How to add first log on user to local administrator group

Hi All,
When first time user log in to system, i need to add that particular user to local administrator group?
How to achieve it using vbscript?
Thanks
Divakar

It is also now against federal law in the US, Canada and, I believe, the UK.
In the US HIPAA and the federal network security act (???) and Sarbanes-Oxley all prohibit users running as Admins. This may not specifically affect your
installation but it does show how important this is.
There is NEVER a good reason to make a user an administrator. It is only lack of technical know how that leads to this scenario. Any vendor product that
requires this is not a safe product to use in a corporate network. Malware specifically looks for this as an attack vector.
I spent three years arguing with Inuit to get there software to work. Every time they said you have to run as an admin I told them it would never be. We
were always able to find a way. Now QuickBooks installs as a standard user with no issues.
It can be done.
¯\_(ツ)_/¯
It is also now against federal law in the US, Canada and, I believe, the UK.
In the US HIPAA and the federal network security act (???) and Sarbanes-Oxley all prohibit users running as Admins. This may not specifically affect your
installation but it does show how important this is.
There is NEVER a good reason to make a user an administrator. It is only lack of technical know how that leads to this scenario. Any vendor product that
requires this is not a safe product to use in a corporate network. Malware specifically looks for this as an attack vector.
I spent three years arguing with Inuit to get there software to work. Every time they said you have to run as an admin I told them it would never be. We
were always able to find a way. Now QuickBooks installs as a standard user with no issues.
It can be done.
¯\_(ツ)_/¯

Similar Messages

Add Managed By AD value to Local Administrator group.

Hi,
I'd like to add the user account of the AD computer's Managed by attribute to the Local Administrator Group.
Could that be done via GPP?
Thanks in advance.

Hi,
I am doubtful about it, as when I run %manager%, the system could not recognize the variable, and also I didn't find out the environment variable.
I would like suggest you use script to do that, first retrieve all "Managers", then add them to each computers local admins group.
For scripting, please refer to the below link:
http://social.technet.microsoft.com/Forums/en-US/ITCG/threads
Best Regards,
Yan Li
Yan Li
TechNet Community Support

How to add a role so user can do Export, Copy & paste Master Data?

How to add a role so user can do Export, Copy & paste Master Data? Thanks!

Add S_GUI to the user role.

How to get/capture log-on user name on PC (work station)

Hi,
Colud anyone give me how to get/capture log-on user name on my PC (work station)?
I need to get the infomation by using a function module.
Kind regards,
Hisao

Hi,
TH_USER_INFO shows me terminal ID, IP address and other information. howerver it does't show me log-on user name of OS.
Kind regards,
Hisao

SCCM 2012 - How to add domain id to local administrator group of all clients

SCCM 2012 - How to add domain id to local administrator group of all clients
Hi,
i have a domain id sccmadmin which is a part of domain admins group too.
Need to add this ID to the local administrators group of all clients. How do I do this? Please help!

Hi ,
you need to choose the second option .
First option will remove all the domains users from the local administrator group available in all the PC'S .Then local administrator group will only have the users updated on the members list present in group policy.
Note : Local admins accounts on the local administrators groups will not be removed.
Second option will add the newly created group to the local administrator group in all the PC'S and it will not remove the existing members in the local administrators group.
Step 1 : Just try to create one new group for SCCM management .
Step 2 : Then add the SCCM account to that group.
Step 3 : Then please create a new group policy on that just choose the second option.On that option just add the newly created group to be an member of administrator group in all the PC'S
Why i have asked you to create a new group ?
Because in second option , we don't have a option to add a individual user .
Once you have created a group policy it will like below snap.
As an additional i will tell how to find the newly created group policy is applying to computer objects or not ans also i will tell you how to force update the group policy
1.gpresult /r ----> To find the which group policy is applying on user and computer object .
2.rsop.msc ----> There you can able to find the change has been applied or not .
3.gpupdate /force -----> Forcefully updating the group policy in a client machine
4.In gpmc.msc there is one option called group policy results .That option will be used for centralized management to find the policies that are applied to a user and computer account.
5.Just check the event viewer in all the PC'S for group policy related events.
Most importantly you need to make sure all the computer accounts are placed in an ou ,where the newly created group policy is applying and also make sure that OU doesn't contain any inheritance block.
Please feel free to reply me if you have any queries.
Thanks & Regards S.Nithyanandham

How do I convert a standard user to an administrator if i have no other admins on the computer, re-bootimg NOT an option, please help!!!!!!

how do I convert a standard user to an administrator if i have no other admins on the computer, re-bootimg NOT an option, please help!!!!!!

