myITforum.com Community Forum myITforum.com Community Forum

Home  Forums  Blogs  Live Support chat  Search Articles  Wiki  FAQ  Email Lists  Register  Login  My Profile  Inbox  Address Book  My Subscription  My Forums 

Photo Gallery  Member List  Search  Calendars  FAQ  Ticket List  Log Out

All Forums RSS Feed Subscription:


           



Can I add Global Security Group to local admin group using SCCM?

 
View related threads: (in this forum | in all forums)

Logged in as: Guest
  Printable Version
All Forums >> [Management Products] >> System Center Products >> System Center Configuration Manager >> Can I add Global Security Group to local admin group using SCCM? Page: [1]
Login
Message << Older Topic   Newer Topic >>
Can I add Global Security Group to local admin group us... - 4/23/2008 12:43:59 PM   
thedave1164

 

Posts: 12
Score: 0
Joined: 5/9/2007
Status: offline 		I want to give some of my help desk amd programmer staff local admin priviliges on the workstations, but not domain admin priviliges.

I have created a Global Security Group and would like to get it in the local admins group, without having to touch each system or having to mess with the GPO.

Post #: 1
RE: Can I add Global Security Group to local admin grou... - 4/23/2008 2:53:53 PM  1 votes
jsandys


Posts: 296
Score: 13
Joined: 3/24/2005
From: San Antonio, TX
Status: offline 		Create a package with no source files that runs a "net localgroup" command: http://technet2.microsoft.com/windowsserver/en/library/bbc58f6d-5283-4da2-9fc4-703503803fbd1033.mspx?mfr=true.

_____________________________

Jason
________________________________________
http://ihaveablog.wordpress.com

(in reply to thedave1164)
Post #: 2
RE: Can I add Global Security Group to local admin grou... - 4/23/2008 4:49:32 PM   
thedave1164

 

Posts: 12
Score: 0
Joined: 5/9/2007
Status: offline
quote:

ORIGINAL: jsandys

Create a package with no source files that runs a "net localgroup" command: http://technet2.microsoft.com/windowsserver/en/library/bbc58f6d-5283-4da2-9fc4-703503803fbd1033.mspx?mfr=true.


Jason,

Thanks for the reply. After reading the above article, I have written a CMD that works for what I want to do, but I am having a problem creating a package with no source files.

I have been trying the help in SCCM, and will be looking for more info on it later, but could you possibly point me in the right direction?

(in reply to jsandys)
Post #: 3
RE: Can I add Global Security Group to local admin grou... - 4/23/2008 6:36:06 PM   
skissinger


Posts: 1676
Score: 103
Joined: 9/13/2001
From: Sherry Kissinger
Status: offline 		If you're planning on using a batch file / cmd file, now you will need a source location, with the .cmd file in the source, and the package distributed to DPs.

_____________________________

mofmaster@smsexpert.com (version 2007) | http://www.smsexpert.com | http://www.sccmexpert.com
Microsoft MVP - SMS

Inventory Manager 2007 is here!

(in reply to thedave1164)
Post #: 4
RE: Can I add Global Security Group to local admin grou... - 4/23/2008 8:11:10 PM   
jsandys


Posts: 296
Score: 13
Joined: 3/24/2005
From: San Antonio, TX
Status: offline 		Because the command already exists on the destination system, you don't even need a batch/cmd file.  To create a package with source files, just go through the package creation wizard and on the page where it says to specify source files, choose this package does not have source files.  Then create the program with the appropriate command line; e.g., net localgroup "Administrators" "Domain\HelpDesk" /add

_____________________________

Jason
________________________________________
http://ihaveablog.wordpress.com

(in reply to skissinger)
Post #: 5
RE: Can I add Global Security Group to local admin grou... - 4/24/2008 8:53:45 AM   
thedave1164

 

Posts: 12
Score: 0
Joined: 5/9/2007
Status: offline
quote:

ORIGINAL: jsandys

Because the command already exists on the destination system, you don't even need a batch/cmd file.  To create a package with source files, just go through the package creation wizard and on the page where it says to specify source files, choose this package does not have source files.  Then create the program with the appropriate command line; e.g., net localgroup "Administrators" "Domain\HelpDesk" /add


DOH!

That is what the commandline is for......

Thanks a bunch!

(in reply to jsandys)
Post #: 6
RE: Can I add Global Security Group to local admin grou... - 4/24/2008 5:57:04 PM   
jjgleason

 

Posts: 18
Score: 3
Joined: 5/22/2007
Status: offline 		Can I ask why you don't want to use a Group Policy with the Restricted Groups feature to accomplish this?  Personally, I'll always use Group Policy for doing this exact thing rather than SCCM and a command line because once it's set up in a GPO it is always there and even if removed will be put back again.  Here's a nice Blog entry explaining the options you have, and be sure to test this first if you go down this path:  http://www.frickelsoft.net/blog/?p=13

(in reply to thedave1164)
Post #: 7
RE: Can I add Global Security Group to local admin grou... - 4/25/2008 10:52:54 AM   
thedave1164

 

Posts: 12
Score: 0
Joined: 5/9/2007
Status: offline
quote:

ORIGINAL: jjgleason

Can I ask why you don't want to use a Group Policy with the Restricted Groups feature to accomplish this?  Personally, I'll always use Group Policy for doing this exact thing rather than SCCM and a command line because once it's set up in a GPO it is always there and even if removed will be put back again.  Here's a nice Blog entry explaining the options you have, and be sure to test this first if you go down this path:  http://www.frickelsoft.net/blog/?p=13


Big picture is this, with all the OU's we have, it is administratively simpler to push this to all workstations. And I want to be able to remove the permissions from Corp Execs and HR as well.

Not real concerned about the group being removed, I can drop it right back in remotely on individual machines as needed. So for our particular situation, it works great.

(in reply to jjgleason)
Post #: 8
RE: Can I add Global Security Group to local admin grou... - 4/28/2008 11:51:35 PM   
tmiller


Posts: 653
Score: 18
Joined: 7/29/2003
From: Iowa
Status: offline 		Doesn't the GPO replace the administrators rather than add to them? I think if you add them via GPO that they will replace and admins that you have added locally. No?

(in reply to thedave1164)
Post #: 9
RE: Can I add Global Security Group to local admin grou... - 4/29/2008 4:32:08 AM   
ridvan

 

Posts: 35
Score: 0
Joined: 3/13/2008
Status: offline 		Just Tested,

And it works fine,

Regards,
Ridvan

(in reply to tmiller)
Post #: 10
Page:   [1]
All Forums >> [Management Products] >> System Center Products >> System Center Configuration Manager >> Can I add Global Security Group to local admin group using SCCM? Page: [1]
Jump to:





New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts




Forum Software © ASPPlayground.NET Advanced Edition 2.4.5 ANSI

0.281