VB script to add local a/c's from workstations/servers in to group policies

Below is the screen shots for the  local policies and a/c's
screenshots.docx

Hi,
The first part is easy via vbscript!
The second part is not actually possible (via vbscript anyway). EE already has an answer to a similar request here

OK, a bit of further investigation has found that it can be done, but you need a tool called ntrights.exe which comes with the server 2003 resource kit, available here. Download the file, install it, then copy out the ntrights.exe file (it works as a standalone program, so you can uninstall the rest of the tools if you like)

With this file you can run a command line that will add a user to those policy groups
The ntrights.exe can be located on a server somewhere in a location that all PC's have access rights to, or you can copy it locally to the PC

Using this command, you can also just add the entire administrators group to the appropriate policies if you like, to save searching for individual users in the local admin group.

The commands you would need to use are:

Add individual user to the "Deny access to this computer from the network"
ntrights.exe +r SeDenyNetworkLogonRights -u username

Add administrator group to "Deny access to this computer from the network"
ntrights.exe +r SeDenyNetworkLogonRights -u administrators

Add individual user to the "Deny logon through Terminal Services"
ntrights.exe +r SeDenyRemoteInteractiveLogonRight -u username

Add administrator group to the "Deny logon through Terminal Services"
ntrights.exe +r SeDenyRemoteInteractiveLogonRight -u administrators


If you would like to add individual users to the policy, then we can do a script for that, but this won't catch any new users that get added to the admin group, unless you run this command on a frequent basis (so its better to add the administrators group to the policy, unless this doesn't work for your purposes)

The above commands can be run from either a batch file or vb script

Hi Thanks alot for your help.

We would not be blocking the administrators group as it's necessary to have an access to them when logging in remotely for any troubleshooting. It's the requirement to block the local admin users only. Also we cannot disable the local admin accounts, as we need it for catastrofic situations(Like DC is unavailable and we have 0 cached credentials for servers defined)

Installing and copying the NTrights.exe would not be a problem to the Servers and workstations.

Is it possible to club the first part and the second part (I am not a scripter but out of my  current situation i am sharing my inputs)
1. Identifying the local admin user accounts and track the number(4 e.g.) of users that are present in administrators group.
2. for each count execute the following
    { take the username1 and verify if it is already added to the "Deny login through Terminal services" policy if not add it with the below command
       ntrights.exe +r SeDenyNetworkLogonRights -u username1
       take the username1 and verify if it is already added to the "Deny access this computer from the network" policy if not add it
       ntrights.exe +r SeDenyNetworkLogonRights -u username1
     }
   Count++

If this can be achieved, then I can push this vbscript thorugh GPO and next time when the system boots the script will enumerate the number...so if it is added by 1 or 2 counts the loop will add the newly added users into the gpedit.msc

Thanks again for your help and support.

This shouldn't be a problem. If the user is already specified in the GP, then they won't be added a second time, so we don't need to worry about checking for that first.
I will throw something together for you over the weekend and post it Monday(hopefully!)

Thanks alot for your extended help and support.

Hi one of my team member has come up with a script below. You may fine tune this script.
===========================================================

Set myFSO = CreateObject("Scripting.FileSystemObject")
Set WriteStuff = myFSO.OpenTextFile("Out.txt", 8, True)
Set oFSO    = CreateObject("Scripting.FileSystemObject")
Set wshShell = CreateObject("WScript.Shell")




'PF= wshShell.ExpandEnvironmentStrings("%PROGRAMFILES(x86)%")
SourceLoc="C:\"

if oFSO.FileExists(SourceLoc & "ntrights.exe") then
'Do nothing
else
oFSO.CopyFile "\\WIN2008\shared\ntrights.exe", SourceLoc

'oFSO.CopyFile "C:\Program Files (x86)\ntrights.exe", SourceLoc
'wscript.echo "Copying Source"

 end if

strComputer = wshShell.ExpandEnvironmentStrings( "%COMPUTERNAME%" )
'WScript.Echo "Computer Name: " & strComputer

Set colGroups = GetObject("WinNT://" & strComputer & "")

colGroups.Filter = Array("group")
For Each objGroup In colGroups
'WriteStuff.WriteLine(objGroup.Name)
If objGroup.Name="Administrators" Then
For Each objUser in objGroup.Members
        'Wscript.Echo vbTab & objUser.Name
      
