Remotely Remove a User From the Local Administrators Group

Here's an easy way to remotely remove a user from the local administrators group using Psexec

What you'll need:

• psexec
• Elevated privileges 
• Allow inbound remote administration on pc you are reaching

Pull up the command prompt. It may be good to double check what users are in the Administrators group first.

C:\>  psexec \\2E01-Computer net localgroup Administrators

Now that you know the user you want to remove, insert the command below

C:\>  psexec \\2E01-Computer net localgroup administrators User /delete

That's it.

Malware/Viruses in the Workplace

Now that our campus is dominantly running Windows 7, I've seen MAJOR improvement on malware/virus infections on campus machines. When we were running XP, I typically cleaned about a machine or two a day. Mostly using ComboFix, Malwarebytes, and/or Microsoft FEP 2010. If those scanners didn't clean the infected machine, I'd resort to a reformat/rebuild of the OS. My time was consistently being pulled away from projects, server maintenance, etc. Thanks Windows 7!

We still have a handful of machines out there running Windows XP. My new motif (which has been quite some time now) that I've learned is that "most of the time" it's easier to just grab a different hard drive, image it, move over the files. This process is usually quicker than cleaning the infected machine and taking a chance of it not being cleaned after spending time on it. Or even the chance of lingering infections that will come back to haunt. This is something that I've learned over my desktop support years.

For on the spot imaging, we use Acronis True Image. I can image a hard drive typically in about 4 minutes, boot it up, let Win7 find the drivers and am ready to go.