Task Sequence - administrator password change

[cooka]

Hi guys,

I have a batch file that will change the local admin password to a serial number. If I run it inside the OS with admin rights it works without issue.

Is there a way I can add this to my task seq in SCCM? I have tried making a package etc but it doesn't seem to change the password - almost like it needs to be running the OS for the password to change.

Any thoughts appreciated..

Thanks

[Mustang]

You should look into LAPS instead https://technet.microsoft.com/en-us/library/security/3062591.aspx

[Guest obsidianpillar]

Hi guys,

I have a batch file that will change the local admin password to a serial number. If I run it inside the OS with admin rights it works without issue.

Is there a way I can add this to my task seq in SCCM? I have tried making a package etc but it doesn't seem to change the password - almost like it needs to be running the OS for the password to change.

Any thoughts appreciated..

Thanks

 

Run it as an application at the end of the installation process running cmd with "/admin"? OR run it as a scheduled task using a Service Account with Local Administrative rights? That's how I've deployed scripts running as Administrator in all of our environments and it's worked without issue. It's a far sight easier than fiddling with Security Settings with UAC in Group Policy.

 

I'd be interested in seeing your script to capture the Serial number and change the password, would you be able to share?

 

Cheers,

 

Tom

[cooka]

Hi Tom,

Sorry i've only just seen your message.

I currently have two scripts which can accomplish changing the admin password to a serial - both are similar.

 

CMD

for /F "skip=1 tokens=*" %%b in ('wmic bios get serialnumber') do if not defined serial set serial=%%b

net user administrator password1.password2.%serial%

 

Powershell

$servicetag = (gwmi win32_bios).SerialNumber

invoke-command { net user Administrator password1.password2.$servicetag /active:Yes }

For this to work you would need to set the execution policy to remotesigned.

 

Both find the serial from a querying the bios, and store it as a variable. It then calls the variable at the end of the password entry.

 

Im no coder, so anyone with any idea about coding could probably do this 10 x better / easier, but both seem to work really well (inside the os)

[Guest obsidianpillar]

Hi Tom,

Sorry i've only just seen your message.

I currently have two scripts which can accomplish changing the admin password to a serial - both are similar.

 

 

 

 

For this to work you would need to set the execution policy to remotesigned.

 

Both find the serial from a querying the bios, and store it as a variable. It then calls the variable at the end of the password entry.

 

Im no coder, so anyone with any idea about coding could probably do this 10 x better / easier, but both seem to work really well (inside the os)

 

 

Cheers for this script, may come in useful.

 

Tom