Is there a simple way to set the built-in local admin password on all clients?

[TwistedHelixis]

Just wondered if there was a simple way to set the password on the built-in local admin account on all domain clients?

 

Currently we have the built-in local admin account disabled but recently had an issue after needing to change our IP and subnet to a new range, and almost locked ourselves out from every client computer on the domain. Managed to get back in by using a back door to enable the built-in local admin account so have decided it might be best just to have this account enabled, but with a very strong password.

 

I don't want to use LAPS by Microsoft as this looks overly complex just for a small primary school and we also don't want random passwords for each client. I want to set the same password and then keep this in the safe.

 

Most forums seem to suggest using SolarWinds but with all the news articles about them being hacked I would rather see if I can find a different way.

 

Any ideas?

[robk]

Seriously, LAPS is built for this type of application, Keeps things secure, and isnt as complex as it first looks.

[sparkeh]

Agree with @robk LAPS is really what you need.

 

But if that’s not an option could you use group policy to set local admins?

 

https://thesysadminchannel.com/add-local-administrators-via-gpo-group-policy/

[TwistedHelixis]

Seriously, LAPS is built for this type of application, Keeps things secure, and isnt as complex as it first looks.

unfortunately this also requires access to the domain server to get at the passwords, which I would like to avoid if possible.

 

But if that’s not an option could you use group policy to set local admins?https://thesysadminchannel.com/add-l...-group-policy/

I could be wrong but think this just adds a domain group to the local admins account on the client machine, I need to set the actual local admin password that comes built into Windows desktop OS.

[Steve21]

Any "official" way of changing the local admin passwords were blocked years ago because it was so exploitable via GPP etc. Which is when LAPS was really brought in

 

You "could" bodge it via NET USER to enable it and then change password using a start-up script or remote powershell etc but obviously more of a security risk

 

How many machines are you talking if it's a primary school? Might just be quicker/safer to manually do it? (or even if you enable it via a bodge method, change them manually after )

 

Steve

[TwistedHelixis]

Well I have no just discovered that the LA setup restricted groups already, and looking at the link above they used 'Members of this group' which wipes out all local groups.

 

So now I need to get my head round how that all works :-(

 

I'll start a new forum post if I have any questions about that

[HPlum78]

I know you have said LAPS ain't the route but I am in this camp and if you want to be supported then it's the only option you have. It's not overly complex at all.. I would like to unpick the issue around access to a domain server? What are your thinking the risks are here?

[TwistedHelixis]

I would like to unpick the issue around access to a domain server? What are your thinking the risks are here?

OK, so I have worked out part of my issue but not the fix just yet.

 

When I setup a new device I always create a new local admin account (local_admin) with a very complex password and disable the built-in admin account. At this school after an IP range change there were a number of desktops that for whatever reason didn't pickup the new IP range, couldn't see the server anymore and when I tried to login using my new 'local_admin' account it was no longer an admin account, so I couldn't easily fix the issue. BTW it was the LA that did the IP migration.

 

Because the LA used the destructive part of restricted groups and I didn't realise, I was then not able to login as my 'local_admin' account when some clients lost access to the server.

 

So now I know this school has restricted groups.

 

Next I need to workout if I can add my new 'local_admin' account I have manually setup on all computers into the restricted groups already there, so it becomes a local admin. When I look at the GPO it just lists domain groups, not users. I am hoping it lets me add local users in a similar way it adds domain groups.

[thimon]

LAPS all the way. Use it here and it’s brilliant! Very easy to use.

[chaplic]

+1 for LAPS (and if you don't own the AD to allow the changes to be made, chase those who do)

 

However, in the days before LAPS what I've seen done is scheduled task on bootup that sets an admin password based on a hash of the machine name + salt, and a little app to figure out what the admin password would be (a poor mans laps), the little app is essentially an admin account for all. But nice thing about this about it is no generic local admin password = no easy lateral traversal and no hassle of someone finding out the generic admin password

 

You can also put local accounts in via restricted groups. Also a nice trick you can use environment variables too, so create groups in AD called MACHINENAME_Admin or similar to give per machine admin rights.

[TwistedHelixis]

I managed to use restricted groups to make my local_admin user an administrator. I'll look at LAPS in a few weeks.

 

Thanks all

[Jaymate]

Defo Look at LAPS - If an attacker gets the local admin account of one of your machines I am admin on all of them!