{"id":68893,"date":"2005-09-23T18:35:00","date_gmt":"2005-09-23T18:35:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2005\/09\/23\/how-can-i-add-a-domain-group-to-the-local-administrators-group\/"},"modified":"2005-09-23T18:35:00","modified_gmt":"2005-09-23T18:35:00","slug":"how-can-i-add-a-domain-group-to-the-local-administrators-group","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-add-a-domain-group-to-the-local-administrators-group\/","title":{"rendered":"How Can I Add a Domain Group to the Local Administrators Group?"},"content":{"rendered":"

\"Hey, <\/P>\n

Hey, Scripting Guy! How can I add a domain group to the local Administrators group?

— SS<\/P>\"Spacer\"\"Hey,\"Script<\/A> \n

Hey, SS. You know, people think of the Scripting Guys as striding powerfully through the world of system administration scripting, confident, almost-arrogant in the knowledge that they can meet any challenge thrown at them. We like to think of ourselves as being that way, too, even though we know it isn\u2019t true. Confident, almost-arrogant in the knowledge that we can meet any challenge thrown at us? Well \u2026.<\/P>\n

Take this question for example. Awhile back<\/B><\/A> we answered a similar question, explaining how a domain user could be added to the local Administrators group on a computer. We expected that, if anything, we\u2019d get a few emails from people saying, \u201cThanks; that answered my question.\u201d Instead, we got a flood of emails from people saying, \u201cOK, sure. But how do you add a domain group<\/I> to the local Administrators group?\u201d In turn, that got us a little worried. Does that mean you have to use a different approach to add a domain group to the local Administrators group? Oh my gosh: how do<\/I> you add a domain group to the local Administrators group?<\/P>\n

Faced with a challenge thrown at us, we did what we usually do in that situation: we acted as though the problem never existed. In the past couple of weeks, however, we\u2019ve gotten several more emails on the subject, and we decided that it was time to meet the challenge head-on.<\/P>\n

And guess what? It turns out that to add a domain group to the local Administrators group you use the exact same approach you use when adding a domain user to the local Administrators group:<\/P>

strComputer = “atl-ws-01”<\/p>\n
Set objAdmins = GetObject(“WinNT:\/\/” & strComputer & “\/Administrators”)\nSet objGroup = GetObject(“WinNT:\/\/fabrikam\/accounting”)<\/p>\n
objAdmins.Add(objGroup.ADsPath)\n<\/PRE>\n
This script begins by assigning the name of the local computer (in this case, atl-ws-01) to a variable named strComputer. We then use this line of code to bind to the local Administrators group on atl-ws-01:<\/P>
Set objAdmins = GetObject(“WinNT:\/\/” & strComputer & “\/Administrators”)\n<\/PRE>\n
Now comes the one tricky part. We need to create a second object reference by binding to the domain group. When you bind to a group in Active Directory you typically use an ADsPath similar to this:<\/P>
Set objGroup = GetObject(“LDAP:\/\/cn=accounting, ou=finance, dc=fabrikam, dc=com”)\n<\/PRE>\n
However, we can\u2019t<\/I> use a binding string like that in this script. Why not? Well, because we\u2019re working with a local account (the local Administrators group), so we need to use the WinNT provider; for better or worse, the WinNT provider has no idea what something like cn=accounting, ou=finance, dc=fabrikam, dc=com<\/B> means. Therefore, we have to use an old-fashioned, Windows NT 4.0 binding string, making a connection using the domain_name\/logon_name<\/I><\/B> format:<\/P>
Set objGroup = GetObject(“WinNT:\/\/fabrikam\/accounting”)\n<\/PRE>\n
It\u2019s something you\u2019re not used to doing, but it works.<\/P>\n\n<\/THEAD>\n\n\n
\n
Note<\/B>. OK, Scripting Guys, it looks like it\u2019s easier to use the WinNT provider to bind to Active Directory than to use the LDAP provider to bind to Active Directory; if that\u2019s the case, then why don\u2019t we always<\/I> use the WinNT provider to bind to an Active Directory object? That\u2019s easy. If you bind to an Active Directory object using the LDAP provider you have access to all the Active Directory properties of that object; in the case of a user account, that\u2019s over 200 properties you can read and write. If you bind using the WinNT provider, however, you get access only to the Windows NT properties of that object; for a user account, that amounts to only 20 or so properties. To get to the Active Directory attributes of an object you have<\/I> to use the LDAP provider. We can use the WinNT provider here because all we need is an object reference; we don\u2019t need any of the properties associated with the account.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
As soon as we have an object reference that the WinNT provider understands all we have to do is call the Add<\/B> method to add the domain group to the local Administrators group:<\/P>
objAdmins.Add(objGroup.ADsPath)\n<\/PRE>\n
Just the way we always knew it would work.<\/P>\n
Well, OK, just the well we always expected<\/I> it would work.<\/P>\n
OK, just the way we always hoped<\/I> it would work.<\/P>\n
Fine, just the way \u2026. Well, the point is, it does<\/I> work. And that\u2019s all that really matters.<\/P>
\n
\n\n\n\n
\"Top<\/A>Top of page<\/A><\/TD><\/TR><\/TBODY><\/TABLE><\/DIV><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! How can I add a domain group to the local Administrators group?— SS Hey, SS. You know, people think of the Scripting Guys as striding powerfully through the world of system administration scripting, confident, almost-arrogant in the knowledge that they can meet any challenge thrown at them. We like to think of […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,44,3,5],"class_list":["post-68893","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-groups","tag-scripting-guy","tag-vbscript"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! How can I add a domain group to the local Administrators group?— SS Hey, SS. You know, people think of the Scripting Guys as striding powerfully through the world of system administration scripting, confident, almost-arrogant in the knowledge that they can meet any challenge thrown at them. We like to think of […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/68893","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=68893"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/68893\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=68893"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=68893"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=68893"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}