Saleem,
You still haven't answered all my questions. I had 4 questions, you gave 1 answer.

OK, so assuming it is a domain user that is a direct member of a local group, it should go something like this (untested):
code:
if ingroup("\\"+@wksta+"\administrators")
 $ShellCMD="%comspec% /c net localgroup administrators "+@Domain+"\"+@userid+" /del"
 $ShellCMD ?
 ;Shell $ShellCMD
endif
You would obviously have to remove the comment.
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.