      WriteStuff.WriteLine(vbTab & objUser.Name)
      Policy(objUser.Name)
    Next
End if
Next

WriteStuff.Close


Function Policy(DomainUser)

Set objShell = WScript.CreateObject("WScript.Shell")
Set objExec = objShell.Exec("C:\ntrights -u " & DomainUser & " -m server1 +r SeDenyNetworkLogonRight")
Set objExec = objShell.Exec("C:\ntrights -u " & DomainUser & " -m server1 +r SeDenyRemoteInteractiveLogonRight")
Do
    line = objExec.StdOut.ReadLine()
    s = s & line & vbcrlf
Loop While Not objExec.Stdout.atEndOfStream

End Function

========================================================================
The only thing is this is enumerating all the local admin users(including domain\user)...Whereas I need to enumerate only<Server/Workstation>\user. it should not be a domain user.

Also i think NTrights.exe doesnt support "Deny this computer from Terminal Services" on windows 2000 OS versions...and client does have Windows 2000 servers as well... however "Deny access this computer from the Network" is supported but wanted to check with you on this.

Also is it possible for this script to search for a local DC(Set l) and then use the Sysvol share to copy the NTrights.exe from there. This is just to avoid the network issues and remote copying from a file server.

Thanks a ton for your excellent tip of NTRights.exe...we are almost there...

Hi Please check the above script from your end as I tested it today morning but it is not editing the users to the respective policies....It is copying the exe from the shared location but not going through...I was being told that it was working till yesterday night.

Thanks

my bad...I edited the script for correct server name and it worked(Now editing the script to take the machine name automatically)....but the only problem is now that it's adding the domain\user or domain\groups as well...I really want to get rid of all except the <Servername>\user...

Also if the script can check the current  logon server(DC) and then later I can put the NTRights into sysvol or any other shared location...


Thanks alot

Hi Roopesha,
Sorry, didn't see your script until this morning so mine is slightly different. Just have a couple of questions first...
1. Do you want to read in a list of PC names from a text file, as stated in your original question, or are you just going to run this script on every computer? (via a domain GPO for example) - your above script does not take PC names from a txt file.

2. Do you really want to be copying the ntrights file to every PC? If you send this script out as a GPO PC startup script, you can put the ntrights file in the sysvol with the script  and run it from there, without copying it down.

You are correct, "Deny logon through Terminal Services" will not work on Windows 2000 - see here for a list of the commands that will work for W2k

You can use the following two lines to get your logon server name:
       Set myEnv = CreateObject("WScript.Shell").Environment("PROCESS")
       MsgBox myEnv("LOGONSERVER")

Here's what I have so far...
It will only add local user admins to the policy, not domain users
Change line 2 to reflect the location of the file with the list of PC's in it

Set fso = CreateObject("Scripting.FileSystemObject")
Set input = fso.OpenTextFile("c:\temp\servers.txt", 1, False)

While Not input.AtEndOfStream
	strComputer = input.ReadLine
	Set colGroups = GetObject("WinNT://" & strComputer & "")
	colGroups.Filter = Array("group")
	For Each objGroup In colGroups
		If LCase(objGroup.Name) = "administrators" Then
			For Each objUser In objGroup.Members
				strUserPath = Mid(objUser.aDSPath, 9)
				arrUserBits = Split(strUserPath, "/")
				If UBound(arrUserBits) = 2 Then
					'We have a local admin user
					strUserPath = arrUserBits(1) & "\" & arrUserBits(2)
					'Add them to the local policies
					Set objShell = WScript.CreateObject("WScript.Shell")
					Set objExec = objShell.Exec("C:\temp\ntrights.exe -u " & strUserPath & " -m " & strComputer & " +r SeDenyNetworkLogonRight")
					Set objExec = objShell.Exec("C:\temp\ntrights.exe -u " & strUserPath & " -m " & strComputer & " +r SeDenyRemoteInteractiveLogonRight")
				End If
			Next
		End If
	Next
Wend

input.Close
Set fso = Nothing
wscript.echo "Finished"

Select allOpen in new window

Thanks alot Scott,

Answer 1:I just want to run this script on every computer? (via a domain GPO). It should take the Computer name automatically as the script is run.

