What are you gonna do about permissions? Do all your users have the rights to add domain groups to local groups? I ran into this before so I wrote a .bat file with my net localgroup command in it, converted it to a .COM file, created a generic domain account with Domain Admin rights, wrote a .KIX file to use the SU command to run the COM file as that Domain Admin account then used Kixcrypt to encrypt the .KIX file so the password wouldn't be in clear text. Does this sound like something you're interested in?