I thought about the fact that eventually you could have a lot of accounts in that group. One option I thought of was to have the script remove all but domain admins from the group, and then add the user back in, each time the script runs.

Admittedly, this is kludgy. My first thought was if Win2K had a built-in object called something like "currently logged on user" that dynaically changes as each user logs on, but I can't find anything like that.

What do you think?