(imported comment written by SystemAdmin)
Once you get used to the if’s of’s and item’s you will get a lot more flexibility. I am by far not the most efficient relevance writer but it should work:
You should be able to just add items separated by a semicolon as below and it will report “true” if there is a user in there that is not included in your hardcoded list.
Relevance:
q: exists (if (item 0 of it = item 1 of it) then (true) else (nothing)) of ((members of local group “Administrators” as string),(“WIN-SMD2P7N3F49\Administrator”;“WIN-SMD2P7N3F49\user1”;“WIN-SMD2P7N3F49\user2”))
A: True
T: 4.390 ms
I: singular boolean
Action:
Your best bet will probably be to build a batch file and execute that using “createfile”. I didn’t see that you could feed net.exe multiple account names in a single line.
The action will look something like this:
createfile until __EOF
@echo off
{relevance_to_create_a_batch_file_with_one_net.exe_command_per_line__see_below_for_example}
__EOF
move __createfile mybaatch.bat
rundettached cmd.exe /C mybatch.bat
Here is the relevance I would use to build my relevance substitution in the action script:
q: ( (pathname of system folder) & “\net.exe localgroup Administrators " & it & " /delete”) of (members whose (it as string != “WIN-SMD2P7N3F49\Administrator” and it as string != “WIN-SMD2P7N3F49\user1” and it as string != “WIN-SMD2P7N3F49\user2”) of local group “Administrators” as string)
A: C:\Windows\system32\net.exe localgroup Administrators WIN-SMD2P7N3F49\jjones /delete
A: C:\Windows\system32\net.exe localgroup Administrators WIN-SMD2P7N3F49\bigfix /delete
T: 4.205 ms
I: plural string
//if you need to have the double quotes around the account name and group you will have to use %22
q: ( (pathname of system folder) & “\net.exe localgroup %22Administrators%22 %22” & it & “%22 /delete”) of (members whose (it as string != “WIN-SMD2P7N3F49\Administrator” and it as string != “WIN-SMD2P7N3F49\user1” and it as string != “WIN-SMD2P7N3F49\user2”) of local group “Administrators” as string)
A: C:\Windows\system32\net.exe localgroup “Administrators” “WIN-SMD2P7N3F49\jjones” /delete
A: C:\Windows\system32\net.exe localgroup “Administrators” “WIN-SMD2P7N3F49\bigfix” /delete
T: 4.676 ms
I: plural string
So your action might look something like this:
createfile until __EOF
@echo off
{( (pathname of system folder) & “\net.exe localgroup %22Administrators%22 %22” & it & “%22 /delete”) of (members whose (it as string != “WIN-SMD2P7N3F49\Administrator” and it as string != “WIN-SMD2P7N3F49\user1” and it as string != “WIN-SMD2P7N3F49\user2”) of local group “Administrators” as string)}
__EOF
move __createfile mybaatch.bat
rundettached cmd.exe /C mybatch.bat
WARNING: I have not actually tested the execution of this. Just creating the relevance.
NOTE: A good way to help troubleshoot if it fails is:
-
Add a line that copies your “mybatch.bat” locally so you can see what is being written into it. (run it manually and see what happens)
-
add ---- 2&> “some_log.txt” — at the end of the cmd.exe to capture possilbleerrors.
GOOD LUCK!
