Oops! I almost forgot to post my scripts:
# Add Local Admin group member
#
# USAGE:
Add-LocalAdmin.ps1 computer domain user
#
param (
$computer,
$domain,
$user)
if (Test-Connection -ComputerName $computer -Quiet) {
$objUser = [ADSI]("winNT://$domain/$user")
$objGroup = [ADSI]("WinNT://$computer/Administrators")
$objGroup.PSBase.Invoke("Add",$objUser.PSBase.Path)
}
else
{
Write-Host "$computer is not responding to a ping"
Invoke-Expression "cmd.exe /c pause"
exit
}
Next, the script to remove rights now:
# Remove Local Admin group member
#
# USAGE:
Remove-LocalAdmin.ps1 computer domain user
#
param (
$computer,
$domain,
$user )
# This tool is available in the Windows 7 Resource kit or
# at
http://archive.msdn.microsoft.com/P...ShellPack:" target="_blank" rel="nofollow">http://archive.msdn.microsoft.com/P...ShellPack:
Write-Host "Importing TaskScheduler module"
Import-Module TaskScheduler # Required for the task scheduling code below to work
Write-Host "Imported TaskScheduler module"
Write-Host
Write-Host "Removing $domain\$user from Administrators' group on $computer"
if (Test-Connection -ComputerName $computer -Quiet) {
$objUser = [ADSI]("winNT://$domain/$user")
$objGroup = [ADSI]("WinNT://$computer/Administrators")
$objGroup.PSBase.Invoke("Remove",$objUser.PSBase.Path)
# Clean-up scheduled task:
Get-ScheduledTask -Name Remove-$user | Remove-Task
}
else
{
Write-Host "$computer is not responding to a ping"
Invoke-Expression "cmd.exe /c pause"
exit
}
Finally, the script to Add local administrators and schedule a task to revoke their rights in 24 hours:
# Adds a domain user to a host's local administrators group and schedules
# a task to remove the user later
# USAGE:
RevokeLater-LocalAdmin.ps1 computer domain user
param (
$computer,
$domain,
$user ) # end param
# This tool is available in the Windows 7 Resource kit or
# at
http://archive.msdn.microsoft.com/P...ShellPack:" target="_blank" rel="nofollow">http://archive.msdn.microsoft.com/P...ShellPack:
Import-Module TaskScheduler
# Required for the task scheduling code below to work
#
# First, add $user as an administrator....
#
if (Test-Connection -ComputerName $computer -Quiet) {
.\Add-LocalAdmin $computer $domain $user
Write-Host
Write-Host "Added $domain\$user to the Administrators group on $computer"
Write-Host
}
else
{
Write-Host "$computer is not responding to a ping. Correct this condition and try again."
invoke-expression "cmd.exe /c pause"
exit
}
#
# Schedule deletion for 24 hours from now
#
$removeIt = "-File C:\Scripts\LocalAdmin\Remove-LocalAdmin.ps1 $computer $domain $user"
$posh = "C:\WINDOWS\system32\windowspowershell\v1.0\powershell.exe"
Write-Host "Scheduling Remove-$user ...."
New-Task -StartWhenAvailable | `
Add-TaskTrigger -In (New-TimeSpan -Hours 24) | `
Add-TaskAction -Path $posh -Arguments $removeIt | `
Register-ScheduledTask -Name Remove-$user
#
# Features yet to be added:
# - Logging who was given rights by whom and when
# - Emailing the log weekly