Please take these steps to restore administrator privileges to your account. This somewhat tedious procedure is only necessary if you've confirmed that no adminstrator account exists on the system.
If you don't already have a current backup of all your data, you must back up before taking any of the steps below. Ask if you need guidance. You won't need the backup unless something goes wrong—which is always a possibility.
Step 1
Start up in Recovery mode. The OS X Utilities screen will appear.
Step 2
Take this step only if you use FileVault 2. Launch Disk Utility, then select the icon of the FileVault startup volume ("Macintosh HD," unless you gave it a different name.) It will be nested below another icon with the same name. Click the Unlock button in the toolbar and enter your login password when prompted. Then quit Disk Utility to be returned to the main screen.
Step 3
Select
Utilities ▹ Terminal
from the menu bar. In the window that opens, type this:
res
Press the tab key. The partial command you typed will automatically be completed to this:
resetpassword
Press return. A Reset Password window opens. Select your startup volume if not already selected. Pull down the menu labeled
Select the user account
and select
System Administrator (root)
Follow the prompts to set a password. It's safest to choose a password that includes only the characters a-z, A-Z, and 0-9. I suggest you write down the password. If you don't write it down and forget it, you'll have to start over from Step 1.
Select
 ▹ Restart
from the menu bar.
Step 4
This step, like Step 2, applies only if you use FileVault. Log in as usual, then select
 ▹ Log Out...
from the menu bar, or press the key combination shift-command-Q. Don't restart. You'll be returned to the login screen.
Step 5
At the login screen, click Other... Enter "root" (without the quotes) in the Name field, and enter the password you set in Step 3 in the Password field. You should now be logged in as root. This is a potentially dangerous condition. Do nothing while logged in as root except as indicated below. You'll be fine as long as you don't deviate from the plan.
Open the Users & Groups preference pane. Select your usual administrator account in the list of users and check the box marked
Allow user to administer this computer
You'll be prompted to restart. Do that and log in as yourself—not as root. Your administrator status should now be restored.
Step 6 (optional, but recommended)
Follow the instructions in this support article under the heading "Disable the root user." You must authenticate in Directory Utility as "root" with the password you set in Step 3. Authenticating as another administrator won't work.
Credit for this idea to ASC member wessongroup.

Can not add Domain User to Local Admin Group Win8.1

Hello,
I am trying to add a domain user to the local admin account on a Win8.1 Enterprise computer. When I click the check name button it asks me to enter network credentials even though I am signed in to the computer with a domain admin account. When I try to
type in any of my domain admin accounts it says "The Username or Password is incorrect". Even though I used that same account to login with. I can successfully ping all 3 of my DCs from the computer and have tried putting my second DC as the primary
DNS and my third DC as the primary DC and same problem. I have checked for Active Directory errors on the DC and everything says it is running fine on the DC in server manager. I have this problem on multiple computers. Some of the computers it will work on
but 90% of them it won't allow me to add the local user to the local admin group.
DCs are running Win Server 2008 R2 Enterprise.
Any help would be greatly appreciated.
Thank You

