How to create local user groups in answer file


  1. Posts : 38
    Windows
       #1

    How to create local user groups in answer file


    Hello,

    As part of preparing a standardized IoT / embedded installation starting point, I'd like to create a new local user group in the answer file so that I can have an imported security setting that grants a certain permission based on that group.

    Is the only way to do this through the FirstLogonCommands of the OOBE? Is there no way to specify the group in an earlier pass (like specialize) so that the group can be specified for a user in local accounts setup?

    Thanks in advance!
      My Computer


  2. Posts : 709
    Windows 7
       #2

    RunSynchronous commands in specialize. Credentials are optional if it's a local operation (no domain).
    Code:
        <settings pass="specialize">
            <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
                <RunSynchronous>
                    <RunSynchronousCommand wcm:action="add">
                        <Order>1</Order>
                        <Description>Add local group</Description>
                        <Path>net group exec estherv ralfr stevent /add</Path>
                    </RunSynchronousCommand>
                </RunSynchronous>
            </component>
        </settings>
      My Computer


  3. Posts : 38
    Windows
    Thread Starter
       #3

    garlin said:
    RunSynchronous commands in specialize. Credentials are optional if it's a local operation (no domain).
    Code:
        <settings pass="specialize">
            <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
                <RunSynchronous>
                    <RunSynchronousCommand wcm:action="add">
                        <Order>1</Order>
                        <Description>Add local group</Description>
                        <Path>net group exec estherv ralfr stevent /add</Path>
                    </RunSynchronousCommand>
                </RunSynchronous>
            </component>
        </settings>
    Hmm...that doesn't seem to work. (I used localgroup instead of group, since I'm not working on a domain controller.)
      My Computer


  4. Posts : 709
    Windows 7
       #4

    Usually what I do for a sanity check (to see if Windows is skipping my command) is redirect output to a log file, on the same <Path> line.
      My Computer


  5. Posts : 38
    Windows
    Thread Starter
       #5

    garlin said:
    Usually what I do for a sanity check (to see if Windows is skipping my command) is redirect output to a log file, on the same <Path> line.
    That's a good idea. It looks like the commands aren't being executed at all. I have:
    Code:
            <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
                <RunSynchronous>
                    <RunSynchronousCommand wcm:action="add">
                        <Order>1</Order>
                        <Path>net.exe localgroup Application /ADD &gt;&gt; c:\install.log</Path>
                    </RunSynchronousCommand>
                    <RunSynchronousCommand wcm:action="add">
                        <Order>2</Order>
                        <Path>net.exe localgroup Administrator /ADD &gt;&gt; c:\install.log</Path>
                    </RunSynchronousCommand>
                </RunSynchronous>
            </component>
    and there is no c:\install.log after installing.

    - - - Updated - - -

    I also tried putting the full path to net.exe:

    Code:
            <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
                <RunSynchronous>
                    <RunSynchronousCommand wcm:action="add">
                        <Order>1</Order>
                        <Path>c:\Windows\System32\net.exe localgroup Application /ADD &gt;&gt; c:\install.log</Path>
                    </RunSynchronousCommand>
                    <RunSynchronousCommand wcm:action="add">
                        <Order>2</Order>
                        <Path>c:\Windows\System32\net.exe localgroup Administrator /ADD &gt;&gt; c:\install.log</Path>
                    </RunSynchronousCommand>
                </RunSynchronous>
            </component>
    Still no dice.

    Thanks for the recommendations - I guess I need to go find out why my specialize commands aren't getting executed...
    Last edited by dpengel3; 23 Feb 2023 at 13:46.
      My Computer


  6. Posts : 709
    Windows 7
       #6

    I don't think it's path issue. Check the full XML formatting, since I didn't include a full autounattend file. Most of the time when nothing runs -- the XML is missing something, or I've copied the block to the wrong place.
      My Computer


  7. Posts : 38
    Windows
    Thread Starter
       #7

    OK, it seems to be working now...weird that it didn't before. For your amusement, I went through the following sequence of tests. (By the way, I'm using WSIM to manage the answer file):

    1. What you indicated - didn't work.

    2. Added redirect to log file - didn't work and no log file created

    3. Added full path to net.exe - didn't work.

    4. Removed everything and added "cmd.exe /C mkdir c:\test" - just to see if it ran - that worked - Good

    5. Added the following sequence of commands (each a separate synchronous command, of course):

    cmd.exe /C mkdir c:\before
    cmd.exe /C net localgroup Application /ADD
    cmd.exe /C mkdir c:\after

    And it worked! Both directories created and the local group was added.

    6. Removed the surrounding "mkdir" commands - works - local group is added.

    7. Removed the "cmd.exe /C" - so now we're back to exactly what you suggested - and now it works.

    ...weird.

    But thanks for pointing me that direction. (I am not a Windows administrator and was barely aware of the "net" command.)
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 13:45.
Find Us




Windows 10 Forums