Creating Administrator Accounts

The final desktop setup task that Tom wants to tackle is the automated creation of two user accounts. One of these accounts will be used as an emergency account that will provide Tom with the ability to locally log on to a user's computer in the event that a problem occurs. The other account will be used to configure scheduled tasks, such as the execution of the defrag script, that require administrative level privileges in order to execute.

Creating a Local Administrator Account

Tom's final scripting assignment is to develop a script that will create the following user accounts:

• ADMA01. A local desktop management account that is a member of the local administrators group. Tom will use this account only in the event that he needs to locally log on to the computer to resolve a problem or perform emergency maintenance.
• ASAT01. A local scheduling account that is a member of the local administrators group, giving the account sufficient security privileges to run any script set up as a scheduled task.

Tom plans to write down the passwords associated with these two accounts (on a computer-by-computer basis) and to store them in sealed envelopes that he will lock up in the corporate safe, where they can be retrieved in an emergency.

Options for Manually Creating New User Accounts

Windows XP Professional provides Tom with two different utilities that can be used to create local user accounts. These utilities are listed below.

• The User Accounts folder
• The Local Users and Groups snap-in

The User Accounts folder is found on the Windows XP Control Panel. It provides only limited control over the creation of a new account. It can be used to create, modify, and delete user accounts but has only limited control over account features such as the assignment of group membership. The Local Users and Groups snap-in can be found in the Computer Management console. The Computer Management console is a built-in MMC (Microsoft management console) that can be used to perform a number of computer administration tasks, including user account creation and management.

Using the Local User and Groups Snap In

Ordinarily, Tom would create the desktop management and schedule administrative accounts by hand using the Local Users and Groups snap-in. The following procedure outlines the steps that Tom goes through when manually creating the local ADMA01 desktop management account using this snap-in. This same procedure can also be used to create the local ASAT01 scheduling account.

1. Click on Start, right-click on My Computer, and select Manage. The Computer Management console opens, as shown in Figure 15.1.

   Figure 15.1: Using the Computer Management console to manually administer user accounts

2. If necessary, expand the System Tools node in the console tree.
3. Expand the Local Users and Groups node.
4. Select the Users node. A list of user accounts defined in the computer's local security database is displayed in the right-hand pane of the Computer Management console, demonstrated in Figure 15.2.

   Figure 15.2: Examining currently defined user accounts on the Windows XP computer

5. Right-click on Users and select New User. The New User dialog box opens, as shown in Figure 15.3.

   Figure 15.3: Assign a username and password to the new user account

6. Type ADMT01 in the User name field. Type Desktop Management Acct in the Full name field, Emergency Backdoor Desktop Management Acct in the Description field, and a password in the Password and Confirm password fields.

   Note

   Tom assigns different passwords to each account and never uses the same passwords again on other computers. To ensure that he is creating a strong password, he always makes them 10 characters long, never uses words or phrases, and always includes a combination of numbers, special characters, and uppercase and lowercase letters.

7. Select Password never expires to prevent the account's password from expiring and locking the account until its password is changed.
8. Click on Create and then Close.
9. The new account will appear in the right-hand pane of the Computer Management console. Right-click on it and then select Properties. The account's properties dialog box appears.
10. Select the Member of property sheet, as shown in Figure 15.4. By default the new account is made a member of the local Users group.

    Figure 15.4: Examining the new account's group memberships

11. Click on Add. The Select Groups dialog box appears.
12. Click on Advanced. The Select Groups dialog box expands to show additional options.
13. Click on Find Now. A list of local group accounts will be displayed, as shown in Figure 15.5. Table 15.1 lists and describes the built-in local groups listed in Figure 15.5.

