Active Directory 'Wild Cards'

[mitchell1981]

Hi,

 

Not sure if my title for this topic is appropriate as I have no idea what the name of the thing is that I want to ask about!

 

When setting up our profiles we use the '%username%' to ensure that the current username is used. I guess you could call this a wild card, but I suppose it has a proper name.

 

What I need to do is use group policy to add a local user (called admin) on all our machines to the local admins group. I know where to put this in the policy but I don't know the format to use. I guess it will be something like:

 

%localmachine%\admin

 

Can someone tell me if the %localmachine% is correct and if not, what it should be. Also, if anyone could provide a list of these 'wild cards' then that would be good too. They are impossible to search for on Google as it wipes out the % sign when you do a search!

 

Thanks for your help.

[plexer]

environment variables.

 

Ben

[mitchell1981]

Thanks!

 

That's good to know. I've found a list on Wikipedia now. Still not found the one I need but perhaps it doesn't exist. Will keep looking!

[Geoff]

Use %computername%. Additionally, open up a command prompt and type 'set'. That'll give you a list of all the environment variables available to you. If you want to do anything not covered by environment variables I suggest you look at VBS scripting using WMI.

[sidewinder]

What policy setting are you using to accomplish this, just out of interest?

[Geoff]

I expect he's using a startup script to run the net command locally. I do the same sort of thing to reset the local admin password on bootup.

[mitchell1981]

Thanks for the %computername% info. Will give it a try.

 

The policy I am using is:

 

computer configuration/windows settings/security settings/restricted groups/

 

I added the administrators group and then add the domain or local groups that I want to be a member of it. Seems to work well.

[alonebfg]

sorry to jump in here how would you do that i have been going round chainging all local password by hand every time and it is driving me mad i do it about once a month but it would be easer to use a script

[Geoff]

Create a batch file containing the following:

 

net user %COMPUTERNAME%\Administrator %1

 

Add the batch file into a GPO as a startup script. Set the parameter to be the password you want to use.

[alonebfg]

ah ok thank for that

[NetworkGeezer]

The %computername% may not be necessary for NET commands. Each command assumes you are referring to local accounts unless you add the AD domain prefix.

[Geoff]

I know, normally you add the /Domain parameter to the net user command to do operations on the domain. However the above is a hang over for when I had Win2k clients and had to have it work reliably for both those and XP clients.