AddLocalUser AddLocalGroup AddLocalUserToLocalGroup AddDomainUserToLocalGroup AddDomainGroupToLocalGroup

Transcription

1 Written by Rob Zylowski Originally developed for Unidesk and posted on Sr. Solutions Architect, Unidesk Corporation Managing User or Group Permissions on Virtual Desktops When managing virtual infrastructure there are times that it becomes important to add a user or group into a virtual desktop in some systematic way. This may be because you have an application that requires the account be deployed or because you want to use the account to manage the desktops in some way. If you are using a shared image technology like VMware View Composer or Citrix Provisioning Services the changes can be made to the base image and they will propagate to all the desktops the next time that image is deployed. However, if you are using a persistent desktop model with full clone virtual desktops or something like Unidesk you will need to perform the addition on each desktop. The easiest way to do this is with GPO Preferences as long as you use a version of Active Directory that supports this. If you don t, or for some reason you can t create preferences then you can use a script to perform the work. This document outlines the use of GPO preferences and the creation of scripts that perform the following functions: AddLocalUser AddLocalGroup AddLocalUserToLocalGroup AddDomainUserToLocalGroup AddDomainGroupToLocalGroup RemoveLocalUser RemoveLocalGroup RemoveLocalUserFromLocalGroup RemoveDomainUserFromLocalGroup RemoveDomainGroupFromLocalGroup Included along with the document are the actual scripts both in PowerShell for Windows 7 and VBscript for Windows XP. Managing User or Group Permissions on Virtual Desktops Page 1

2 Editing the SAM Database using GPO Preferences If you are running your Windows Domain on Windows Server 2008 or later and using XP with Sp2 and Client Side Extensions or Windows 7 then you can use Windows Group Policy Preferences to add accounts and groups to your client systems. This is the easiest way to do this. As an aside you want to make sure that your VDI desktops are in a separate OU path from your physical systems so that you can control group policy separately. To add accounts or groups to the local SAM edit you VDI group policy and select Computer Configuration>Preferences>Control Panel Settings>Local Users and Groups. Then choose New Local User or Local Group. Obviously, if you need to add a new user to a new group you must add the user first then the group. The entries can be moved up or down after you create them. Managing User or Group Permissions on Virtual Desktops Page 2

3 You can also add a user to an existing group. Here are some examples Managing User or Group Permissions on Virtual Desktops Page 3

4 And here are the results Managing User or Group Permissions on Virtual Desktops Page 4

5 Editing the SAM Database using A Script So what can you do if you do not have access to GPO preferences? You can use a script to modify the SAM database and call that script with a normal startup GPO. Download the accompanying script to use in your layer here <link to scripts zip>. We are displaying the usage with the PowerShell script we created for Windows 7. There is also a VB script available for Windows XP. When you look at the script you will see the following functions that have been developed AddLocalUser AddLocalGroup AddLocalUserToLocalGroup AddDomainUserToLocalGroup AddDomainGroupToLocalGroup RemoveLocalUser RemoveLocalGroup RemoveLocalUserFromLocalGroup RemoveDomainUserFromLocalGroup RemoveDomainGroupFromLocalGroup You can use the script o perform any and all of these during the same run by adjusting which are called. You can do multiples by copying one line to another. It s important to get the order correct note in the example below we add a local user, then we add that user to a local group. If you use the script there are a couple of places that you must customize it. The first is right at the top where you will enter your domain in the variable global:domain = Managing User or Group Permissions on Virtual Desktops Page 5

6 Also if you add local accounts you must determine if you will set the Password Never Expires flag and the User Cannot change Password. By default in the script only the Password never expires flag is set. See the AddLocalUser Function below for more detail. Add a cmd script to run the PowerShell script into your layer In order to run the Powershell script we created we need to create a CMD script to call it then have the script run at startup using SYSTEM permissions. If we were to run in a logon script then the user would have to be an administrator to be able to run the script. In your application layer create a cmd file that will launch the PowerShell script. An example is shown here. Setting the execution policy to remotesigned allows local PowerShell scripts to run without being signed. If desired you can add a line to delete the script after it runs. This will remove any passwords you have in the script. If you did not add any users or you would rather that the script run on every startup to ensure the accoutns are wlays there do not use a del in the CMD script. Make sure you also configure and copy the PowerShell script to the c:\windows\setup\scripts folder os that is it available for the script file to call. Add a Startup GPO to Run the script Now add a GPO to run the CMD file on startup. In your VDI group policy goto Computer Configuration>Windows Settings>Scripts>Startup> And add a script pointing to c:\windows\setup\scripts\addusersandgroups.cmd Managing User or Group Permissions on Virtual Desktops Page 6

7 Scripts Created On the following pages I outline the scripts I created that you can use. Function AddLocalUser This function is used to add a new local user to a desktop. By default the password is set to never expire. If desired remove the # in line2 64 and 65 to also set user cannot change password. When the command is run you must pass it the account name, account description and the password. Managing User or Group Permissions on Virtual Desktops Page 7

8 Function AddLocalGroup This function is used to add a new local group to a desktop. When the command is run you must pass it the group name, and description. Managing User or Group Permissions on Virtual Desktops Page 8

9 Function AddLocalUserToLocalGroup This function is used to add a local user to a local group. When the command is run you must pass it the user account name, and the group name. We first check to see if the user is already in the group. If not we add it. Function AddDomainUserToLocalGroup This function is used to add a domain user to a local group. When the command is run you must pass it the user account name, and the group name. The domain is set as a global variable. We first check to see if the user is already in the group. If not we add it. Managing User or Group Permissions on Virtual Desktops Page 9

10 Function AddDomainGroupToLocalGroup This function is used to add a domain group to a local group. When the command is run you must pass it the domain group name, and the local group name. The domain is set as a global variable. We first check to see if the domain group is already in the local group. If not we add it. Managing User or Group Permissions on Virtual Desktops Page 10

11 Function RemoveLocalUser This function is used to remove a local user from a desktop. When the command is run you must pass it the account name. We check to make sure the account exists and of so we remove it. Managing User or Group Permissions on Virtual Desktops Page 11

12 Function RemoveLocalGroup This function is used to remove a local group form a desktop. When the command is run you must pass it the group name. We check to see if the group exists and if it does we delete it. Managing User or Group Permissions on Virtual Desktops Page 12

13 Function RemoveLocalUserFromLocalGroup This function is used to remove a local user from a local group. When the command is run you must pass it the user account name, and the group name. We first check to see if the user is already in the group. If so we remove it. Function RemoveDomainUserFromLocalGroup This function is used to remove a domain user from a local group. When the command is run you must pass it the user account name, and the group name. The domain is set as a global variable. We first check to see if the user is already in the group. If so we remove it. Managing User or Group Permissions on Virtual Desktops Page 13

14 Function RemoveDomainGroupFromLocalGroup This function is used to remove a domain group from a local group. When the command is run you must pass it the domain group name, and the local group name. The domain is set as a global variable. We first check to see if the domain group is already in the local group. If so we remove it. Function IsGroupMember There is one last function used in the script. This function is used to determine if a user or group is a member of a local group. It is called by all the other functions and returns a global variable as True or False. Managing User or Group Permissions on Virtual Desktops Page 14