#207902 - 2013-10-09 04:37 PM
Re: Add user to local admins group and also connect to SQL database...
[Re: Thrasonic]
|
Glenn Barnas
KiX Supporter
Registered: 2003-01-28
Posts: 4403
Loc: New Jersey
|
There are UDFs to connect to SQL that work well - I'd use those. I assume you have some type of table that matches computers with authorized local admins. You can also use a simple INI file, something like [AUTHORIZED]
computer1=joe,mary
Computer2=tom,harry
computer3=jane
Here's some sample logic using the INI file, run during logon (assuming everyone's a local admin):; Get a list of auth admins for this computer
; can be gathered from SQL or an INI file as desired
; The 'Allowed' list should begin and end with a comma, and be comma-delimited
$Allowed = ',' + ReadProfileString('\\server\share\ladmins.ini', 'AUTHORIZED', @WKSTA) + ','
If InStr($Allowed, ',' + @USERID + ',')
'User is allowed as admin!' @CRLF
$Cmd = '%COMSPEC% /c '
$Cmd = $Cmd + ' Net LocalGroup "Administrators" "Domain Users" /delete >>groupadd.log'
Shell $Cmd
$Cmd = '%COMSPEC% /c '
$Cmd = $Cmd + 'Net LocalGroup "Administrators" ' + @USERID + ' /add >>groupadd.log'
Shell $Cmd
EndIf
Glenn
_________________________
Actually I am a Rocket Scientist! 
|
|
Top
|
|
|
|
|
#207931 - 2013-10-21 10:14 PM
Re: Add user to local admins group and also connect to SQL database...
[Re: Thrasonic]
|
Glenn Barnas
KiX Supporter
Registered: 2003-01-28
Posts: 4403
Loc: New Jersey
|
Well, it would be either-or.. Use SQL or use an INI. the INI solution is easier and uses only built-in Kix commands but you'd have to build the INI file from a SQL query.
Bottom line - you have your data in a format of "computer_name" and "list of admin users" format. The list of allowed users is placed into the $Allowed variable, either through the ReadProfileString command as shown in my example or via a SQL query UDF call.
There's one important thing on that line - it puts a comma before and after the list of user names, so "John,Mary,Tommy,Sue" becomes ",John,Mary,Tommy,Sue,".
The If statement uses InStr to determine if @USERID is in the $Allowed variable. Before checking, the @USERID is also wrapped in commas. This forces an exact match. Consider this - if you simply checked for @USERID and "Tom" logged in, it would match "Tommy" because it's a sub-string search. By wrapping @USERID in commas, you get ",Tom,", which doesn't match. When Tommy logs in, you get ",Tommy,", which does.
The InStr doesn't check position, just whether a match was found. Some position greater than zero (found) or zero (not found). The result is treated as a Boolean value. So - if a match is found, we run the commands in the If / EndIf section. There are two Shell commands, one to remove the generic "Domain Users" group and one to add the current user. I haven't tested this specific code, so you may want to add the current user before removing Domain Users, although the rights should not change until next process.
There's an inherent flaw in this in that if more than one person should have local admin rights on a workstation - the first user removes the rights of all other users, preventing the second (authorized, but no longer a local admin) from updating the group. With slightly more complex logic, the first user could enumerate the list of domain accounts that are permitted and repeat the /Add command for all allowed users.
Personally, I'd use PSExec.exe to run the commands needed from a central server. Get a list of workstations and the users allowed to log in with local admin rights.. you'll need this anyway to make the above work. Then, simply call the two commands using PSEXEC (Shell PSExec.exe \\target $Cmd) to update the remote workstations. Again, you'd run the /Delete syntax once and the /Add syntax once per allowed user. If you run the script as a domain admin from a server or admin workstation, you can process quite a number of workstations per hour - do it once and be done.
Glenn
_________________________
Actually I am a Rocket Scientist!
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
1 registered
(Henriques)
and 2516 anonymous users online.
|
|
|
