Creating and Populating Local Groups on Remote Computers

If you plan to rebuild domain controllers (DCs) from scratch or migrate from Windows NT 4.0 SAM domains to Windows Server 2003 Active Directory (AD) domains, you can easily set group permissions by creating local groups, setting their permissions, then placing your global groups inside the local groups. (Global groups can go into local groups but not vice versa.) As soon as you add the global groups to the local groups, the global groups inherit the appropriate permission set.

However, creating local groups from the GUI is clumsy, time-consuming, and prone to typographical errors. So, I decided to automate the group creation process. I first looked into using the Net Localgroup command, which lets you create local groups from the command line rather than the GUI. However, although this command works well for creating groups on one local computer, it's not too useful for automating group creation on multiple remote computers. In addition, you can't create group or user accounts before adding them to the new local group. Rather than try to work around the Net Localgroup command's limitations, I decided to write a script. . . .