There are UDFs to connect to SQL that work well - I'd use those. I assume you have some type of table that matches computers with authorized local admins. You can also use a simple INI file, something like
 Code:
[AUTHORIZED]
computer1=joe,mary
Computer2=tom,harry
computer3=jane
Basically, computer name = user list.

Here's some sample logic using the INI file, run during logon (assuming everyone's a local admin):
 Code:
; Get a list of auth admins for this computer
; can be gathered from SQL or an INI file as desired
; The 'Allowed' list should begin and end with a comma, and be comma-delimited
$Allowed = ',' + ReadProfileString('\\server\share\ladmins.ini', 'AUTHORIZED', @WKSTA) + ','

If InStr($Allowed, ',' + @USERID + ',')
  'User is allowed as admin!' @CRLF
  $Cmd = '%COMSPEC% /c '
  $Cmd = $Cmd + ' Net LocalGroup "Administrators" "Domain Users" /delete >>groupadd.log'
  Shell $Cmd
  $Cmd = '%COMSPEC% /c '
  $Cmd = $Cmd + 'Net LocalGroup "Administrators" ' + @USERID + ' /add >>groupadd.log'
  Shell $Cmd
EndIf
You might want to add the user before removing the group...

Glenn
_________________________
Actually I am a Rocket Scientist! \:D