    Figure 15.5: Locating local group accounts to which the user account may be added

    Table 15.1: Windows XP Professional's Built-in Local Group Accounts

    Local Group Account	Description
    Administrators	Provides its members with control over all computer resources as well as the ability to perform any Windows administration task.
    Backup Operators	Provides its members with the ability to back up and restore all files stored on the computer.
    Guests	Contains the Guest account which provides very limited access to computer resources.
    Network Configuration Operators	Provides members with the ability to configure TCP/IP and other network-related configuration settings.
    Power Users	Provides members of this group with all the capabilities of the Users group, plus the ability to modify certain system settings and install applications.
    Remote Desktop Users	Provides members of this group with the ability to remotely connect to the computer using the Remote Assistance utility.
    Replicator	This group is not used to administer user accounts. Instead, it is used by the operation system to support domain replication.
    Users	Provides members of this group with the ability to run applications, work with files, submit print jobs, turn off the computer, and perform an assortment of nonadministrative tasks.
    HelpServicesGroup	This group is not used to administer user accounts. Instead it is used by the operating system to support the Help and Support Center service.

14. Select the Administrators group and click on OK twice.
15. The local Administrators group is now displayed as one of the groups to which the account has been added. Click on OK.
16. Close the Computer Management console.

Table 15.1 provides a complete list of Windows XP Professional's built-in collection of local group accounts.

Net Commands

In researching his options for scripting the creation of local user accounts on computers running Windows XP Professional, Tom determined that he wanted to use either the Windows XP Net User command or the Windows XP Resource Kit's Addusers command-line utility.

The Addusers command-line utility provides the ability to create new accounts and configure account passwords as nonexpiring. Unfortunately, when Tom requested the funds to purchase the Windows XP Resource Kit, he was told that given the capital outlay the company has already committed to upgrading its desktop infrastructure, there were not additional funds available at this time.

Net User

Tom's plan is to use the WshShell object's Run() method to execute the Windows XP Net User command and automate the creation of the two new user accounts. The Net User command can be used in several different ways. The syntax for each of the forms of the Net User command is outlined below.

net user [username [password | *] [options]] [/domain] net user [username {password | *} /add [options] [/domain] net user [username [/delete] [/domain]

When Net User is executed without arguments, it displays a list of user accounts on the local computer. Username specifies the account name to be added, deleted, modified, or viewed. Password is used to assign a password to a new account or change the password of an existing account. The asterisk symbol * prompts for the password. The /domain parameter causes the account to be created on the domain that is currently logged on. The /add parameter defines an add operation and the /delete parameter defines a delete operation. Finally, the options parameter specifies a list of one or more optional subparameters that sets specific account attributes. Table 15.2 defines the list of parameters that are available as options for the Net User command.

The following VBScript statements demonstrate how to use the Net User command to automate the creation of a user account named TestAcct and assign it an initial password of Wql#5?yi.

Set WshShl = WScript.CreateObject("WScript.Shell") WshShl.Run "net user TestAcct Wql#5?yi /add", 0

Similarly, the same account could have been defined at a Windows domain level by adding the /domain parameter, as demonstrated below.

Set WshShl = WScript.CreateObject("WScript.Shell") WshShl.Run "net user TestAcct Wql#5?yi /add /domain", 0

Unfortunately, the Net User command has one drawback. You cannot use it to create or configure user accounts with passwords that do not expire. This will cause a problem for Tom because these passwords assigned to the ADMA01 and ASAT01 accounts will eventually expire, in effect disabling the accounts until Tom changes their passwords. Although this will not impact the usefulness of the desktop management account, it affects the scheduler account and can cause the defrag script to fail when it executes. To get around this issue, Tom will have to manually modify the user account to set its password to nonexpiring after the script has created it.

Net Localgroup

In addition to the Net User command, which provides the ability to create, modify, and delete local and domain user accounts, Tom needs a way to automate the addition of user accounts to the local administrators group. After looking around, he has discovered that he can use another Windows command to perform this task. This command is the Net Localgroup command, which provides the ability to add user accounts to local groups on both the local computer and a Windows domain.

The Net Localgroup command can be used in several different ways. The syntax for each of these forms of the Net Localgroup command is outlined below.

net localgroup [groupname [/comment:"text"]] [/domain] net localgroup groupname {/add [/comment:"text"] | /delete} [/domain] net localgroup groupname name [...] {/add | /delete} [/domain]

When Net Localgroup is executed without arguments, it displays the name of the computer and the local groups defined on that computer. Groupname specifies the name of the local group to be administered. The /comment:"text" parameter adds or modifies a comment to a new or existing group. Specifying /domain causes the operation to occur on the domain level instead of the local computer. The name [ …] parameter is used to list one or more usernames or group names to be added or removed from a local group. The /add parameter specifies an add operation and /delete specifies a delete operation.

