Solved

Need a batch file to create local admin account and place that account is the Administrators group.

Posted on 2013-06-18
9
7,386 Views
2 Endorsements
Last Modified: 2013-06-24
Would like this batch created in notepad, and then to rename with the extension .bat, so that it will become a batch file. Need it to do the following:

1. Create local admin account, and place in the Administrator group.
2. Password must be set to never expire.
3. Need a description added to the account as "Local Admin"
4. Need to prompt the local admin to change password, upon initial login with the default password.
2
Comment
Question by:rtangaccurate
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
9 Comments
 
LVL 84

Expert Comment

by:oBdA
ID: 39258494
Not fully possible, sorry. "Must change password at logon" and "Password never expires" are mutually exclusive. You can either force the new admin to change his password on the logon and then set the "Password never expires" option himself, or set the "Password never expires" option in the script and tell the new admin to change his password after logon.
@echo off
setlocal
set NewAdmin=LocalAdmin
set NewPassword=Password123
set NewComment=Local Admin
net.exe user "%NewAdmin%" "%NewPassword%" /add /comment:"%NewComment%" /logonpasswordchg:YES
net.exe localgroup Administrators "%NewAdmin%" /add
REM *** If the next line is executed, it will disable the "Must change password" option ("/logonpasswordchg:YES"), because these two are mutually exclusive.
REM wmic.exe useraccount WHERE "Name='LocalAdmin'" SET PasswordExpires=FALSE

Open in new window

1
 

Author Comment

by:rtangaccurate
ID: 39261460
i ran the script but it did not work. so lets just have it run without prompting to change password, but rather set the password to never expire. please write the batch script and attach it back to me.

set the admin to be Randy Wang
Password, set to P@ssw0rd
set the description to be Local Admin

Giving you max point for doing this. Please attach notepad file back. Thank you.
0
 
LVL 84

Expert Comment

by:oBdA
ID: 39261555
@echo off
setlocal
set NewAdmin=RandyWang
set NewPassword=P@ssw0rd
set NewComment=Local Admin
echo Creating user account '%NewAdmin%' ...
net.exe user "%NewAdmin%" "%NewPassword%" /add /comment:"%NewComment%"
echo Adding '%NewAdmin%' to local administrators ...
net.exe localgroup Administrators "%NewAdmin%" /add
REM *** If the "wmic.exe" line is executed, it will disable the "Must change password" option ("/logonpasswordchg:YES" in "net user /add"), because these two are mutually exclusive.
echo Setting password of '%NewAdmin%' to never expire ...
wmic.exe useraccount WHERE "Name='%NewAdmin%'" SET PasswordExpires=FALSE

Open in new window

0
NEW Veeam Agent for Microsoft Windows

Backup and recover physical and cloud-based servers and workstations, as well as endpoint devices that belong to remote users. Avoid downtime and data loss quickly and easily for Windows-based physical or public cloud-based workloads!

 

Author Comment

by:rtangaccurate
ID: 39264730
This is great! I like the fact that it leaves existing accounts "As-is", and does not overwrite them. How can I push this out to all servers in my environment through GPO? Or can I push it out to all my servers without using GPO?
0
 
LVL 84

Expert Comment

by:oBdA
ID: 39265352
You can use a GPO startup script (http://technet.microsoft.com/en-us/library/cc779329(v=ws.10).aspx), which means the account will only be available once the server has rebooted), or use psexec (http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx). Create a list "Computernames.txt" (with a test computer in it first, and the server names if everything works OK) and use tis script (adjust "C:\Temp" and "NewUser.cmd" to whatever you're using):
@echo off
setlocal
for /f %%a in ('type "C:\Temp\Computernames.txt"') do (
	echo Processing %%a ...
	copy "C:\Temp\NewUser.cmd" "\\%%a\Admin$"
	psexec.exe \\%%a "C:\Windows\NewUser.cmd"
	del "\\%%a\Admin$\NewUser.cmd"
)

Open in new window

0
 

Author Comment

by:rtangaccurate
ID: 39267033
Can you modify the batch file to include Randy Wang under "Full Name"? I wont bother you anymore, after this. I will give the points you deserve. Thanks again.
0
 
LVL 84

Expert Comment

by:oBdA
ID: 39267225
@echo off
setlocal
set NewAdmin=RandyWang
set NewPassword=P@ssw0rd
set NewComment=Local Admin
set NewFullName=Randy Wang
echo Creating user account '%NewAdmin%' ...
net.exe user "%NewAdmin%" "%NewPassword%" /add /comment:"%NewComment%" /fullname:"%NewFullName%"
echo Adding '%NewAdmin%' to local administrators ...
net.exe localgroup Administrators "%NewAdmin%" /add
REM *** If the "wmic.exe" line is executed, it will disable the "Must change password" option ("/logonpasswordchg:YES" in "net user /add"), because these two are mutually exclusive.
echo Setting password of '%NewAdmin%' to never expire ...
wmic.exe useraccount WHERE "Name='%NewAdmin%'" SET PasswordExpires=FALSE

Open in new window

1
 

Author Comment

by:rtangaccurate
ID: 39267284
It did not add the Full Name.
0
 
LVL 84

Accepted Solution

by:
oBdA earned 500 total points
ID: 39267889
Which error(s) did show up?
Note that the script will not add the full name to an existing account, it will just set the full name when a new account is created. To add the full name to an existing account, all you need is
@echo off
setlocal
set NewAdmin=RandyWang
set NewFullName=Randy Wang
echo Adding full name 'NewFullName' to user account '%NewAdmin%' ...
net.exe user "%NewAdmin%" /fullname:"%NewFullName%" 

Open in new window

0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Merging text files strings with filename 18 57
Script to move computer from one domain to another 6 54
Powershell- Registry HIVE 6 63
script to read text file 34 34
Batch, VBS, and scripts in general are incredibly useful for repetitive tasks.  Some tasks can take a while to complete and it can be annoying to check back only to discover that your script finished 5 minutes ago.  Some scripts may complete nearly …
In threads here at EE, each comment has a unique Identifier (ID). It is easy to get the full path for an ID via the right-click context menu. However, we often want to post a short link within a thread rather than the full link. This article shows a…
In this fourth video of the Xpdf series, we discuss and demonstrate the PDFinfo utility, which retrieves the contents of a PDF's Info Dictionary, as well as some other information, including the page count. We show how to isolate the page count in a…
In this fifth video of the Xpdf series, we discuss and demonstrate the PDFdetach utility, which is able to list and, more importantly, extract attachments that are embedded in PDF files. It does this via a command line interface, making it suitable …

710 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question