I use ingroup to check if the user is in the "NT Install" group but users are only in this temporarily and I would like to catch PCs that have not been updated locally. Hope this makes sense.

this will only work if the user is a local admin

$admincmd="cmd /c NET LOCALGROUP administrators domain\group /add 2>nul"
shell "$admincmd"

If they are not local admins, you will need to use something like SU

code:

---

break on cls
; This script needs the NT Resource Kit tool "LOCAL"
; You also need a list of target computer to scan, the list must be in the UNC format
;	\\computer1
;	\\computer2
;	....
;------------------------------------------------------------------------------------
$file 		= "clist.dat"		;A target list of computers to scan
$tempfile 	= "temp.txt"		
$globalgroup 	= "Domain Admins"	;The global group that you are searching for
$localgroup 	= "Administrators"	;the local group that you are looking for $globalgroup in
$q = open(1,$file,2)
$computer = readline(1)
do
	select
		case exist("$computer\admin$\") = 1
			shell '%comspec% /c local $localgroup $computer | find /i "$globalgroup" > $tempfile'
			if getfilesize("$tempfile") <> 0
				$q = open(2,$tempfile,2)
				$return = readline(2)
				$q = close(2) 
				del $tempfile
				? "$Computer has Global group $return in the local $localgroup"
			Else
				? "$globalgroup can not be found the the local $localgroup"
			endif
		case exist("$computer\admin$\") = 0
			? "Can't connect to $computer OR you have insufecent rights"
		
	endselect
	$computer = readline(1)
until @error <> 0
$q = close(1)
exit

---

Bryce

Also, I have found a wonderful use for the "Global in Local" scanning script! Playing around with it last night I found out that 2 of my NT computers have the global group "Domain users" in the local "Administrators" group.

This script has some great potential to become a tool to be used in a system audit

Bryce