Creating a Login Script

At this point, Tom has reviewed the manual account creation process and has identified the Windows commands that he will need to use when developing the VBScript that will automate account creation. He is now ready to write the script. As with the previous scripts, Tom will develop it in a modular fashion. First he will define the statements that make up the Initialization Section and Main Processing Section and then he will develop each of the script's functions and subroutines.

The Initialization Section

As with all his other scripts, Tom begins by specifying the Option Explicit and the On Error Resume Next statements, as shown below.

'Initialization Section Option Explicit On Error Resume Next

The reason for adding the On Error Resume Next statement is to prevent the scripts from terminating in the event of an error and to provide the ability to interrogate the return status of each command after it executes. This way, if for some reason the script should run into an error when trying to create the first user account, it can continue to run and try and create the second account.

Next, a constant is defined that will be used to display a title bar message in all pop-up dialog boxes generated by the script. This will provide for a consistent and professional-looking presentation.

Const cTitlebarMsg = "Administrative Account Creator"

The next four statements, shown below, define a number of variables used by the script. The first variable represents the WshShell object and the rest of the defined variables used in the script's Main Processing Section.

Dim WshShl Dim intRunStatus Dim strDskMgtAcct Dim strSchedAcct

Next, an instance of the WshShell object is set up, as shown below, in order to later facilitate the use of the Net User and Net Localgroup commands using this object's Run() method.

'Instantiate the WshShell object Set WshShl = WScript.CreateObject("WScript.Shell")

The last two statements in the Initialization Section assign values to the strDskMgtAcct and strSchedAcct variables. These values represent the names of the desktop management and scheduling accounts that are to be created by the script.

strDskMgtAcct = "ADMA01" strSchedAcct = "ASAT01"

The Main Processing Section

The Script's Main Processing section begins by calling the CallRunVerification() function, as shown below.

'Get permission to proceed intRunStatus = CallRunVerification()

This function displays a pop-up dialog box asking for permission to continue executing the script. It returns a value of 6 if permission is granted. The value returned by the function is assigned to the intRunStatus variable, allowing it to be interrogated, as shown below.

If intRunStatus = 6 Then 'Call the procedure that creates new accounts CreateAdminAcct(strDskMgtAcct) CreateAdminAcct(strSchedAcct) End If

If a value of 6 is returned by the function, then two new procedure calls are executed. In both instances the same procedure is called. This procedure is named CreateAdminAcct(). It is written as a subroutine because it does not need to return any information back to its calling statement. It is designed to accept and process one argument. This argument is the name of the account that it is to create. The first statement that calls this subroutine passes it the strDskMgtAcct variable, representing the name of the desktop management account. The second statement that calls this subroutine passes it the strSchedAcct variable, which represents the name of the scheduling management account.

The script's Main Processing Section ends like all earlier scripts by executing the WScript object's Quit() method, as shown below.

'Terminate script execution WScript.Quit()

The CallRunVerification() Function

The CallRunVerification() function is designed to display the pop-up dialog box shown in Figure 15.6 in order to confirm its execution.

Figure 15.6: Using VBScript's built-in MsgBox() function to create a confirmation prompt

The CallRunVerification() function, shown below, begins by defining a localized variable called strMsgText. It then assigns a text string to this variable. In order to make the text string more readable, the VBScript vbTab and vbCrLf string formatting constants are used to restructure the string's presentation within the pop-up dialog box. The MsgBox() function is then executed and passed three arguments. The first argument is the value assigned to the strMsgText variable.

Function CallRunVerification() Dim strMsgText 'Display the splash screen and ask the user if he or she wants to play strMsgText = "This script will create the following Administrative level" & _ " user accounts on the local computer:" & vbTab & vbCrLf & vbCrLf & _ strDskMgtAcct & " - A Desktop Management Administrative Account" & vbCrLf & _ strSchedAcct & " - A Admin level user account used to run scheduled tasks" & _ vbCrLf & vbCrLf & "Do you wish to continue?" CallRunVerification = MsgBox(strMsgText, 36, cTitlebarMsg) End Function

The second argument passed to the MsgBox() function is 36. This number represents the accumulation of the numeric values assigned to the vbYesNo (that is, 4) and vbQuestion (that is, 32) constants. The net effect of this argument is to display a pop-up dialog box that displays the Yes and No buttons along with a graphic question mark icon.

