Execute almost any command remotely on windows using WMI.

Whenever I want perform any task remotely WMI (Windows Management Instrumentation) is my first choice. I can do whatever I want remotely, run process get information, setup configuration. It is an API to windows. I have already many article earlier one of the article is Change DNS IP address remotely. In this article I will be adding Domain group to Remote machine's local Group. My earlier article was on the same topic but it was through the Group Policy. But when I am doing it through WMI I can select the computers where I want to change settings, Contrary to apply GPO on specific Computers, I will have put those Computer Accounts in specific OU in AD, Which can be some time cumbersome to maintain Computer accounts within AD. 

Only limitation I found so far with WMI is you can not run files stored on UNC path or map UNC path directly over remote. For that you will have to do changes on remote computer Accounts in AD  (Add Trusted computer as a  delegate). My another POST.

In this article I will be adding Domain Group in Local machine Group of Remote.I have created RemoteAccess group in my AD. make a note there is no space between RemoteAccess Group account, if you dont keep any space your scripts will be successful 100%. I will be adding Domain group RemoteAccess to the local machine group name "Remote Desktop Users"

On my server i have c:\temp folder and created 2 files one is Computers.txt it contains all the list of my computers hostname and ip address.

Another file is Dos Batch file and I have named it Script.bat kept in same location C:\Temp. Containts of the Batch files are as below, I have also attached screenshot.

@echo off
FOR /f "tokens=*" %%G IN (Computers.txt) DO (
wmic /Node:%%G process call create 'net localgroup "Remote Desktop Users" vcloud\RemoteAccess /add')

As per the screenshot in case you want to change the name and location try to keep both files in same location, underlined Green text you can change accordingly your need, Don't change rest of the code.

Now open CMD Prompt on server where you will be running bat script. You don't need to run cmd as administrator, but the account you will be running this script must be administrator on the remote machine, I am using vcloud\vkunal, it is my domain admin account, by default Domain Admin is added to all machines Administrators account.

First command is cd C:\temp will take you to the directory, next dir, check all the necessary files are present. and final one is Script.bat, once it executed, you will see the return value 0, means successful. below is the meaning of all the returncode, it will help you to resolve other code.

Successful completion (0)

Access denied (2)

Insufficient privilege (3)

Unknown failure (8)

Path not found (9)

Invalid parameter (21)

Other (22–4294967295)

If you got 0 return code, go ahead and check remote computer for the changes.

WMi is very handy doing all sort of work on Windows. you can execute almost any process using WMI. if you want run such processes in my batch file just replace your code between sigle quote. Below are some of the programs you may like to run remotely.

Group Policy update (gpupdate)
Killing a process (Taskkill)
Restart services (SC)
Create local users, or change administrator password 
Getting Bios serial number using wmic bios get serialnumber
Disk information
Complete Inventory.
and many more ....

Also now you can perform same task with Powershell aswell and here it is how you can use the same.

$credentials = get-credential
$RunProc = get-wmiobject -list Win32_process -computername "ComputerName" -credential $credential
$results = $RunProc.Create( "notepad.exe" )

$results

How to - Adding AD Group to local computer Group using Group Policy

Last month I had written article on how to copy files on computers using Group Policy. This time I will be showing how to add AD Group in local machines Group, Same process can be used to create new local group. This can help to bring servers and computers in compliance. At this point I Have create one Group in AD called System Server_Administrators and I will be add this AD group vCloud.lab\server_Administrators to local machines Administrators group.
 
As a start below is the summary, In my Active Directory Users and Computers console I created OU called vCloud.lab and all my Computer accounts are in it under Computers OU. With correct step you can achieve great automation through Group Policy.

Here open Group Policy Management console from search or Administrative tools from Control Panel. Next collapse Group Policy Management >> Forest:DomainName(vCloud.lab) >> Domains >> DomainName(vCloud.lab) >> Group Policy Objects. Right click GPO (Group Policy Objects), and create a new policy. It is always best practive to have new policy for new setting instead of doing all the settings in one policy and also for any new policy create it under Group Policy Objects and link it later once your configuration is done.

Give policy some name, mine is Local_Administrators (Always use some good naming convention which I can understand afterwords). And click ok.

Now right click new created Local_Administrators policy. Edit it. To configure it,

Now collapse Computer Configuration Node >> Policies >> Windows Settings >> Security Settings >> Restricted Groups. Right click and Open Group. This will open another pop up window.

Here browse and add the Group which you want to add to Local machine Group. I have already created a group Server_Administrators in AD

Once the Group name vcloud\Server_Administrators is reflected in Group box, click OK for next.

Once you click ok this window will be closed, this group policy is created and it will be shown in right pane of Restricted Groups, here you have two options,
 
Members of this group: Use this option when you want create local group on machines. (as above step instead of browsing you can type some name for Group, it will be created on client machines) This group is member of: We are going to use this option as we want to add this AD Group to local machines Administrators. Click add button type Administrators, (Do not browse).

As per below screenshot AD Group Server_Administrators will be member of local Administrators group. Click OK button.

If everything is good as per below screenshot you should see Group name and Member of as expected. And close this GPO by clicking cross button, without this Group policy changes are not saved. (Many times I forgot this step while testing :))

Next is linking Local_Administrators GPO to OU where your computer accounts are residing, Mine are residing under vCloud.lab >> Computers. Right click Computers OU, Click Link an Existing GPO.

Select Local_Administrators GPO from the list. And click OK. This was the final configuration step on the Group Policy server.

When you see Computer OU, it will show Local_Administrators GPO as linked (shortcut icon), and also under Linked Group Policy Objects tab. Server side configuration is done now. It’s time to check on member machines.

On member computer servers (Client001 part of Computers OU), we need to verify whether changes has been applied, start run and open compmgmt.msc.

It opens Computer Management, Collapse System Tools. Go to groups under Local Users and Groups. And double click or go to properties of Administrators account.

If you check it, you won’t find group added, because it will take at least 90 mins to apply changes, This is the point where we have create GPO, linked it to OU but computers are not aware of it.

Instead of waiting for next cycle we can get policies applied immediately, for the same run “gpupdate /force” or reboot the server, Next generate the report what changes has been applied from group policy by running command “gpresult /h report.html”. You must be running cmd run as administrator to pull computer node configuration. Open report by executing command “start report.html”, It will open the web page

In this web page you can verify computer account, Group policy which has been applied, and under Computer configuration node, Restricted Groups is applied successfully. It shows everything what is failed and what is successfully applied.

Finally check Administrators properties again and hopefully you can see AD Group is added to local Group. And your PC is compliant now.