i missed the bit about removing non allowed users from the local administrator group.

here is some code to help you out [Smile]

code:
$allowed_admins = "administrator, @userid"

;get a listing of all members of the local administraotr group
$localadminusers = groupmembers("@domain/@wksta","Administrators",18)

;get a connection to the localadmin group
$localadmingroup = getobject("WinNT://@domain/@wksta/administrators,group")


for each $admin in $localadminusers
	if instr($allowed_admins,$admin.name) = 0
		;a user has been found that is not in the $allowed_users list,
		;and will now be removed.

		? "Removing " + $admin.name + " from " + $localadmingroup.name
		;to make this code work, you will have to uncomment the following line.
		;$localadmingroup.remove($admin.adspath)
	endif
next
this code needs the UDF GroupMembers()

Bryce

[ 04 April 2002, 03:57: Message edited by: Bryce ]