Download the Local Group manipulation tool.

Joe Richards writes:

Lg - Local group manipulation tool. Create/Enumerate/Delete/set the comments of local groups locally or remotely in a domain or on a specific machine. Even add/remove members of the groups. This tool works in a slightly different way in that it pulls the SIDS of the security principals and adds those to the specific group. The reason I did this is so that you could add a group from the first domain into the machine of a second domain and then move that machine into the first and have that group membership be valid.

To put it more specifically, say you have a machine in Domain A and you want to put it into Domain B and gosh darn it you have the ability to do that through delegation or something. Well when the machine moves from Domain A to Domain B, Domain A Domain Admins are gone from the administrators group and Domain B domain admins are added. But wait, you aren't a Domain B Domain Admin!!! Unless you have a local ID on that box which is an administrator ID you are locked out from making any more changes. Not anymore, now you can pre-add the group you need say "OUAdmins of the Bob OU" from Domain B to the administrators group of the machine. The SID you added will be unknown until such a time that the machine is added to the new domain at which point it will work.

Note that the tool is not aware of OU's yet so you can't create a group in a specific OU or see what OU a group exists in but that is something that I am thinking about for a future version as I actually need that functionality myself. Right now groups created land in the Users container but you can manipulate groups in OU's no problem.

G:\Dev\cpp\LG>lg \\pro1\administrators

LG V01.01.00cpp Joe Richards (joe@joeware.net) August 2002

USER    : PRO1\Administrator
GROUP   : JOEHOME\Domain Admins
BI-GROUP: NT AUTHORITY\SYSTEM
USER    : JOEHOME\Administrator

4 members listed

The command completed successfully.

Update: V1.01.00 - Added -lu option to list users in groups when doing enumeration (. option)
         of all local groups on a domain or server.
\[Version: 1.01.00, Date: 08/20/2002\]


C:\>lg /?

LG V01.01.00cpp Joe Richards (joe@joeware.net) August 2002

Usage:
 LG Group SecPrin \[switches\]

   Group         LocalGroup to work with
   Group can be specified in the following ways:
          o domain\localgroup
          o \\server\localgroup
          o localgroup

          If Group is specified as domain\. or \\server\.
          localgroups at that location are enumerated
          If Group is specified as . the localgroups on
          the local machine are enumerated


  SecPrin        Security Principal to add/remove from group

  Switches: (designated by - or /)
   -add          Add SecPrin to Group.
   -remove       Remove SecPrin from Group
   -addgroup     Add localgroup specified
   -removegroup  Remove localgroup specified
   -r computer   Specify computer to resolve SIDs. \[LOCALHOST\]
   -comment      Display LG Comments
   -setcomment   Set Comment for addgroup
   -lu           List Users (only used for . enumerate option)

  Ex1:
    lg domain\.
      Enumerate localgroups on domain

  Ex2:
    lg domain\. -lu
      Enumerate all localgroups and members on domain

  Ex3:
    lg \\computer\.
      Enumerate localgroups on computer

  Ex4:
    lg . -comment
      Enumerate localgroups and comments on localhost

  Ex5:
    lg users
      Enumerates members of localgroup users on localhost

  Ex6:
    lg \\computer\bob -addgroup -setcomment "bobs group"
      Create bob localgroup on computer with comment

  Ex7:
    lg bob -setcomment "bobs group"
      Sets comment for localgroup bob on localhost

  Ex8:
    lg users joe doug louise /add
      Adds joe, doug, and louise to localgroup joe

  Ex9:
    lg \comp1users louise -add -r comp3
      Adds SID resolved at comp3 for louise to localgroup joe on comp1


 This software is Freeware. Use it as you wish at your own risk.
 If you have improvement ideas, bugs, or just wish to say Hi, I
 receive email 24x7 and read it in a semi-regular timeframe.
 You can usually find me at joe@joeware.net