I am trying to write a simple powershell script that ads a domain user to the local admin group on windows machines, and then after 30 Minutes removes them. This is what I have so far.
Param(
[string]$machineName,
[string]$group,
[string]$user
)
$objUser = [ADSI]("WinNT://$user")
$objGroup = [ADSI]("WinNT://$machineName/$group")
$objGroup.PSBase.Invoke("Add",$objUser.PSBase.Path)
sleep 1800
$objGroup.PSBase.Invoke("Remove",$objUser.PSBase.Path)
This script is called with three parameters, and works great. The user is inserted into the group, and 30 Minutes later they are removed.
The last bit I need help on is forcing windows to realize that the user is no longer an admin after 30 minutes...
Currently the user must log off and back in to realize the admin permissions, which I am fine with, but I do not want them to be able to keep the perms past 30 Minutes. How can I force this to happen? Even after being removed from the group, they still can perform admin tasks until they log off.
Thanks in advance.