on one and ignore the rest. Is not possible for it to ignore the other domain if they do not match?  When I setup the script with the strDomain = "lab", it would on the match but hang on the others.



0
 
LVL 24

Expert Comment

by:purplepomegranite
ID: 21857393
I could probably modify the script to actually query the machine as to its domain, and then run whichever was the appropriate routine.  I'll have a look and post back a little later.
0
 

Author Closing Comment

by:Lorrec
ID: 31469955
Thank you for the assistance. I decided to go with one for each domain.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hello again, all.  For those of you that have been following along, you'll know that this is my third article on this topic (though it is not Part III).  This article is sort of remedial, and probably the topic with which I should have started the s…
I met Paul Devereux (@pdevereux) today when I responded to his tweet asking “Anybody know how to automate adding files from disk to a folder in #outlook  ?”.  I replied back and told Paul that using automation, in this case scripting, to add files t…
Video by: ITPro.TV
In this episode Don builds upon the troubleshooting techniques by demonstrating how to properly monitor a vSphere deployment to detect problems before they occur. He begins the show using tools found within the vSphere suite as ends the show demonst…
Want to learn how to record your desktop screen without having to use an outside camera. Click on this video and learn how to use the cool google extension called "Screencastify"! Step 1: Open a new google tab Step 2: Go to the left hand upper corn…

649 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question