I would suggest you to use Restricted Group(via GPO) to add domain users/group to a local admins group
1)Create a new group in Active Driectory
Create a new group in Active Driectory that you wish to add to every workstations local administrator group. DO NOT add any users to this group at this time.
2.
Create a new GPO
Create a new group policy object and link it to the desired OU. Make sure that the GPO you are using covers the OU that the WORKSTATIONS you are wanting to give users local administrative rights over.
3.
Edit the newly created GPO
Navigate within the newly created GPO to Computer Configuration -> Policies -> Windows Settings -> Security Settings --> Restricted Groups
4.
Add your new Active Directory group to the Restricted Group
Right-click the Restricted Groups folder and select "Add Group" to add your new Active Directory group to the Restricted Group. In the Group field, type the name of the newly created Active Directory group and click "OK"
5.
Add the Restricted Group to the local administrator group
In the Restricted Group Properties windows click "Add" under the section titled "This group is a member of:" Type "Administrators" (without the quotes and yes it is plural), in the Group Membership window and click "OK"
6.
Wait for GPO updates to apply to the workstations
Once your users receive their updated group policy settings every workstation within the OU you specified will have your new Active Directory group as a member of the local administrators group. If you need to force the GPO update on a specific workstation,
run "gpupdate /force" in a command window on that workstation.
7.
Add a user or group of users to the Active Directory Restricted Group
When you are ready, or in a position where you need to provide local workstation admin rights you can simply add the users or group of users to the Active Directory group that you created for use with Restricted Groups within your Active Directory Management
Console.

Adding users in Local Administrators Group using GP Restricted Group

Hi Experts.
I have approx 200 servers. There are user1, user2 and user3 which I have added in
Local Administrators Group using GP Restricted Group in all 200 servers. This works fine. In Add Group option I added "Administrator" and Added user1, user2 and user3 in "Members of this Group". Now all 3 users are reflected as a Local
Administrators member.
Now there is a need that user 4 should be in Local Administrators Group using GP Restricted Group for certain servers only. Lets say 50.
In Add Group option I added "Administrator" and Added user4 in "Members of this Group". BUT it doesn't work.
Any idea?
Regards Suman B. Singh

Hi,
How is it going? I agree with Martin. To do this, we can configure the setting in two different GPOs. For instance, in GPO1, we add user1, user2, and user3 to the local admin group; in GPO2, we add user1, user2, user3, and user4 to the local admin group;
and then we can use Security Filtering to apply the specific GPOs to specific computers.
Regarding security filtering, the following article can be referred to for more information.
Security filtering using GPMC
https://technet.microsoft.com/en-us/library/cc781988(v=ws.10).aspx
Filter Using Security Groups
https://technet.microsoft.com/en-us/library/cc752992.aspx
Besides, in addition to Restricted Groups, we can also use Group Policy Preferences Local Users and Groups to do this, in which way we can configure two Local Group items in one GPO and utilize Item-Level Targeting to apply the specific items to specific
computers.
Regarding GPP Local Users and Groups, the following article can be referred to for more information.
Configure a Local Group Item
https://technet.microsoft.com/en-us/library/cc732525.aspx
How to use Group Policy Preferences to Secure Local Administrator Groups
http://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/
Regarding Item-Level Targeting, the following article can be referred to for more information.
Preference Item-Level Targeting
https://msdn.microsoft.com/en-us/library/cc733022.aspx
Best regards,
Frank Shen

Wmi script to find out the time when the user was added to local administration group

Hi Friends,
i need a script/query based on wmi/wql that find out the time when the user was added to local administration group on this computer
Regards
Tanoj
OSLM ENGINEER - SCCM 2007 & 2012

WMI does not keep security information.
Unless you have enabled auditing, this information is not retained in any way.
If auditing is enabled, you can write a powershell script to look for the specific event in the eventlog. More specifically, you should look for all security events with id 4732 containing the group.
this one command does the trick
get-eventlog -logname security -instanceid 4732 -message *administrators*
https://technet.microsoft.com/en-us/library/dd772663(v=ws.10).aspx
MCP/MCSA/MCTS/MCITP

How to access Portal Logged in user in Web Service application

Hi Experts,
I have created one Deployable Proxy and based on that i have created Web Based (WAR) project. to consume the proxy i have created Servlet based java file which invokes Web services. Based on this WAR project i created EAR application which deploys on J2EE server.
I am facing issue while accessing Portal Logged in user in my Servlet Class in WAR project so can you please provide inputs for how we can access Portal Logged in user in our Servlet class? also how we can access LDAP detailes of portal Logged inuser ?
I tried to fetch the Logged in user from servlet request but i can't access it giving me null value. Following is the method details that i am using in my servlet.
protected void doGet(HttpServletRequest request,HttpServletResponse response)throws ServletException, IOException
IUser user = UMFactory.getAuthenticator().getLoggedInUser();
String strName = user.getFirstName();
If I checked in LDAP values First name for logged in user is present but in my code its giving Null value.
Can you please provide your inputs on above issue.
Regards,
Rahul

have you found a solution this problem yet?

