Adding domain user to local groups

microsoft.public.dotnet.framework.aspnet

23 Dec 2005 12:19 AM

Rocky

Hi,

I have a webform, with 2 textboxs and a submit button. In the text box1, i
enter a username and in textbox2 I enter the computer name. Both the username
and computer name is in active directory.

When i click submit, I want to add the username from textbox1 into the local
administrators group on the computer name from textbox2.

I want to use vb.net as the programming language.

can someone please give me some code examples on how i should do this?

Thank yo so much!

23 Dec 2005 2:55 AM

Lau Lei Cheong

I think this is a bad idea. You're going to impersonate the web
application's running identity to by the "domain admins" to do this, and
this can lead to all kinds of trouble if your web site is being attacked.

Show quoteHide quote

"Rocky" <Ro***@discussions.microsoft.com> ¼¶¼g©ó¶l¥ó·s»D:2683A90C-0102-4A4E-8AF2-76FDFF6ED***@microsoft.com...
> Hi,
>
> I have a webform, with 2 textboxs and a submit button. In the text box1, i
> enter a username and in textbox2 I enter the computer name. Both the
> username
> and computer name is in active directory.
>
> When i click submit, I want to add the username from textbox1 into the
> local
> administrators group on the computer name from textbox2.
>
> I want to use vb.net as the programming language.
>
> can someone please give me some code examples on how i should do this?
>
> Thank yo so much!

Are all your drivers up to date? click for free checkup

23 Dec 2005 7:33 AM

Rocky

I don't want to add to the domain admins, i want to add to the LOCAL Admins
of a machine.

Show quoteHide quote

"Lau Lei Cheong" wrote:

> I think this is a bad idea. You're going to impersonate the web
> application's running identity to by the "domain admins" to do this, and
> this can lead to all kinds of trouble if your web site is being attacked.
>
> "Rocky" <Ro***@discussions.microsoft.com> Â¼Â¶Â¼gÂ©Ã³Â¶lÂ¥Ã³Â·sÂ»D:2683A90C-0102-4A4E-8AF2-76FDFF6ED***@microsoft.com...
> > Hi,
> >
> > I have a webform, with 2 textboxs and a submit button. In the text box1, i
> > enter a username and in textbox2 I enter the computer name. Both the
> > username
> > and computer name is in active directory.
> >
> > When i click submit, I want to add the username from textbox1 into the
> > local
> > administrators group on the computer name from textbox2.
> >
> > I want to use vb.net as the programming language.
> >
> > can someone please give me some code examples on how i should do this?
> >
> > Thank yo so much!
>
>
>

23 Dec 2005 8:14 AM

Lau Lei Cheong

But you need the Web Application to be run as "domain admins" to add a user
to administrators group of "Any computer in domain"

This is obvious. To add the user in "local administrators" group you'll also
need to be one of the members in the group, and the only AD entry
that is "local administrators" of all computers in the domain is the "domain
admin" group.

If you create other group/user that is the "local administrators" of all
computers in the domain, you're creating another "domain admin"
group/user anyway, and will have similar security risk.

Show quoteHide quote

"Rocky" <Ro***@discussions.microsoft.com> ¼¶¼g©ó¶l¥ó·s»D:85891402-CAF8-4665-8E8C-8DD03BE7E***@microsoft.com...
>I don't want to add to the domain admins, i want to add to the LOCAL Admins
> of a machine.
>
> "Lau Lei Cheong" wrote:
>
>> I think this is a bad idea. You're going to impersonate the web
>> application's running identity to by the "domain admins" to do this, and
>> this can lead to all kinds of trouble if your web site is being attacked.
>>
>> "Rocky" <Ro***@discussions.microsoft.com> ???gco?l¢Do¡Ps?D:2683A90C-0102-4A4E-8AF2-76FDFF6ED***@microsoft.com...
>>
>> > Hi,
>> >
>> > I have a webform, with 2 textboxs and a submit button. In the text
>> > box1, i
>> > enter a username and in textbox2 I enter the computer name. Both the
>> > username
>> > and computer name is in active directory.
>> >
>> > When i click submit, I want to add the username from textbox1 into the
>> > local
>> > administrators group on the computer name from textbox2.
>> >
>> > I want to use vb.net as the programming language.
>> >
>> > can someone please give me some code examples on how i should do this?
>> >
>> > Thank yo so much!
>>
>>
>>

27 Dec 2005 6:32 AM

Rocky

I know i need to run it as a domain admin, i know i have to be one of the
members, i know all the security risks. MY QUESTION IS HOW DO I DO IT?????
WHAT IS THE ASP.NET AND VB.NET
CODE??????????????????????????????????????????????/

Show quoteHide quote

"Lau Lei Cheong" wrote:

> But you need the Web Application to be run as "domain admins" to add a user
> to administrators group of "Any computer in domain"
>
> This is obvious. To add the user in "local administrators" group you'll also
> need to be one of the members in the group, and the only AD entry
> that is "local administrators" of all computers in the domain is the "domain
> admin" group.
>
> If you create other group/user that is the "local administrators" of all
> computers in the domain, you're creating another "domain admin"
> group/user anyway, and will have similar security risk.
>
> "Rocky" <Ro***@discussions.microsoft.com> Â¼Â¶Â¼gÂ©Ã³Â¶lÂ¥Ã³Â·sÂ»D:85891402-CAF8-4665-8E8C-8DD03BE7E***@microsoft.com...
> >I don't want to add to the domain admins, i want to add to the LOCAL Admins
> > of a machine.
> >
> > "Lau Lei Cheong" wrote:
> >
> >> I think this is a bad idea. You're going to impersonate the web
> >> application's running identity to by the "domain admins" to do this, and
> >> this can lead to all kinds of trouble if your web site is being attacked.
> >>
> >> "Rocky" <Ro***@discussions.microsoft.com> ???gco?lÂ¢DoÂ¡Ps?D:2683A90C-0102-4A4E-8AF2-76FDFF6ED***@microsoft.com...
> >>
> >> > Hi,
> >> >
> >> > I have a webform, with 2 textboxs and a submit button. In the text
> >> > box1, i
> >> > enter a username and in textbox2 I enter the computer name. Both the
> >> > username
> >> > and computer name is in active directory.
> >> >
> >> > When i click submit, I want to add the username from textbox1 into the
> >> > local
> >> > administrators group on the computer name from textbox2.
> >> >
> >> > I want to use vb.net as the programming language.
> >> >
> >> > can someone please give me some code examples on how i should do this?
> >> >
> >> > Thank yo so much!
> >>
> >>
> >>
>
>
>

28 Dec 2005 2:34 AM

Lau Lei Cheong

Ok, having reminded you about the security risks, here are probably what you
want:

a VB script that will allow the chang of the local admin password from a
remote box
http://www.experts-exchange.com/Security/Win_Security/Q_20946526.html

Add User to Group w/COM
http://www.adminscripteditor.com/scriptlibrary/view.asp?id=44

Although the above 2 are not the direct anwser, but you should have no
problem combine both to get what you want.

Show quoteHide quote

"Rocky" <Ro***@discussions.microsoft.com> ¼¶¼g©ó¶l¥ó·s»D:DA202D5F-2596-4A4C-B80C-5DD7B2A71***@microsoft.com...
>I know i need to run it as a domain admin, i know i have to be one of the
> members, i know all the security risks. MY QUESTION IS HOW DO I DO IT?????
> WHAT IS THE ASP.NET AND VB.NET
> CODE??????????????????????????????????????????????/
>
> "Lau Lei Cheong" wrote:
>
>> But you need the Web Application to be run as "domain admins" to add a
>> user
>> to administrators group of "Any computer in domain"
>>
>> This is obvious. To add the user in "local administrators" group you'll
>> also
>> need to be one of the members in the group, and the only AD entry
>> that is "local administrators" of all computers in the domain is the
>> "domain
>> admin" group.
>>
>> If you create other group/user that is the "local administrators" of all
>> computers in the domain, you're creating another "domain admin"
>> group/user anyway, and will have similar security risk.
>>
>> "Rocky" <Ro***@discussions.microsoft.com> ???gco?l¢Do¡Ps?D:85891402-CAF8-4665-8E8C-8DD03BE7E***@microsoft.com...
>>
>> >I don't want to add to the domain admins, i want to add to the LOCAL
>> >Admins
>> > of a machine.
>> >
>> > "Lau Lei Cheong" wrote:
>> >
>> >> I think this is a bad idea. You're going to impersonate the web
>> >> application's running identity to by the "domain admins" to do this,
>> >> and
>> >> this can lead to all kinds of trouble if your web site is being
>> >> attacked.
>> >>
>> >> "Rocky" <Ro***@discussions.microsoft.com> ???gco?l¢FDo!Ps?D:2683A90C-0102-4A4E-8AF2-76FDFF6ED***@microsoft.com...
>> >>
>> >> > Hi,
>> >> >
>> >> > I have a webform, with 2 textboxs and a submit button. In the text
>> >> > box1, i
>> >> > enter a username and in textbox2 I enter the computer name. Both the
>> >> > username
>> >> > and computer name is in active directory.
>> >> >
>> >> > When i click submit, I want to add the username from textbox1 into
>> >> > the
>> >> > local
>> >> > administrators group on the computer name from textbox2.
>> >> >
>> >> > I want to use vb.net as the programming language.
>> >> >
>> >> > can someone please give me some code examples on how i should do
>> >> > this?
>> >> >
>> >> > Thank yo so much!
>> >>
>> >>
>> >>
>>
>>
>>