Creating local users and adding them to a local group (Win) - Page 1

[ARCHIVED THREAD] - Creating local users and adding them to a local group (Win)

Posted: 7/1/2017 9:30:04 AM EDT

I've come up with the need to create alternate local admin accounts. While I'm doing that, I also want to add a domain account into a local group (not sure of power user, local admin, etc yet) for machine admin without the account having enhanced domain rights.

I'm trying to figure out the best way to achieve this - .bat/.ps1, GPO, etc.
GPO seems to be the Answer to All Things now, so I checked that out a little. Is Restricted Groups (here and here) still the way to go for giving domain accounts local group memberships?

It looks like MS has removed the ability to use GPO to create local accounts, so I'll treat that part separately. I found an old .cmd script that I can base things on. I barely recognize it, so I'm up for redoing it in powershell - any alternate suggestions?

for /F "tokens=1" %%A in (c:\scripts\computers.txt) do runas /user:[email protected] /savecred /noprofile "psexec \\%%A -h net user LocalAdmin RandomPass87 /ADD /FULLNAME:\"Local Admin User\""

for /F "tokens=1" %%A in (c:\scripts\computers.txt) do runas /user:[email protected] /savecred /noprofile "psexec \\%%A -h net localgroup Administrators LocalAdmin /ADD"

for /F "tokens=1" %%A in (c:\scripts\computers.txt) do runas /user:[email protected] /savecred /noprofile "psexec \\%%A -h net user administrator /active:no"

for /F "tokens=1" %%A in (c:\scripts\computers.txt) do echo %%A

Posted: 7/4/2017 5:01:52 PM EDT

[#1]

GPO is the best solution. Group Policy still has the ability to create local accounts and rename the default admin account.

I use this in my environment to create local admin accounts for the desktop support team and to add the desktop support team's group to the local administrator group.

Posted: 7/5/2017 9:35:30 AM EDT

[#2]

Quote History

Quoted:
GPO is the best solution. Group Policy still has the ability to create local accounts and rename the default admin account.

I use this in my environment to create local admin accounts for the desktop support team and to add the desktop support team's group to the local administrator group.

View Quote

Multiple references say this is no longer so.
https://www.reddit.com/r/sysadmin/comments/
https://community.spiceworks.com/topic/

Including MS - https://blogs.technet.../ms14-025-an-update-for-group-policy-preferences/

The docs say that existing policies still work, but you cannot create new ones.

Posted: 7/5/2017 10:40:02 AM EDT

[#3]

Quote History

Quoted:
Multiple references say this is no longer so.
https://www.reddit.com/r/sysadmin/comments/
https://community.spiceworks.com/topic/

Including MS - https://blogs.technet.../ms14-025-an-update-for-group-policy-preferences/

The docs say that existing policies still work, but you cannot create new ones.

View Quote

Interesting. I'll have to look later today. And later this week when we raise our functional level.

Posted: 7/5/2017 12:00:03 PM EDT

[#4]

We've started doing this with our own agent written in .NET. It creates a local admin account with a random password, securely syncs that password to a web based dashboard that's accessed via 2FA and SSO creds, where it can be looked up. Then that password is changed ever 24 hours. So if my techs need a local admin password on a machine, the login to the dashboard, find the particular machine they need, and look up the password.

We're working on a mobile app as well. We're thinking about selling it as a SaaS service if we can work out the bugs.

But yeah, the new thing to do is use PowerShell scripts.

Posted: 7/5/2017 8:40:37 PM EDT

[#5]

I've got the basics of a script put together. It has a few problems though...
I found it weird that I have to put a SetInfo after each entry on the account creation.
It really falls apart on the old admin account password set and disable. I'm assuming there's some PS magic like the $NewUser = $ADSIComp.Create line in the new account creation. I just don't know what it is.

Ideas?

$TargetComputers = Get-Content c:\scripts\computerlist.txt
$NewAdminUser = 'WeirdAdminAccount'
$OldAdminUser = 'Administrator'
$group = "Administrators"
$EnableUser = 512
$DisableUser = 2
FOREACH ($Target in $TargetComputers)
{
#
# Create a new local user on each target computer
#
$ADSIComp = [adsi]"WinNT://$Target"
$NewUser = $ADSIComp.Create('User',$NewAdminUser)
$NewUser.SetPassword('HardPW9)')
$NewUser.SetInfo()
$NewUser.Description = "Local Administrator"
$NewUser.SetInfo()
$NewUser.userflags = $EnableUser
$NewUser.SetInfo()
#
# Put new local user into specified group (local administrator for this script)
#
& NET LOCALGROUP "$group" $NewAdminUser /add
#
# Reset password and disable local Administrator account on each target computer
#
$OldAdmin = [adsi]"WinNT://$Target,OldAdminUser"
$OldAdmin.SetPassword('HardPW9)')
$OldAdmin.SetInfo()
$OldAdmin.Description = "Disabled Local Administrator"
$OldAdmin.SetInfo()
$OldAdmin.userflags = $DisableUser
$OldAdmin.SetInfo()
}

Edit - put script in a Code block to see if it made any real difference

Posted: 7/5/2017 10:02:38 PM EDT

[#6]

Crap - this reminds me of 15 feet of wide greenbar stretched down the hallway looking for a misplaced period in a COBOL listing....

$OldAdmin = [adsi]"WinNT://$Target,OldAdminUser"
should be
$OldAdmin = [adsi]"WinNT://$Target/$OldAdminUser"

I need to do some testing, but I think its working. :-)

Posted: 7/5/2017 10:48:42 PM EDT

[#7]

A few more tweaks, and here is what I have that (so far) seems to work...
The input text file is just a list of the computers I want to touch, one per line
(If we're going to have Code tags, can we ask that they are language aware instead of just a different quote system?)

# Create New Local Admins
# Disable local Administrator
$TargetComputers = Get-Content c:\scripts\computerlist.txt
$NewAdminUser = 'WeirdAdminAccount'
$OldAdminUser = 'Administrator'
$LocalGroup = "Administrators"
$EnableUser = 512
$DisableUser = 2

FOREACH ($Target in $TargetComputers)
{
#
# Create a new local user on each target computer
#
$ADSIComp = [adsi]"WinNT://$Target"
$NewUser = $ADSIComp.Create('User',$NewAdminUser)
$NewUser.SetPassword('HardPW9)')
$NewUser.SetInfo()
$NewUser.Description = "Local Administrator"
$NewUser.SetInfo()
$NewUser.userflags = $EnableUser
$NewUser.SetInfo()
#
# Put new local user into specified group (local administrator for this script)
#
#& NET LOCALGROUP "$group" $NewAdminUser /add
$AddToGroup = [ADSI]("WinNT://$Target/$LocalGroup,group")
$AddToGroup.add("WinNT://$NewAdminUser,user")
$AddToGroup.setinfo()
#
# Reset password and disable local Administrator account on each target computer
#
$OldAdmin = [adsi]"WinNT://$Target/$OldAdminUser"
$OldAdmin.SetPassword('HardPW9)')
$OldAdmin.SetInfo()
$OldAdmin.Description = "Disabled Local Administrator"
$OldAdmin.SetInfo()
$OldAdmin.userflags = $DisableUser
$OldAdmin.SetInfo()
}

[ARCHIVED THREAD] - Creating local users and adding them to a local group (Win)

General » Urban Commandos

Warning

Confirm Action

About AR15.COM

Stay Connected

Newsletter

Contact Us