Teh Tech » Login Script

How to Add and Remove a Local Account from a Group

admin — Tue, 27 Apr 2010 20:35:25 +0000

Occasionally you may need to add a local user account to the local administrators group for a software install or temporary maintenance. The following vbs script can be used to add the local ‘user1’ account to the local ‘administrators’ group. Any user can be added to any local group, change the red to match your needs. The computer name is pulled from the workstation dynamically so this is also completely portable and can be run on any computer.

Dim objComputer, objWSHNetwork, strComputerName, objUser, objGroup
Set objWSHNetwork = WScript.CreateObject(“WScript.Network”)
strComputerName = objWSHNetwork.ComputerName
Set objComputer = GetObject(“WinNT://” & strComputerName)
Set objGroup = GetObject(“WinNT://” & strComputerName & “/Administrators“)
Set objUser = GetObject(“WinNT://” & strComputerName & “/user1“)
objGroup.Add(objUser.ADsPath)
objUser.SetInfo

To use this through Kaseya save the above as user1addadmin.vbs and upload it to the server:

Script Name: Add user1 to admin group
Script Description: Adds the local user1 account to the local admin group
IF True
THEN
Write File
Parameter 1 : c:\temp\user1addadmin.vbs
Parameter 2 : admin\VBS\user1addadmin.vbs
OS Type : 0
Execute File
Parameter 1 : c:\WINDOWS\system32\wscript.exe
Parameter 2 : c:\temp\user1addadmin.vbs
Parameter 3 : 3
OS Type : 0
ELSE

It might also come up that you may need to remove a user from a local group. The following one line batch file can be run as a login script, batch file or ran as a shell command. It will remove the local ‘user1’ account from the local ‘administrators’ group. Again this will work for any user account and any group. Just change the red to match your needs.

net localgroup administrators user1 /delete

[ad]

Through Kaseya the following script would accomplish this:

Script Name: Remove the local user1 from admin group
Script Description: removes the local user1 account from the admin group.

IF True
THEN
Execute Shell Command
Parameter 1 : NET LOCALGROUP administrators user1 /delete
Parameter 2 : 1
OS Type : 0
ELSE

[ad]

Change your Power Options to ‘Always On’

admin — Wed, 24 Mar 2010 07:31:24 +0000

It is anoying as hell when you push out an update or a patch and a computer is off. This hopefully will limit this problem. Although it is impossible to keep a user from shutting down this will at least keep the computer from doing it on its own. This can be pushed in a batch file, or deployed as part of a login script for rollouts, and of course through kasyea. Note this will only work on windows xp sp2 or higher.

Batch or login script:

powercfg /setactive “always on”

Kaseya

Script Name: Power Option – Always on

Script Description: Turns the computers power configuation to the ‘always on’ setting

IF True

THEN

Execute Shell Command

Parameter 1 : powercfg /setactive “always on”

Parameter 2 : 1

OS Type : 0

ELSE

[ad]

Inserting a Wait in a Batch File, Using Netstat in a Login Script

admin — Fri, 12 Mar 2010 16:50:33 +0000

So you want to pause a batch file for a few seconds. Unfortunately windows doesn’t provide a very simple way of doing this. I wanted to run ‘netstat -b’ 25 seconds after a user logged into their computer as to give the computer enough time to start up all background applications. But, there is no wait function in batch files. Well I found a workaround. If you use the ‘-n’ argument with the ping command you can specify the amount of time to run a ping for. Thus ping -n 60 127.0.0.1 will ping your local host for 60 seconds. This will more or less keep the batch file at a standstill for a specified number of seconds before continuing. In my case I used it for a pause in a login script.

echo off
title login script
color 1f
set name=%computername%
ping -n 25 127.0.0.1
echo %computername% >> g:\%name%.log
date /T >> g:\%name%.log
time /T >> g:\%name%.log
netstat -b >> g:\%name%.log
echo *********************************************** >> g:\%name%.log
echo *********************************************** >> g:\%name%.log
echo *********************************************** >> g:\%name%.log
echo *********************************************** >> g:\%name%.log
echo *********************************************** >> g:\%name%.log

In this script the ‘G’ Drive is a mapped drive for administration. When a user logs in they will open the log stamp it with their computer name, the date and the time. Then the netstat output, followed by a few lines of asterisks to separate the uses visually. I have an OU with this script applied to it. If I suspect a user is doing something sketchy I add them to this OU, to do a little snooping.

[ad]