Enforcing the Membership of the Administrators Group

Managing the members of the Administrators group on computers is a common IT security task. You can use Group Policy to control the membership of a computer's Administrators group by creating a Restricted Groups policy or configuring Group Policy Preferences (GPP) for Local Users and Groups. However, computers that aren't members of an Active Directory (AD) domain can't take advantage of these features. Alternatively, some IT system administrators might not have control over Group Policy Objects (GPOs) or the organizational unit (OU) structure where the computer accounts are located.

The most common way of adding accounts to or removing accounts from the Administrators group is by using the Net Localgroup command. You can list members of the group, add members (using the /Add parameter), and delete members (using the /Delete parameter). However, the Net Localgroup command has some limitations. For one, you must specify the Administrators group by name. This can be a problem if the group is renamed or you're using different language settings. Also, the Net Localgroup command doesn't have a way to remove all accounts from a group, except for certain accounts. Finally, the Net Localgroup command can't change the membership of the Administrators group on a remote computer. It works only on the current computer.

A Better Solution: EnforceLocalAdmin.vbs

To overcome these limitations, I wrote a VBScript script, EnforceLocalAdmin.vbs, that lets you enforce the membership of the Administrators group on one or more computers. I decided to write the script using VBScript rather than PowerShell to maximize performance.

The command-line syntax of the script is as follows:

EnforceLocalAdmin.vbs "[,...]"  [/computer:"name[,...]"] [/domain] [/v]

The script's only required parameter is a comma-delimited list of one or more account names that are allowed to be members of the Administrators group. You need to list the account names following the format domainame. If you want to include a local account, you simply need to specify the account name. You must enclose the entire list of account names in quotes (").

When you run the script, it will remove all the accounts from the Administrators group, except for the list of accounts listed on the command line. After the script removes the disallowed accounts, it adds the listed accounts to the Administrators group if they're not already members.

The script can also enforce Administrators group membership on remote computers. To do this, you use the /computer parameter and specify a comma-delimited list of computer names, enclosed in quotes.

If the computer is a member of an AD domain, the script ignores domain accounts when removing disallowed accounts. If you want to include domain accounts for removal, you need to specify the /domain parameter on the script's command line.

The script runs silently by default (i.e., it produces no output). You can specify the /v (verbose) parameter if you want to see the results of the script's actions. (This is mainly useful when testing.) The output will appear in the console window if you run the script using the cscript.exe or in a message box if you run the script using wscript.exe.

EnforceLocalAdmin.vbs determines the identity of the Administrators group using its SID (S-1-5-32-544), not the English name "Administrators". This is particularly important if you're running a non-English version of Windows or if someone has renamed the group. In addition, the script ignores the built-in Administrator account when removing accounts because Windows won't allow you to remove it. (Attempting to do so will return error 1371: "Cannot perform this operation on built-in accounts.")

Table 1 shows a list of sample script commands.

Figure 1 shows an example of the script's output when running the script using cscript.exe and the /v parameter.

Figure 1: Running the Script Using cscript.exe and the /v Parameter

Script Considerations

You can download the EnforceLocalAdmin.vbs script by clicking the Download the Code button near the top of the page. When using this script, keep in mind the following considerations:

Manage Your Administrators Groups

If you don't have a domain or you don't have control over Group Policy or your OU structure, you are no longer without a solution for managing the members of the Administrators group on one or more computers. You can use the EnforceLocalAdmin.vbs script instead and ensure that only allowed accounts are members of the Administrators group.