[1903, au] Bulk adding a local administrator account?

[talksr]

Hi there,

Is there a way I can add a local admin username and password to a set of devices in an OU on Active Directory?

 

The school has kindly been donated 30 laptops. I am adding them using WDS and Deployment Workbench to the server but thought it would be useful to have local admin accounts pre-setup so that if there is another lockdown, the laptops could be handed to children who could use workstationname\localadminaccount as the username to get on at home.

 

Any help would be great.

[djm968]

You could do it with Powershell

 

https://gist.github.com/ducas/3a65704a3b92dfa0301e

[talksr]

You could do it with Powershell

 

https://gist.github.com/ducas/3a65704a3b92dfa0301e

 

Thank you, very helpful. What is the best way to put this on Group Policy? I have only really used batch files in the past.

[Garacesh]

Thank you, very helpful. What is the best way to put this on Group Policy? I have only really used batch files in the past.

 

Same method. Startup Scripts can be .ps1 files

[talksr]

Same method. Startup Scripts can be .ps1 files

 

 

Thanks very much

[djm968]

Copy the PowserShell code into notepad to create a text file, just as you would with a batch file and save it as "yourfilename.ps1" The netlogon folder is probably the most obvious location.

 

Create or Edit a GPO object and add the script to the PowerShell Scripts tab at the location below.

 

Computer Configuration\Policies\Windows Settings\Scripts (Startup/Shutdown).

 

Further info here.

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn789196(v=ws.11)

 

It should work as a startup script but if not, you can also assign it as a logon script.

[Chaniel]

You'd give students access to a local administrator account? Even if another lockdown happens, that's a bad idea.

[Boredguy]

to be honest, you would be better setting up a standard local user and not a admin user, as even the DfE laptops were configured for the students to use a local user account.

 

However if you have the infrastructure available, setting up Always On VPN with device tunnel might be a better option.

[Garacesh]

Er, yeah, I didn't even read why you wanted this.

 

Giving kids localadmin is a terrible idea. As soon as you do, every single one of your safeguarding provisions is rendered moot, as they can remove them all.

[talksr]

Ok, good point, so I would change administrators in the ps1 code to Users? Then they would be part of the users group and nothing else?

 

 

$Username = "su"

$Password = "password"

 

$group = "Administrators"

[djm968]

Yes that should do it.

[talksr]

Yes that should do it.

 

Thank you, I am trying through Startup script, but it doesn't like it, it has not made a change.

Do you have any ideas?

[thimon]

LAPS would be a much better route to go down.

[talksr]

Will look into LAPS, but in the mean time, I have made a simple PowerShell to add a local non admin account with no password.

Works perfectly on PowerShell, I have added it as a command prompt Task Sequence for our 1909 build on MDT. I am now getting the following:

 

It works perfectly on a W10 system when I run Powershell. Really not understanding why this is so difficult to achieve.

I added the Task Sequence at the end of Postinstall named it Create Local User Account, Run command line and it runs: powerhsell.exe New-LocalUser "LocalUser" -NoPassword -FullName "Local User Account" -Description "Local User Account" -AccountNeverExpires.

[Guest Guest]

Will look into LAPS, but in the mean time, I have made a simple PowerShell to add a local non admin account with no password.

Works perfectly on PowerShell, I have added it as a command prompt Task Sequence for our 1909 build on MDT. I am now getting the following:

[ATTACH=CONFIG]62696[/ATTACH]

 

It works perfectly on a W10 system when I run Powershell. Really not understanding why this is so difficult to achieve.

I added the Task Sequence at the end of Postinstall named it Create Local User Account, Run command line and it runs: powerhsell.exe New-LocalUser "LocalUser" -NoPassword -FullName "Local User Account" -Description "Local User Account" -AccountNeverExpires.

Did you copy and paste that? You misspelled powershell

[talksr]

Did you copy and paste that? You misspelled powershell

 

Well spotted, but no, I typed manually as server is on another computer so can't copy and paste. It is spelt correctly on server and running like a dream if I do it as administrator on PowerShell by copying and pasting.

[Norphy]

These are domain members? Can you use a group policy preference to create local users? The option is there:

 

 

I've admittedly never tried, but it looks like it should work.

[Guest Guest]

These are domain members? Can you use a group policy preference to create local users? The option is there:

 

[ATTACH=CONFIG]62698[/ATTACH]

[ATTACH=CONFIG]62699[/ATTACH]

[ATTACH=CONFIG]62700[/ATTACH]

 

I've admittedly never tried, but it looks like it should work.

You can't sent passwords via GPP

[talksr]

You can't sent passwords via GPP

 

It won't work, it won't let me even put in a username, it is all greyed out. Don't even know why it is there if it can't be used. When you select Create from the drop down, everything is greyed out.

[psydii]

not necessarily helpful to the OP, but I've discovered you can use Defender "Live Response" to run a script that adds users on an ad-hoc basis to the local administrator group. Let them perform the task (typically for us this was for Creative Cloud installs), then run another script to remove their admin access.

[psydii]

It won't work, it won't let me even put in a username, it is all greyed out. Don't even know why it is there if it can't be used. When you select Create from the drop down, everything is greyed out.

Because it used to work. Feature was disabled after it became trivial to decrypt the passwords stored in SYSVOL

 

It remains because people need to be able to see it if configured - and the GPO system has not received any meaningful development since Vista.