Answer 2: I was thinking to copy NTRights.exe to the local system from the Sysvol folder if in case its deleted from the system either due to system being imaged or some other reason, however your option makes more sense to me if we have both Script and NT rights saved in the Sysvol it should work. However I am not sure how to achieve it...do you make changes in the script to look for the NTRights.exe to look into Sysvol and run it from there or how would that be?

Question 1; Could you please also let me know if I can push this Script as a Logon script. The problem is that we have arround 1000+ Servers and the startup script would need to reboot the server for the script to run. As far as Desktops and Laptops are concerned they can be rebooted often, not the case with Servers. So in case the Local admin removes the permission(Logging in Locally) it will require to run this script again and Servers wont be rebooted so often..Will it be possibe to run the script under system account when a domain user is looged in. With the logon script the script would run under user's context and if the user is not the local admin it would fail to run. I also dont find VBscript to be runas under some domain admin credentials and using encoder to encode/hide the password. It might not be safe and the client would not agree...So any suggestions on this as well would be appreciated.

Hi Scott,

I think we will be going with the Startup Script as the servers will be patched regularly so they would be rebooted in any case so the script will be applied.

Second We will be copying the NTRights.exe from the \\logonserver\Sysvol to the C:\ and run it from the local system under systems account. This also rules out any permissions issues to run the exe from the sysvol share.

Please help in modifying the scripts accordingly.

This is exactly what I am trying to do:

Script should:

1.      Check for the NTRights.exe in a local c:\ or c:\program files(x86) and (x64) both.. I would prefer the c:\ so that this is available on all the windows machines.
2.      If its there it will execute the script to enumerate the local admin usersfrom the administrators group and add those enumerated users into GPEDIT.msc.
3.      If its not there in the c:\ it will check the logon server details(DC) and there will be either that Logon server available or else it is not available.
4.      If the logon server is available it will copy the NTRights.exe from the \\LogonServer\Sysvol and execute the script to enumerate the users and add them to the GPEDIT.msc.
5.      If the Logon server not available(user logged in with cached credentials) exit the script..do nothing.

We need to push this script through GPO using startup script so please help me in scripting the above 5 things...Please also consider that every time the system boots it needs to identify the newly added users to the local administrator and it should add those users as well. Also the Script needs to run under system account so it should run accordingly..

Thanks Scott for your valuable time in helping me in this.

Hi Roopsha,
I'll start by answering your questions:
1. You can configure this in line 1 of the code in case you change your mind at a later date
2. See script below
3 - 5. Because you are running it as a computer startup script, there is no logonserver defined (as this happens at user logon). Therefore you need to define the server location of the file in line 2 of the script. You could locate the ntrights file in the same place as this script in the GPO files location.

To distribute and run, create a new GPO, edit Computer configuration > Policies > Windows Settings > Scripts > Startup
Click the show files button and copy the script and ntrights files here. Edit the script at line 2 to point to this location.
This should resolve any permission issues

local_ntrights = "C:\"
server_ntrights = "\\server\path\ntrights.exe"

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set wshNetwork = WScript.CreateObject( "WScript.Network" )

strComputer = wshNetwork.ComputerName

'Check if ntrights file exists on local PC
If objFSO.FileExists(local_ntrights) then
	'continue with script
Else
	'check it's on the server, then copy it down to PC
	If objFSO.FileExists(server_ntrights) Then
		objFSO.CopyFile server_ntrights, local_ntrights
	Else
		wscript.quit
	End If
End If

Set colGroups = GetObject("WinNT://" & strComputer & "")
colGroups.Filter = Array("group")
For Each objGroup In colGroups
	If LCase(objGroup.Name) = "administrators" Then
		For Each objUser In objGroup.Members
			strUserPath = Mid(objUser.aDSPath, 9)
			arrUserBits = Split(strUserPath, "/")
			If UBound(arrUserBits) = 2 Then
				'We have a local admin user
				strUserPath = arrUserBits(1) & "\" & arrUserBits(2)
				'Add them to the local policies
				Set objShell = WScript.CreateObject("WScript.Shell")
				Set objExec = objShell.Exec(local_ntrights & "ntrights.exe -u " & strUserPath & " -m " & strComputer & " +r SeDenyNetworkLogonRight")
				Set objExec = objShell.Exec(local_ntrights & "ntrights.exe -u " & strUserPath & " -m " & strComputer & " +r SeDenyRemoteInteractiveLogonRight")
			End If
		Next
	End If
Next

Select allOpen in new window

Thanks a ton Scott...I will try this and let you know about the outcome.

