Windows Tip: Enumerating local admin group membership
Send your Windows question to Mitch today! | See other Windows tips
Awhile back I wrote a series of introductory articles about WMI scripting. In one article, I posted the following question: "How can you list any local administrator accounts on a remote machine?" The solution I offered used the Windows Management Instrumentation Command-line (WMIC), a command interpreter that let's you query WMI information directly from the command line instead of doing it from within a WMI script. The command I suggested using was wmic path win32_groupuser where (groupcomponent="win32_group.name=\"administrators\",domain=\"%computername%\"") and this command produces the Administrator account list for the specified computer.
Recently, reader Gene Cox contacted me with this follow-up question: "How can I leverage this for multiple machines?" I asked Gene what the scenario was that he was trying to address, and he replied that he wanted to "Verify all Administrators group on each machine in the domain contain the [minimum] number of authorized users ... Laptop users by nature and by usage need to be local administrators to their corporate machines can add other users to the Admin group. LAN Admins by nature and by usage need to be administrators to all corporate machines in their regions can add other users to the Admin group ... you see where this is going. This is a gauge of abuse or variation from the normal standards. It can easily [be] changed for "other" groups, such as Power Users, etc."
In response to Gene's needs, I suggested taking the above WMIC command and parsing it using a "FOR /F" CMD statement and passing it a parameter to WMIC as follows:
for /f %i in (MyComputerList.txt) do wmic /Node:%i path win32_groupuser where |
Gene replied afterward and told me that this solution "works well" and I was gratified to hear this. Being a Microsoft Most Valuable Professional (MVP), I believe that part of my mandate as an IT professional is to spend a good chunk of my free time helping other IT pros whenever I can with their technical problems. So feel free to send me your own Windows-related technical questions and I'll try and see if I can answer them, and if I can't, then at the least I'll try to point you in the direction of some other experts who might be able to help.
ITworld.com
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
