| JohnQ |
| (Starting to like KiXtart) |
| 2004-02-11 10:02 PM |
|
Local Admin Members
|
Does anyone know of a way to enumerate the members of the local admin group on a NT4 workstation (No ADSI)?
Looking for a method other than Howard's dll.
| maciep |
| (Korg Regular) |
| 2004-02-11 10:08 PM |
|
Re: Local Admin Members
|
Does this work on nt: "net localgroup administrators" (from command prompt)
| Howard Bullock |
| (KiX Supporter) |
| 2004-02-11 10:15 PM |
|
|
Re: Local Admin Members
|
You can use GrpMaint.exe as a standalone solution. You can enum remote servers and workstations. Or are you looking for a way to do this from within the logon script as a user?
| JohnQ |
| (Starting to like KiXtart) |
| 2004-02-11 10:31 PM |
|
|
|
Re: Local Admin Members
|
Howard, I would like to run it from the login script. Users will have admin rights.
Shelling out net localgroup administrators would be a possible solution, but it doesn't differentiate between users and groups as members. It just spits out everything.
Lonkero
|
| (KiX Master Guru) |
| 2004-02-11 10:40 PM |
|
Re: Local Admin Members
|
k, why you want to have loginscript checking for all admin group members?
| Howard Bullock |
| (KiX Supporter) |
| 2004-02-11 10:44 PM |
|
|
|
Re: Local Admin Members
|
I can not understand the requirement for a user to enum the group. Can you tell us what exactly you want to get from this operation and how you intend to use the data?
Code:
break On
? @kix
? ingroup("\\@wksta\administrators")
| JohnQ |
| (Starting to like KiXtart) |
| 2004-02-11 11:00 PM |
|
|
|
Re: Local Admin Members
|
The information will be gathered as part of our invnetory script at login. This info is of no value to the user and the user never sees it, but the info is stored in a SQL database. This allows us to audit the members of the local admin group on any given PC. Many PC's have members who should not be.
| ShaneEP |
| (MM club member) |
| 2004-02-11 11:45 PM |
|
|
Re: Local Admin Members
|
This code should work to get all of the objects that are in the local admin group. I dont know how to tell the difference from users and groups however.
Code:
$memberfile = "%temp%\adminmembers.tmp"
If Exist ($memberfile)
Del $memberfile
Endif
Shell '%comspec% /c net localgroup administrators > '+$memberfile
$members = ArrayEnumText($memberfile)
Del $memberfile
For Each $member in $members
? $member
Next
get $
FUNCTION ArrayEnumText($TextFile)
Dim $TextHandle,$Line,$LineArray,$LineValue
$TextHandle = FreeFileHandle()
If Open ($TextHandle,$TextFile) = 0
While @Error = 0 and $trigger < 1
$Line = ReadLine ($TextHandle)
If InStr ($line, "---")
$trigger = 1
Endif
Loop
$LineValue = 0
While @Error = 0
$Line = ReadLine ($TextHandle)
If Not InStr ($line, "The command completed successfully")
ReDim Preserve $ArrayEnumText[$LineValue]
$ArrayEnumText[$LineValue] = $Line
$LineValue = $LineValue+1
Endif
Loop
$null = Close ($TextHandle)
If UBound ($ArrayEnumText) >= 0
Exit 0
Else
Exit 1
Endif
Else
Exit 1
Endif
ENDFUNCTION
|
Lonkero
|
| (KiX Master Guru) |
| 2004-02-12 12:07 AM |
|
Re: Local Admin Members
|
k, this worked on my w2k system:
Code:
"listing local admin group accounts:" ?
$bk="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy"
$sk=enumkey($bk,$)
do
$count=0+readvalue($bk+"\"+$sk+"\GroupMembership","count")
if $count
for $2=1 to $count
if "S-1-5-32-544"=readvalue($bk+"\"+$sk+"\GroupMembership","Group"+$2)
$un=sidtoname($sk)
if len($un)
$un ?
endif
endif
next
endif
$=$+1
$sk=enumkey($bk,$)
until @error
get $
| ShaneEP |
| (MM club member) |
| 2004-02-12 01:32 AM |
|
|
|
Re: Local Admin Members
|
Nice...It also works on XP Pro
|
Lonkero
|
| (KiX Master Guru) |
| 2004-02-12 01:34 AM |
|
Re: Local Admin Members
|
damn.
I have mistakenly created script that has potential to become UDF
|
NTDOC
|
| (KiX Master) |
| 2004-02-12 01:44 AM |
|
|
Re: Local Admin Members
|
Yes, good code for 2000/XP there Lonk
However for NT 4 which was the original request it does not appear to work. I tested it on NT 4 SP6a workstation and NT 4 Server SP6a and neither one returned info.
