Remotely Remove a User From the Local Administrators Group

Here's an easy way to remotely remove a user from the local administrators group using Psexec

What you'll need:

• psexec
• Elevated privileges 
• Allow inbound remote administration on pc you are reaching

Pull up the command prompt. It may be good to double check what users are in the Administrators group first.

C:\>  psexec \\2E01-Computer net localgroup Administrators

Now that you know the user you want to remove, insert the command below

C:\>  psexec \\2E01-Computer net localgroup administrators User /delete

That's it.

Finding Out a Machines Uptime

This post sort of goes along with the previous "Remotely Rebooting Machines" post.

The title says all - being curious, I wanted to find out everyone's machine uptime. In other words, how long has the computer been powered on?

You need:
-psexec
-elevated privileges to access remote machines
-grep - if you want to filter out what you dont need from the command, add ".../bin" directory to your environment variables

If you run "systeminfo" from the command prompt on your machine, this is the output that we are looking for from remote machines. Also, we just need this line from the output: "System Boot Time: 6/8/2011, 7:07:01 AM" The other junk can be handy for other "curiousness'" but for this instance, Im not interested.

Create a .cmd file, paste in this command (all one line):

for /f "tokens=*" %%c in (machines.txt) do psexec \\%%c systeminfo | grep "System Boot Time:"

Create a separate text file named machines.txt in the same directory. Put all your computer names in the text file, each on a separate line. Ok, open the command prompt, adjust your screen buffer, run the .cmd file.  If you have hundreds of computers, this will take a LONG time to run.

I believe there is a way to output the results in a local text file, but I could never get it to work since I have a pipe grep at the end, however I could be doing something wrong.

Remotely Rebooting Machines

I noticed there are some machines on the network that haven't been rebooted for quite some time. As time moves along, new gpo's are created, software is updated, etc. Nonetheless, every month or two, all machines should be rebooted to pick up what has changed.

Create a .cmd file with this command in it:

for /f "tokens=*" %%c in (machines.txt) do shutdown /r /f /m \\%%c

You also need to create a txt file in the same directory that includes the machines you want rebooted. Make sure you do not include \\ in front of the computer name. If you prefer leaving \\, then revise the command above.

/r - Indicates to reboot the machine
/f - Force running applications to close without forewarning users
/m - Specify the remote computer in \\

Run your .cmd file in the command prompt window so you can see which machines errored out. You may need to adjust your screen buffer size if you have alot of machines.

C:\Reboot\RebootMachines.cmd

Note - There may be computers that are shutdown or in Sleep mode, this command will error out if it cannot contact the machine, however, it will proceed to the next machine after about 15 seconds. Keep a list of what computers errored out and visit them individually.

2E01: The entered computer name is not valid or remote shutdown is not supported on the target computer.

Also, if you dont have the proper permissions to do so, this will fail.