Script to remove domain user from local administrator group

' (This script can run as logon script without problems because it first check if the user is a member.
' If the user is a local administrator s/he has privileges to remove him/her self from the local group.
' Do Keep in mind however that the user at this stage already is logged-on as an Administrator,
' s/he will keep all the access rights until the next logon).

Set objNetwork = CreateObject("Wscript.Network")
strUser = objNetwork.UserName
strDomain = objNetwork.UserDomain
strComputer = objNetwork.ComputerName

strLocalGroup = "Administrators"

On Error Resume Next

' Bind to local group object.
Set objGroup = GetObject("WinNT://" _
& strComputer & "/" & strLocalGroup & ",group")
If (Err.Number <> 0) Then wscript.Quit

' Bind to the user object on the Domain.
' (use also the WinNT provider).
Set objUser = GetObject("WinNT://" _
& strDomain & "/" & strUser & ",user")
If (Err.Number <> 0) Then wscript.Quit

On Error GoTo 0

' Check If user is a member, then remove him/her self! from local group
If (objGroup.IsMember(objUser.AdsPath) = True) Then
objGroup.Remove(objUser.AdsPath)

End If

Wscript.Quit

Comments

Popular posts from this blog

LDAP Queries

Exchange 2007 Powershell

Delete Media Files