Script to change the local Administrator password on Clients

[Kyle]

Does any one have a script that can be run on all the XP Clients on our domain that will change the local administrator accounts password. We have been using the same password on all the clients for a long while now and i would like to change it on all our clients (Which are all XP)

[Norphy]

There is a SysInternals tool which will change the local admin password on all of the machines on the domain

It's called PsPasswd and it's part of the PsTools suite available here

usage: pspasswd [\\computer[,computer[,...] | @file [-u username [-p password]]] Username [NewPassword]]

To change the password on all domain PCs, use \\* instead of \\<computer>

[ChrisH]

Theres also the sample code in the Microsoft Scripting Centre which you can use but Norphy's post seems to be the easiest .

[Geoff]

I have a batch file sitting in the netlogin share. It contains the following:

net user Administrator %1

If you set this up as a machine start-up script you can specify the password to set in the parameter section. Makes it a little more secure than having your local admin password embedded in the script.

[k-strider]

i do it almost the same as Geoff though i put the password in the file and then explicitly denied read access to those groups i didn't want to see it.. but i might change it now... hadn't thought of that...

[ajbritton]

I have a batch file sitting in the netlogin share. It contains the following:

net user Administrator %1

If you set this up as a machine start-up script you can specify the password to set in the parameter section. Makes it a little more secure than having your local admin password embedded in the script.

I think your parameters will be stored in an INI file which will be copied down to the PC Geoff, although I can't remember exactly where off the top of my head.

Here's another possibility...

Write an AutoIT script and embed the password as an encoded RC4 string. AutoIT can decode this then issue the command line. In addition, the script can be compiled to .EXE and password protected to prevent decompilation. Might be a bit OTT though!

I once toyed with a script that would set the Administrator password of the PC based on the MAC address, encrypted in some way. That way, it would be possible to release the Admin password of a single PC should it be necessary. You would not need to record the password as it could be regenerated using the same algorithm, given the MAC address.

[Geoff]

I think your parameters will be stored in an INI file which will be copied down to the PC Geoff, although I can't remember exactly where off the top of my head.

well it'll be in the DC's sysvol share under the GPO's GUID. However as it's a machine policy it'll only be readable by 'Domain Computers' AFAIK.

[ajbritton]

well it'll be in the DC's sysvol share under the GPO's GUID. However as it's a machine policy it'll only be readable by 'Domain Computers' AFAIK.

Some client side extensions record historical data on the PC where they execute though and if that's the case, they might just be readable by 'Power Users'. I can't say for sure exactly what is recorded, but this article suggests that it does happen.

[Geoff]

No one has Power Users group membership on my network. I don't use it as it's horribly broken. I'll have a look Monday though and see if I can hack my network from a child's account.