change local admin passwords

[GoodheadDC]

Now that Microsoft has taken away the options to create and update local accounts from gpo preferences, What's the alternative to do this without scripts?

Is there one?

[computer_expert]

Local Administrator Password Solution (LAPS)

 

Worked well when I tested it on a few isolated test machines

[free780]

Just hope you never has to logon a suite with local admin account. Or you'll need counseling. I've only had to do that with conficker.

[ITGURU]

Just hope you never has to logon a suite with local admin account. Or you'll need counseling. I've only had to do that with conficker.

 

What would you do in the case of laptops in a classroom that may have lost their wireless connection with 'no logon servers' and you need to go on local to re-enable the wireless. Does the local admin account just mean the built in 'Administrator' account or does it apply to any local user account that is created with Administrators group permission?

 

I cannot imagine going into a classroom of 30 laptops to find 5 not logging on and having to bring that back to the office just to either plug in a network cable or find the local admin password through LAPS

[snagrat]

Now that Microsoft has taken away the options to create and update local accounts from gpo preferences, What's the alternative to do this without scripts?

Is there one?

 

Have they actually taken it away?

 

I still use it in a number of schools.

[ITGURU]

Have they actually taken it away?

 

I still use it in a number of schools.

 

The option is still there, but once you install one of the MS Security releases it takes the option away (hence why I've not installed the update yet).

[Marshall_IT]

The option is still there, but once you install one of the MS Security releases it takes the option away (hence why I've not installed the update yet).

 

Which MS Security release? And is it on the server or desktop?

[ITGURU]

Which MS Security release? And is it on the server or desktop?

 

I believe it may have been https://technet.microsoft.com/library/security/ms14-025 and install depends on whether you edit the GPO from server or client.

[Arthur]

@ITGURU is correct. It was MS14-025.

 

https://support.microsoft.com/en-us/kb/2962486

[BrettH]

What would you do in the case of laptops in a classroom that may have lost their wireless connection with 'no logon servers' and you need to go on local to re-enable the wireless. Does the local admin account just mean the built in 'Administrator' account or does it apply to any local user account that is created with Administrators group permission?

 

I cannot imagine going into a classroom of 30 laptops to find 5 not logging on and having to bring that back to the office just to either plug in a network cable or find the local admin password through LAPS

 

When using LAPS, as far as I understand it, the local administrator password is set in the properties of the domain computer account (attribute editor area). So, all you need is ADUC with sufficient rights and you'll be able to quickly find the local administrator password.

 

When preparing LAPS, schema modifications are done. It is these schema modifications that make it possible to store the local administrator password in Active Directory.

Edited September 4, 2015 by BrettH