Set a local username and password using GPO

[chrisjako]

I've recently7 taken over a site which has a mish mash of local admin usernames and password - sometimes we need to log in locally in order to troubleshoot

 

is there a way of universally setting a local admin username and password via GPO?

[Alkaline]

I did this ages ago I think its in the GP under computer config then windows and registry. I deployed registry keys to create the user if I remember rightly but that was some time ago.

 

edit:

 

I think I was wrong this looks like how to:

 

http://blog.korteksolutions.com/how-to-create-local-accounts-via-group-policy/

Edited December 8, 2014 by Alkaline

[tmcd35]

Which version of Windows Server are your DC's running? I think anything above 2008R2 includes Group Policy Preferences. What you want to do can be done very easily within there.

[computer_expert]

There was a windows update that removed the ability to set passwords on local users via GPP: MS14-025: Vulnerability in Group Policy Preferences could allow elevation of privilege: May 13, 2014

[chrisjako]

Yeah its 2012 R2 - i got stuck at the create new user under GPP due to the password bit

[SovietRussia]

We do the same here -

 

Create a batch script with "net user administrator password"

Deploy it on all PCs

[chrisjako]

We do the same here -

 

Create a batch script with "net user administrator password"

Deploy it on all PCs

 

This would work great if the user accounts where called 'administrator' - however unfortunately they aren't, some aren't even close to that

[SovietRussia]

This would work great if the user accounts where called 'administrator' - however unfortunately they aren't, some aren't even close to that

 

But doing this will create the account administrator - thus giving you local administrator access to the PCs.

 

You might need to enable it so:

 

net user administrator /enable:yes

net user administrator /active:yes

[Arthur]

is there a way of universally setting a local admin username and password via GPO?

AdmPwd perhaps?

 

Local admin password management solution works using GPO and custom Client-Side GPO Extension. Solution periodically changes pwd of admin account to random value; it stores current builtin admin password in AD confidential attribute on computer account.

[chrisjako]

But doing this will create the account administrator - thus giving you local administrator access to the PCs.

 

You might need to enable it so:

 

net user administrator /enable:yes

net user administrator /active:yes

 

wanted to try leave this default account disabled but at the moment its looking like the best option, thanks for the advice I'll give it a whirl

[sted]

wanted to try leave this default account disabled but at the moment its looking like the best option, thanks for the advice I'll give it a whirl

 

well just change

 

Create a batch script with "net user administrator password"

 

to Create a batch script with "net user marvin password"

 

marvin being whatever you want to call your account

[chrisjako]

well just change

 

Create a batch script with "net user administrator password"

 

to Create a batch script with "net user marvin password"

 

marvin being whatever you want to call your account

 

that doesn't work, the account already has to exist

[sted]

that doesn't work, the account already has to exist

 

ive just managed it on the pc im sat at (win7x64)

 

net user marvin password /add

 

then use gpp to add that user to local administrators group