TechOnTip Weblog

Run book for Technocrats

Add Domain User to Local Administrators Group

Posted by Brajesh Panda on June 22, 2012

Here is a nice article which states about this process;

I was aware how to add a domain user to local administrators group using “net” command, like below;

NET LOCALGROUP “Administrators” domain\useraccount /ADD

But for a specific requirement I was wondering how I can execute this in remote servers without getting into scripting like mess! And that article pointed me to right direction… PSEXEC came to rescue me!!

If we want to execute in a single remote computer use “psexec \\computername <CommandTobeExecuted>’

If we want to execute in multiple computers use a text file with all computer names written in each row then use “psexec @FileName <CommandTobeExecuted>’

So here is the command how to add a specific domain account in Local Administrators group of multiple computers;

PSEXEC.EXE @computers.txt NET LOCALGROUP “Administrators” domain\useraccount /ADD

PsExec executes a program on a remote system, where remotely executed console applications execute interactively.

Usage: psexec [\\computer[,computer2[,…] | @file][-u user [-p psswd]][-n s][-l][-s|-e][-x][-i [session]][-c [-f|-v]][-w directory][-d][-<priority>][-a n,n,…] cmd [arguments]

-a Separate processors on which the application can run with commas where 1 is the lowest numbered CPU. For example, to run the application on CPU 2 and CPU 4, enter: “-a 2,4”

-c Copy the specified program to the remote system for execution. If you omit this option the application must be in the system path on the remote system.

-d Don’t wait for process to terminate (non-interactive).

-e Does not load the specified account’s profile.

-f Copy the specified program even if the file already exists on the remote system.

-i Run the program so that it interacts with the desktop of the specified session on the remote system. If no session is specified the process runs in the console session.

-l Run process as limited user (strips the Administrators group and allows only privileges assigned to the Users group). On Windows Vista the process runs with Low Integrity.

-n Specifies timeout in seconds connecting to remote computers.

-p Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password.

-s Run the remote process in the System account.

-u Specifies optional user name for login to remote computer.

-v Copy the specified file only if it has a higher version number or is newer on than the one on the remote system.

-w Set the working directory of the process (relative to remote computer).

-x Display the UI on the Winlogon secure desktop (local system only).

-priority Specifies -low, -belownormal, -abovenormal, -high or -realtime to run the process at a different priority. Use

-background to run at low memory and I/O priority on Vista.

computer Direct PsExec to run the application on the remote computer or computers specified. If you omit the computer name PsExec runs the application on the local system, and if you specify a wildcard (\\*), PsExec runs the

command on all computers in the current domain.

@file PsExec will execute the command on each of the computers listed in the file.

program Name of application to execute.

arguments Arguments to pass (note that file paths must be absolute paths on the target system).

You can enclose applications that have spaces in their name with quotation marks e.g. psexec \\marklap “c:\long name app.exe”. Input is only passed to the remote system when you press the enter key,

and typing Ctrl-C terminates the remote process. If you omit a user name the process will run in the context of your account on the remote system, but will not have access to network resources

(because it is impersonating). Specify a valid user name in the Domain\User syntax if the remote process requires access to network resources or to run in a different account. Note that the password is

transmitted in clear text to the remote system. Error codes returned by PsExec are specific to the applications you execute, not PsExec.


6 Responses to “Add Domain User to Local Administrators Group”

  1. Linnie said

    Hi there! I’m at work surfing around your blog from my new iphone 4! Just wanted to say I love reading through your blog and look forward to all your posts! Carry on the fantastic work!

  2. Greetings! Very useful advice in this particular article!
    It is the little changes which will make the largest changes.
    Thanks for sharing!

  3. purvis said

    It’s enormous that you are getting ideas from this post as well as from our discussion made here.

  4. Wow, that’s what I was exploring for, what a information! present here at this webpage, thanks admin of this web site.

  5. You definitely made the point.

  6. said

    Does yor website havbe a contact page? I’m hving trouble locating it but, I’d like to send you
    an e-mail. I’ve got some ideas for your blog you might be interested in hearing.

    Either way, great blog and I look forward to seeing it develoop over time.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: