Script to add domain users to local groups on remote machines

Hello, Has anyone got any ideas how I might add a user to a local group on a remote networked Windows machine via a PHP script? The idea is to make an automated tool where users can request access to a shared folder via our intranet, and after suitable approval the system add them to a group which has read privileges for the folder in question. If I run apache using an account with suitable privileges, I've been able to do it with COM, but for security reasons I'd like to be able to authenticate through the script instead, and leave apache running on the standard local system account. Perhaps COM is the wrong way to go about the problem - perhaps exec? Any ideas gladly appreciated! Thanks, Jon.