Local Admin password GPO

[Shadow_Walker]

After taking over a site a couple of months back we have found that a lot of windows 7 machines were never set a local admin password. I set up a GPO basically following these instruction https://www.avoiderrors.net/change-local-administrator-password-gpo/ and for whatever reason it still will not set the admin password. Edited September 13, 2017 by Shadow_Walker

[Katy]

Not sure why that method wouldn't work, but as a work around you could stick in a startup script containing:

 

net user Administrator newpasswordhere

 

and then get rid of it again once they've all been restarted. Only problem is keeping the password in plain text so you'd have to put it somewhere users can't get at. In theory it should work as startup scripts run as the SYSTEM account.

[Scrambles]

Have you had a look at Microsoft LAPS?

We use it across our network. Basically it sets a random password to the administrator account and writes it back into AD so each machine has a unique local admin password.

[Katy]

Have you had a look at Microsoft LAPS?

We use it across our network. Basically it sets a random password to the administrator account and writes it back into AD so each machine has a unique local admin password.

Oooh that looks really useful actually, might give it a go

[Shadow_Walker]

I was hoping the gpo would work as it was a quick fix

[Scrambles]

LAPS is an MSI that also comes with an ADMX so it can be controlled through Group Policy

Super easy to setup. Kinda annoying as well since you need to look up the local admin password before you can logon. However, I find the need to use the local admin password these days is less and less. Mainly just a security thing now.

[ajs]

The ability to set the local administrator password via a GPO was removed in an update years ago and it was deemed a potential security issue. LAPS is certainly the way to go now.