Batch Add Domain Users to a Local Security Group on Domain Hosts

You can run a script to automate adding the user that the Agent runs under to the local Backup Operators group (or Administrators group, if collecting from Windows XP workstations). You can run the script manually on each host the Agent needs access to, or it can be pushed via Group Policy Object (GPO).

1. Configure the script for execution.
   1. Create a new text file, name it AddLogRhythmUser.vbs, and save it in an accessible location.

   2. Open the script in Notepad, and copy the following code into the file:

      CODE

      '**********
      'Add User To Local Group Script
      'Copyright 2007 LogRhythm, Inc.
      'Last Updated: 8/29/2007
      'Function:
      ' This script will add the specified domain account to a specified local group
      ' It can be added to a GPO to apply the change across the hosts managed by the GPO
      '********** function add_to_local_group( machine, account, local_group_name ) 
      set object_to_add = GetObject("WinNT://" & account ) 
      set local_group = GetObject("WinNT://" & machine & "/" + 
      local_group_name & ",group") 
      On Error Resume Next 
      local_group.Add( object_to_add.AdsPath )
      end function 
      'Constants - do not change
      '*********
      this_machine = "."
      '********** 
      'Variables - change the following values
      '**********
      'Change the value to the domain user you want added to the local group. Change should be in the format of [DomainName/UserName].domain_account = "DOMAIN/USERNAME" 
      'Change the value to the name of the local group you want the domain user added to. LogRhythm recommends the Backup Operators group.admin_group_name = "Backup Operators" 
      '********** 
      call add_to_local_group(this_machine, domain_account, admin_group_name)

   3. Edit the domain_account = "DOMAIN/USERNAME" variable (line 25), to reference the local domain, and the user that will be used by the Agent service to log on.
   4. If collecting from Windows XP workstations, edit the admin_group_name = "Backup Operators" variable (line 28), to reference the local Administrators group. It should read admin_group_name = "Administrators".
   5. Save the file.
2. Run the script on the hosts by doing one of the following:
   
   • To run the script locally, copy it to the host where group membership will be modified, and double-click it.
   • To configure the domain GPO to cause the script to run on system boot:
     1. Click Active Directory Users and Computers.
        The Active Directory Users and Computers window appears.
     2. On the Organizational Unit (OU) that contains the computer account objects, right-click the OU.
     3. Click Properties.
     4. Select the Group Policy tab.
     5. Select the GPO in effect.
     6. Edit the GPO.
        1. In the Group Policy Object Editor MMC, go to Computer Configuration and click Windows Settings.
        2. Click Scripts.
        3. Click Startup.
        4. Right-click the selection and click Properties.
        5. Click Show Files. 
           A Windows Explorer window to the startup scripts folder of the GPO appears.
        6. Drag, paste, or move the AddLogRhythmUser.vbs script into the folder.
        7. To return to the GPO dialog box, close the Windows Explorer window .
     7. Click Add.
     8. Select the AddLogRhythmUser.vbsscript. No Script Parameters are needed.
     9. To add the script, click OK.

     10. To save the setting, click OK.
         On the next boot, the Agent's user account will be added to the local Backup Operators group on all machines that this GPO controls.

         

         The script is stored in the GPO itself and does not reference the file. Host machines need no access to the script file itself.