Hi Scott I tried it and it worked fine, however it required two reboots...the first one added only few users but not all...the second reboot added all...Any idea why this could be happening..Is it possible to have all the users in a single reboot...Though my purpose would be solved by this...but just in case if we can..

Also can I also add the "power users" group as well.

Also I see multiple command prompts flashes for a second. Can it be suppressed.

This is what you can help me to look into.

1. It needs two reboots to have all the users added in the GPedit.msc. Any specific reason why this needs 2 reboots of the server. I see the NTRights is copied to the C:\ and few users are added to the policies. When I do another reboot it does add the other missing users.

2. The multiple command prompts flashes for a second. Is it possible to suppress it.

3. I am not that keen on Power users group as I have'nt got any requirement on this from the client..But just in case if I needed to add "is it possible". Though not required at this point in time.

Hi,
The issue was that the commands were executing too quickly on top of each other, so now it will wait until one command has finished before executing the next (lines 34,36)
If this doesn't work, we may have to put a sleep command in to make it wait longer, although not all versions of Windows support sleep.

I've tried several different ways to suppress the prompt but have been unsuccessful - this may be a limitation of the ntrights command, rather than the command promt that it runs in (I've tried using START /MIN to no avail)

In order to do the same for the power users group, you just change administrators (line 24) to Power Users

local_ntrights = "C:\"
server_ntrights = "\\server\path\ntrights.exe"

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set wshNetwork = WScript.CreateObject( "WScript.Network" )

strComputer = wshNetwork.ComputerName

'Check if ntrights file exists on local PC
If objFSO.FileExists(local_ntrights) then
	'continue with script
Else
	'check it's on the server, then copy it down to PC
	If objFSO.FileExists(server_ntrights) Then
		objFSO.CopyFile server_ntrights, local_ntrights
	Else
		wscript.quit
	End If
End If

Set colGroups = GetObject("WinNT://" & strComputer & "")
colGroups.Filter = Array("group")
For Each objGroup In colGroups
	If LCase(objGroup.Name) = "administrators" Then
		For Each objUser In objGroup.Members
			strUserPath = Mid(objUser.aDSPath, 9)
			arrUserBits = Split(strUserPath, "/")
			If UBound(arrUserBits) = 2 Then
				'We have a local admin user
				strUserPath = arrUserBits(1) & "\" & arrUserBits(2)
				'Add them to the local policies
				Set objShell = WScript.CreateObject("WScript.Shell")
				strExeCommand = local_ntrights & "ntrights.exe -u " & strUserPath & " -m " & strComputer & " +r SeDenyNetworkLogonRight"
				objShell.Run "cmd.exe /c " & Chr(34) & strExeCommand & chr(34) & Chr(32) ,1,True
				strExeCommand2 = local_ntrights & "ntrights.exe -u " & strUserPath & " -m " & strComputer & " +r SeDenyRemoteInteractiveLogonRight"
				objShell.Run "cmd.exe /c " & Chr(34) & strExeCommand2 & chr(34) & Chr(32) ,1,True
			End If
		Next
	End If
Next

Select allOpen in new window

Thanks alot Scott...It worked in a single reboot itself...

I must say you are really a champ in Scripting and Helping lot of people like me in trouble. God Bless you..

Hey no problem, thats what we're here for !

Please remember to close off the question and assign points once you are happy with an answer.
Enjoy the weekend!
S.

I am just keeping it open for some time as I am awaiting to hear the feedback on the pilot machines to be pushed...

Thanks alot and I will not forget to rate it for sure..

I've requested that this question be closed as follows:

Accepted answer: 0 points for roopesha2's comment #37634871

for the following reason:

This is Awesome and it really has the technical expertise at par.....

Thanks a ton...

Can you help me to make it to 500 points...