假设某个域的管理员被解雇,您现在是
Windows 2012服务器的新管理员.在管理网络时,有些人告诉您,有些人正在使用具有管理权限的本地帐户登录计算机(他们可能已从前一个管理员那里获得此用户).现在您要做的是禁用所有本地管理员除了具有组策略的内置管理员.
我试图更改“允许本地登录”：
Computer Configuration
* Policies
* Windows Settings
* Security Settings
* Local Policies
* User Rights Assignment
但问题是,如果您将“管理员组”添加到允许的列表中,Windows只允许您执行此操作,通过这样做,我们将返回到第一个方块.
也许你问错了问题.也许您应该使用组策略中的受限制组来准确定义允许哪些人成为计算机上Administrators组的成员,而不是尝试在一堆不同的计算机上禁用一堆本地用户帐户.它将删除所有计算机上本地Administrators组中的所有帐户,但指定的帐户(或组)除外.
https://technet.microsoft.com/en-us/library/cc756802(v=ws.10).aspx
但是,如果出于某种原因,您实际上想要将本地用户帐户留在所有客户端上的本地Administrators组中,但只是禁用它们,那么您将必须开发一个脚本来执行此操作.
编辑：因为这是一个懒惰的星期六下午,我写了一个脚本,完成你所描述的.它会禁用作为Administrators组成员的所有用户本地用户帐户,但内置Administrator除外.这不是最有效的方式,但我懒得优化它.同样,为了记录,我的建议是使用组策略限制组,但我只是想做一些脚本.
# Author: Ryan Ries
# This script disables all local user accounts who are members of the Administrators group,# except for the built-in Administrator (sid-500).
# Use at your own risk.
Set-StrictMode -Version Latest
[Int]$DomainRole = (Get-WmiObject Win32_ComputerSystem).DomainRole
# Don't run if we are a domain controller.
If (($DomainRole -EQ 4) -OR ($DomainRole -EQ 5))
{
Write-Error "This script cannot be run on a domain controller."
Return
}
# We need to be an elevated administrator.
$CurrentUser = New-Object System.Security.Principal.WindowsPrincipal([System.Security.Principal.WindowsIdentity]::GetCurrent())
If (-Not($CurrentUser.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)))
{
Write-Error "$($CurrentUser.Identity.Name) is not currently an Administrator. (Need UAC elevation?)"
Return
}
Add-Type -AssemblyName System.DirectoryServices.AccountManagement
$ContextType = [System.DirectoryServices.AccountManagement.ContextType]::Machine
$Context = New-Object System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList $ContextType,$Env:COMPUTERNAME
$IDType = [System.DirectoryServices.AccountManagement.IdentityType]::SamAccountName
$Group = [System.DirectoryServices.AccountManagement.GroupPrincipal]::FindByIdentity($Context,$IDType,'Administrators')
Foreach ($Member In $Group.Members)
{
If ($Member.Sid.Value.EndsWith('-500'))
{
# This is the built-in local administrator,so we'll skip it.
Continue
}
$User = [ADSI]"WinNT://./$($Member.SamAccountName)"
$User.UserFlags = 2
$User.CommitChanges()
}