The third and final argument passed to the MsgBox() function is cTitlebarMsg. This argument represents the constant defined in the script's Initialization Section that specifies a standard title bar message to be used in all pop-up dialog boxes displayed by the script.

The CreateAdminAcct() Subroutine

The CreateAdminAcct() subroutine, shown below, is responsible for the actual creation of user accounts as well as for their addition to the local administrators group. It accepts and processes one argument, called strNewAcctName, that is passed to it as input. This variable will contain the name of the user account that the subroutine is to create. It begins by defining two localized variables. The first variable is strPasswd and it will be used to store the password for the account. The second variable is intCmdResult. It will be used to store the return code generated by the Net User and Net Localgroup commands. The strCmdResult value is then assigned a initial default value of 0.

The subroutine then calls the GetValidPassword() function, which prompts for the specification of a valid password. The value returned by this function call is then assigned to the strPasswd variable.

Sub CreateAdminAcct(strNewAcctName) Dim strPasswd Dim intCmdResult intCmdResult = 0 strPasswd = GetValidPasswd() 'Create the new account intCmdResult = WshShl.Run("net user " & strNewAcctName & " " & _ strPasswd & " /add", 0) 'Add the account to the local administrators group If intCmdResult = 0 then intCmdResult= WshShl.Run("net localgroup Administrators /add " & _ strNewAcctName, 0) If intCmdResult <> 0 then MsgBox "Error Code 2: Account creation failed for " & _ strNewAcctName, , cTitlebarMsg Else MsgBox "Account creation successful for " & strNewAcctName, , cTitlebarMsg End If Else If intCmdResult <> 0 then MsgBox "Error Code 1: Account creation failed for " & _ strNewAcctName, , cTitlebarMsg End If End If End Sub

Next, the subroutine executes the WshShell object's Run() method, passing it the Net User command, the strNewAcctName variable, the strPasswd variable, the /add option, and a 0 (which causes the command to run hidden in the background). The result of this command is stored in the intCmdResult variable, which is then checked to ensure that an error has not occurred. If the return code generated by the command was not zero (that is, an error occurred), then an error message is displayed. Otherwise the WshShell object's Run() method is executed again, this time to process the Net Localgroup command. The result of this command's execution is then checked. If all goes well, a pop-up dialog box like the one shown in Figure 15.7 will be displayed.

Figure 15.7: A message is displayed for each account that is successfully created

The GetValidPasswd() Function

The script's final procedure, shown below, is a function named GetValidPassword(). Its job is to display the pop-up dialog box shown in Figure 15.8. The script begins by defining two localized variables. The strPasswd variable is used to store the password that Tom will type in and the strValidPassword variable will be used to store a variable that the function will use to test whether a valid password has been supplied.

Figure 15.8: Rather than embed passwords into the script, the script is designed to manually collect them

Function GetValidPasswd() Dim strPasswd Dim strValidPassword strValidPassword = "NO" Do Until strValidPassword = "YES" 'Prompt for a password to assign to the account strPasswd = InputBox("Type a password for the " & strDskMgtAcct & _ " account and click on OK." , cTitleBarMsg) If strPasswd = "" Then MsgBox "Password Missing: You must enter a valid 8 character " & _ "Password to continue.", , cTitlebarMsg Else If Len(strPasswd) < 8 Then MsgBox "Incorrect password length. Password must be at least " & _ "8 characters long", , cTitlebarMsg Else GetValidPasswd = strPasswd strValidPassword = "YES" End If End If Loop End Function

A Do…Until loop is set up, which iterates until a valid password is supplied. It begins by displaying a pop-up dialog box using the built-in VBScript InputBox() function. The password that is entered is then interrogated to ensure that it is not blank (that is, either the Cancel button was clicked or the OK button was clicked without a password being typed).