So unless Lonk or someone else can figure out a pure KiXtart method, I'll suggest this.
NetLocalGroupEnum
NetUserGetLocalGroups
NetUserEnum
Using Win32 C,C++,VB,Perl,Python,etc... you could use
NetLocalGroupGetMembers
Otherwise you may have to locate a compiled .EXE or use WSH/ADSI to really accomplish this task.
Here is a tool that I think should do what you're looking to do, but I've not tested it on NT 4
http://www.joeware.net/win32/zips/Lg.zip
He also has a lot of other nice utilities for Admin work.
http://www.joeware.net/
|
NTDOC
|
| (KiX Master) |
| 2004-02-12 01:48 AM |
|
|
|
Re: Local Admin Members
|
Also, on 2000/XP it will show my own account which is a member of a Universal group on the AD, but it won't list the members of the other users in that group which actually do have local admin rights based on that group.
| Les |
| (KiX Master) |
| 2004-02-12 02:36 AM |
|
Re: Local Admin Members
|
Quote:
...but it doesn't differentiate between users and groups as members. It just spits out everything.
Can't you just enumerate the results? Would you not want to know both group and user members?
| Howard Bullock |
| (KiX Supporter) |
| 2004-02-12 03:07 AM |
|
|
|
Re: Local Admin Members
|
I would not have the user collect this info. Instead, I would have the computer create a flag file on a server indicating it is available for interogation. A server based process would then query the workstation for any info needed outside the logon process.
|
NTDOC
|
| (KiX Master) |
| 2004-02-12 10:33 AM |
|
|
|
Re: Local Admin Members
|
Howard,
I don't think a server admin script would be able to do it either without using ADSI/WMI or 3rd party against NT 4.0
He said without either of those methods.
| Howard Bullock |
| (KiX Supporter) |
| 2004-02-12 01:19 PM |
|
|
|
Re: Local Admin Members
|
Yes he did say that...but the reason I think he said that ADSI was not installed on his current NT4 clients. In the scanario I put forth, he would not need ADSI on the clients just the computer from where the admin script was executed.
| Co |
| (MM club member) |
| 2004-02-12 03:03 PM |
|
|
Re: Local Admin Members
|
Dependencies: WMI enabled
Code:
Break On
$srv='\\server\share\'+@wksta+'.txt'
;$strComputer = "comp1"
If $strComputer = ""
$strComputer = "."
EndIf
Open(1,$srv,5)
$logdata='User'+Chr(9)+'Local Group'+Chr(9)+'Workstation'+Chr(9)+'OS'+Chr(9)+'Build'+Chr(9)+'SP'+Chr(9)+'NT Version'+Chr(13)+Chr(10)
$nul=WriteLine(1,$logdata)
$logdata=$name+Chr(9)+$group+Chr(9)+@Wksta+Chr(9)+@ProductType+Chr(9)+@Build+Chr(9)+@CSD+Chr(9)+@Dos+Chr(13)+Chr(10)
$nul=WriteLine(1,$logdata)
$colGroups = GetObject("WinNT://" + $strComputer + "")
If $colGroups
$colGroups.Filter = "group",""
For Each $objGroup In $colGroups
$group=$objGroup.Name
For Each $objUser In $objGroup.Members
$name=$objUser.Name
$logdata=$name+Chr(9)+$group+Chr(10)+Chr(13)
$nul=WriteLine(1,$logdata)
? $name +"-"+ $group
Sleep 1
Next
Next
EndIf
:end
$logdata=Chr(10)+Chr(13)+Chr(10)+Chr(13)
$nul=WriteLine(1,$logdata)
$nul=Close(1)
With output:
Quote:
User Local Group Workstation OS Build SP NT Version
TESTPC2 Windows XP Professional 2600 Service Pack 1 5.1
Administrator Administrators
Domain Admins Administrators
XPtest Administrators
|
Lonkero
|
| (KiX Master Guru) |
| 2004-02-12 04:26 PM |
|
Re: Local Admin Members
|
hey co, I see only groups in there...
didn't he say only users
| Co |
| (MM club member) |
| 2004-02-12 07:35 PM |
|
|
|
Re: Local Admin Members
|
XPtest is a user....
Quote:
Does anyone know of a way to enumerate the members of the local admin group on a NT4 workstation (No ADSI)?
|
Lonkero
|
| (KiX Master Guru) |
| 2004-02-14 02:05 AM |
|
Re: Local Admin Members
|
hey johnie...
are you gonna just sit back there and let us fight?
please tell us where you at so we can try to better be of assistance.