How to show current logged in user image in Master Page

Hi,
I am trying to show logged in user image next to his name, following this article
http://erikswenson.blogspot.in/2011/04/display-user-profile-picture-next-to.html
I am trying to do this in SharePoint 2013, so i put Reference
in .Master file & Control in . html file
Picture is not visible and when i tried to find whether the control has been loaded or not, the control also hasn't been loaded.
Please tell me, how could i do this?

This is not that hard to do, simply go into your masterpage (Design Manager) and copy and paste this on the top of the page:
<%@ Register tagprefix="SPSWC" namespace="Microsoft.SharePoint.Portal.WebControls" assembly="Microsoft.SharePoint.Portal, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" %>
Once that is done, you can now add this:
<SPSWC:ProfilePropertyLoader runat="server" />
<SPSWC:ProfilePropertyImage PropertyName="PictureUrl" ResizeToFit="115" ShowPlaceholder="true" id="PictureUrlImage" runat="server"/>
To the location where you want the image to be shown. If you have a custom HTML page that you built out, just add it the same way. Let me know if you have any questions.
-G

How to determine the logged in user - BI Publisher

Hi,
I am building a SQL based BI Publisher report. I am using BI Publisher integrated with the E-Business Suite so all ebiz users can log in to BI Publisher
I have a requirement that my parameter LOV query is to be restricted based on the BI publisher logged in user. I have the necessary select statement which just requires the logged in user to be supplied. But I don't know if there is any standard BI variables which I can use in my SQL Query
Thanks
Shasik
Edited by: Shasik on Sep 14, 2008 1:04 AM

Hi Shashi,
http://winrichman.blogspot.com/2008/09/how-to-get-logged-in-obiee.html
Use the available XDO session variables like :xdo_user_name
Select :xdo_user_name from dual wil fetch you , the Logged in USER :)

How to get current logged-in user name in data access driver or in universe

In universe, to get the current log in user is via @Variable('BOUSER').
Right now, I need to be able to get the user name in the data access driver. I am writing a customized data access driver because we need to patch some where clause on the the query generated by the universe based on the logged-in user info. I only think of using end_sql parameter or adding an universe level filter to patch the @Variable('BOUSER') to the query, which would not work if user want to use customized query.
Can anyone tell me how to get currentBO user name from connection server ? or how @Variable('BOUSER') is translated into the logged-in user name in the universe?

I do not know your EJB Service. But you should pass the credentials of the current logged on portal user to your service. That's not by default I think.
I had a similar problem with CAF developed webservices. I had to turn on permission checks in my web service and passed the credentials via logon ticket.
Regards, Bernd

OIM11gr2 - How to get currently logged in user details using oim api

Hi All,
I have a requirement to retrieve currently logged in users profile in the process adapter.
I have tried with getSelfProfile in tcUserOperation and also ContextManager.getOIMUser API's however, in both the cases i am getting xelsysadm details only.
Also as know request details in Process task mapping doesnot work for OIM11g onwards (its returning column not found exception )
DOes any one has idea how to achieve this.
PS. - i am using platform to retrieve API's.
Thanks & Regards
Swati Pandey

You can get the logged in user name using the below java code:
ADFContext adfCtx = ADFContext.getCurrent();
SecurityContext secCntx = adfCtx.getSecurityContext();
String user = secCntx.getUserPrincipal().getName();
HTH

How to check logged in user belongs to particular group using workflow

HI All,
I have a list and I want o implement row level security based on the list filed called Relevant group.
I have a list filed called RelevantGroup , this filed is a choice filed and it has couple of SharePoint site's groups that I have created. Now what I want to do is give current logged in user to edit the record based on his/her security group. For example
if I logged in and if I m a member of the current record RelevantGroup I can edit the record, if I m not a member of the RelevantGroup then the system shouldn't allow to edit the record.
I want to do this SharePoint designer workflow. Can someone please help me. Using SPD2013.
Thanks.
d.n weerasinghe

Is the form being served up from livecycle? If not how is the form being served up to the user?

How to add first log on user to local administrator group

Similar Messages

Maybe you are looking for