The length of the password is then checked to ensure that it is at least eight characters long. If the value assigned to strPasswd is blank or is less than eight characters long, an error message is displayed and a new pop-up dialog box is displayed to once again try and collect a valid password. Once a valid password is entered, its value is assigned to GetValidPassword (a variable with the same name as the function) in order to return it to the statement that called in the function the first place. Then, to break out of the Do…Until loop, the value of strValidPassword is set equal to YES.

The Fully Assembled Script

The entire administrative account creation script is assembled below. When executed, it will create both administrative level management accounts. It will then be up to Tom to remember to set the password for the ASAT01 account to non-expiring in order to prevent the account from getting locked out, which would prevent the execution of the defrag script. Tom will also have to modify the scheduled task that runs the defrag script to run using this account.

'************************************************************************* 'Script Name: Script 15.1.vbs 'Author: Jerry Ford 'Created: 03/15/03 'Description: This script creates 2 administrative level user accounts. 'One provides the Desktop Support Team with a backdoor into the computer. 'The other provides sufficient access to run scheduled administrative 'scripts. '************************************************************************* 'Initialization Section Option Explicit On Error Resume Next Const cTitlebarMsg = "Administrative Account Creator" Dim WshShl Dim intRunStatus Dim strDskMgtAcct Dim strSchedAcct 'Instantiate the WshShell object Set WshShl = WScript.CreateObject("WScript.Shell") strDskMgtAcct = "ADMA01" strSchedAcct = "ASAT01" 'Main Processing Section 'Get permission to proceed intRunStatus = CallRunVerification() If intRunStatus = 6 Then 'Call the procedure that creates new accounts CreateAdminAcct(strDskMgtAcct) CreateAdminAcct(strSchedAcct) End If 'Terminate script execution WScript.Quit() 'Procedure Section Function CallRunVerification() Dim strMsgText 'Display the splash screen and ask the user if he or she wants to play strMsgText = "This script will create the following Administrative level" & _ " user accounts on the local computer:" & vbTab & vbCrLf & vbCrLf & _ strDskMgtAcct & " - A Desktop Management Administrative Account" & vbCrLf & _ strSchedAcct & " - A Admin level user account used to run scheduled tasks" & _ vbCrLf & vbCrLf & "Do you wish to continue?" CallRunVerification = MsgBox(strMsgText, 36, cTitlebarMsg) End Function Sub CreateAdminAcct(strNewAcctName) Dim strPasswd Dim intCmdResult intCmdResult = 0 strPasswd = GetValidPasswd() 'Create the new account intCmdResult = WshShl.Run("net user " & strNewAcctName & " " & _ strPasswd & " /add", 0) 'Add the account to the local administrators group If intCmdResult = 0 then intCmdResult= WshShl.Run("net localgroup Administrators /add " & _ strNewAcctName, 0) If intCmdResult <> 0 then MsgBox "Error Code 2: Account creation failed for " & _ strNewAcctName, , cTitlebarMsg Else MsgBox "Account creation successful for " & strNewAcctName, , cTitlebarMsg End If Else If intCmdResult <> 0 then MsgBox "Error Code 1: Account creation failed for " & _ strNewAcctName, , cTitlebarMsg End If End If End Sub 'This procedure creates a backdoor account for the desktop management team Function GetValidPasswd() Dim strPasswd Dim strValidPassword strValidPassword = "NO" Do Until strValidPassword = "YES" 'Prompt for a password to assign to the account strPasswd = InputBox("Type a password for the " & strDskMgtAcct & _ " account and click on OK." , cTitleBarMsg) If strPasswd = "" Then MsgBox "Password Missing: You must enter a valid 8 character " & _ "password to continue.", , cTitlebarMsg Else If Len(strPasswd) < 8 Then MsgBox "Incorrect password length. Password must be at " & _ "least 8 characters long", , cTitlebarMsg Else GetValidPasswd = strPasswd strValidPassword = "YES" End If End If Loop End Function

Summary

In this chapter, you reviewed the steps that are required to manually create new user accounts and add them to groups. You also learned how to script the creation of new user accounts, as well as how to add those accounts to groups. Using the techniques presented here, you can begin developing an assortment of account management scripts that can be used to create or modify user accounts on both the local computer and a Windows domain.