Local Admin Rights

[IanT]

Hi Guys,

 

Just had a IT Meeting at a client site and we need to take away local admin rights from all users, now I'm not too keen on going round every desktop and laptop doing this, I am sure I've seen it where on the server side you can take away local admin rights when the user logs on?

[ChrisH]

You want to look at restricted groups in the relevant GPOs.

[IanT]

Just found a VBscript which runs at logon and removes the user from Local Administrator Group.

 

Testing now....

[mac_shinobi]

Just found a VBscript which runs at logon and removes the user from Local Administrator Group.

 

Testing now....

 

Beat me to it haha

[Ignatius]

Just found a VBscript which runs at logon and removes the user from Local Administrator Group.

When you've tested it (and confirmed that it works!), can you post it for my "little black book of useful scripts"?

[mac_shinobi]

delete/remove users from local administrators grou

 

should help - create a dummy local admin user and test

 

' computer name or ip address
sNode = "."

' suppress errors
On Error Resume Next

' group name to remove user from
Set oGroupAdm = GetObject("WinNT://" & sNode & "/Administrators")

' loop through all members of the Administrators group
For Each oAdmGrpUser In oGroupAdm.Members

' get the name and make it lowercase
sAdmGrpUser = LCase(oAdmGrpUser.Name)

' Leave administrator and Domain Admins alone
' use lowercase letters in the names in the If statement!
If (sAdmGrpUser <> "administrator") And (sAdmGrpUser <> "domain admins") Then
msgbox oAdmGrpUser.Name
' remove users from Administrators group
oGroupAdm.Remove oAdmGrpUser.ADsPath
End if
Next

If you leave the sNode variable as sNode = "." that will tell it to select the computer it is on when it runs ( sort of like a localhost or 127.0.0.1 ) kind of thing.

 

The rest of the script should take care of removal of local admin rights as long as the users are not the administrator or domain admins as per this line

 

If (sAdmGrpUser <> "administrator") And (sAdmGrpUser <> "domain admins") Then

So if your local admin accounts are named something else then you may want to amend the above mentioned line to suit your needs

 

Just found this script which is an improvement

 

Option Explicit 
 
Dim network, group, user 
Set network = CreateObject("WScript.Network") 
Set group = GetObject("WinNT://" & network.ComputerName & "/Administrators,group") 
For Each user In group.members 
If UCase(user.name) <> "ADMINISTRATOR" And UCase(user.name) <> "DOMAIN ADMINS" Then 
group.remove user.adspath 
End If 
Next                       

Edited August 13, 2009 by mac_shinobi

[strawberry]

you can use msba to check who is in the admin group to double check your work.

[mac_shinobi]

you can use msba to check who is in the admin group to double check your work.

 

msba ?

[DMcCoy]

When building images create one (or more) groups in AD, Add this group to Local Administrators, then simply add/remove users from this group. Not quite so useful in more individual environments, but good for schools if you only have a few types of machine (admin/student/teaching etc). It's also handy for running services as a local admin.

[IanT]

Once I've fully tested it and happy with it, I will let ya all know.

[mac_shinobi]

Once I've fully tested it and happy with it, I will let ya all know.

 

The 2nd script I posted would be better to use as a startup script but will leave the first one there for you to try but linked to the web page where I found the scripts etc

[maniac]

You can control membership of the local administrators group through Group policy. We do it this way, and have two domain groups - one called local administrators and one called local power users which are automatically added to their respective group on the local machine when group policy is applied.

 

We can then add and remove staff from these groups, and it changes their permission on the local machine.

 

Mike.

[pete]

msba ?

 

mbsa - Download details: Microsoft Baseline Security Analyzer 2.1 (for IT Professionals)

[mac_shinobi]

mbsa - Download details: Microsoft Baseline Security Analyzer 2.1 (for IT Professionals)

 

Obviously with not knowing about it - how does that util / app help and what does it allow you to do ?

[rh91uk]

Or, you could simply run this batch script at startup, if you wanted it to be removed for everyone in a particular group:

 

net localgroup administrators DOMAIN\GROUP /remove

 

Maybe try:

 

net localgroup administrators DOMAIN\%username% /remove

 

That will work too! Will remove the current username from that group.

[SYNACK]

Obviously with not knowing about it - how does that util / app help and what does it allow you to do ?

 

A Review of Microsoft Baseline Security Analyzer: A Free Tool to Examine the Security Settings of a Computer

Microsoft Baseline Security Analyzer is a tool intended for IT administrators, managing small to medium sized networks. The application scans a specified computer or group of computers for security vulnerabilities. It measures the parameters of the system or systems against the guidelines set down by Microsoft.

The advantage of using the MBSA, apart from accurately assessing and discovering potential security lapses, is the coordination it has with the other Microsoft security tools.

 

Full setup review in the link with screenshots.

[strawberry]

Obviously with not knowing about it - how does that util / app help and what does it allow you to do ?

 

itscans remote machines and compares them to either your standards or the pre defined ms standards, one of which is how many local admins the machine has and who they are.