Avatar of waltforbes
waltforbesFlag for Bahamas asked on

How to add domain group to a member server's local group using commandline, PowerShell, or scripting?

Points of My Scenario:


1. I must ensure a specific domain local Active Directory group is added to the local Administrators group of many member servers.


2. I must not use Restricted Groups or any other group policy option to accomplish  this task (for organization reasons).


3. I have a text file list of servers to work on.


4. I don't want to have to logon to each Windows server. I would like configure all servers from one logon session.


QUESTION: How can I add the domain local group to the local administrators group of  specified member servers using the command line, PowerShell, or related script?

PowershellActive DirectoryScripting Languages* commandlineWindows OS

Avatar of undefined
Last Comment
waltforbes

8/22/2022 - Mon
arnold

You can use psexec to go through each server running
Net localgroup /add administrators addomain\groupname

Using restricted group member off is the best way.

Powershell scripts using wmi connection that iterate through your server list...

The connection has to have the requisite rights to add, administer.
ASKER
waltforbes

I keep getting the error:
"NET LOCALGROUP
[groupname [/COMMENT:"text"]] [/DOMAIN]
              groupname {/ADD [/COMMENT:"text"] | /DELETE}  [/DOMAIN]
              groupname name [...] {/ADD | /DELETE} [/DOMAIN]"

I searched the command net localgroup to verify the syntax. Nothing works.

I am using a Windows Server 2008 R2 computer.
arnold

Net localgroup administrators /add addomain\groupname

This has to be in an elevated command window.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
ASKER
waltforbes

1. I am using only elevated command window
2. The Active Directory group I'm attempting to add is a domain-local group...
    Does that make a difference?
ASKER
waltforbes

The name of the AD group I am attempting to add:
1. has hypens
2. has underscores
3. is 36 characters long ('addomain' not included in this count of characters)

When I created 2 test AD groups (named globalgroup and dlgroup: global & domain local, respectively), it worked!

QUESTION: How do I get this command to work given the attributes of the AD group name?
==> NOTE: I am not allowed to change the group naming convention.
arnold

Surround the group name to be added in quotes.

net localgroup /add administrators "addomain\group-name"
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
arnold

ASKER
waltforbes

1. I tried the quotes (net localgroup /add administrators "addomain\group-name"): no success

2. I tried the PowerShell option: error = "Add-LocalGroupMember: The term 'Add-LocalGroupMember' is not recognized as the name of a cmdlet, function, script file, or operable program..."
ASKER
waltforbes

Additional Note: I tried the PowerShell option on Windows Server 2012 R2. I also tried the net localgroup on this 2012 R2 server.
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes
arnold

Do you get an error?

If you run
net localgroup administrators
It will list the members of the group.
ASKER CERTIFIED SOLUTION
oBdA

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
ASKER
waltforbes

Amazing! Works BEAUTIFULLY! I bow in thanks, oBdA!