Local Administrator Password Puzzle

[Andie]

:oops: I seem to be unable to log on to the our XP workstations as local administrator. When I install software, I use Ghost images and Sysprep. The inf file for sysprep contains the local admin password, or so I thought. But although the imaging and setup of workstations has been working fine, I can't log on to the machines locally with the local admin password.

 

Our old Win2k workstations haven't been sysprepped/imaged since we got the Win2003 server, and I can still log on to these locally successfully.

 

I did look at trying to reset the local password, but got a nasty warning from Windows when I tried so I abandoned it.

 

Is there a password that may have been set at a deeper level on the machines that would prevent the local admin password behaving properly?

 

Help! Please!

[danIT]

why dont you just reset the local password? plenty of bootable cd's out there that will do what you need?

[plexer]

Log on to the machine as a domain admin and via users and passwords or the same section through computer management change the local admin password?

 

Ben

[CyberNerd]

http://home.eunet.no/pnordahl/ntpasswd/

 

* This is a utility to (re)set the password of any user that has a valid (local) account on your NT system.

* You do not need to know the old password to set a new one.

* It works offline, that is, you have to shutdown your computer and boot off a floppydisk or CD. The bootdisk includes stuff to access NTFS and FAT/FAT32 partitions and scripts to glue the whole thing together.

* Will detect and offer to unlock locked or disabled out user accounts!

* It is also an almost fully functional registry editor!

[thom]

I have used this tool in the past

If you have, lets say, 100 Windows NT® or Windows 2000® workstations, it can be a very time consuming task to change the local administrator account password on every one of them.

But with DCPC you don't have to go from one computer to the next anymore. You can change them all from your workstation. All you need is administrative privileges and DCPC.

This is a free tool and is quick and easy without messing about with boot disks.

http://www.danish-company.com/dcpc

I haven't tried it on XP workstations but I presume it will work OK

[Andie]

Thanks, all. As I did say in my posting, I was worried by the warning message that came up in Windows suggesting dire consequences if I reset the Administrator password.

 

But as you have all suggested I do this, can I assume that it won't do anything awful?

 

And does anyone know why the password set in the sysprep.inf file doesn't work?

[thom]

We have had issues where the sysprep hate password if it has been encrypted so now we just leave it as plain text and that solved that problem.

 

In terms of the warning message it only causes problems if the user (administrator) has used EFS to encrypt any files, if so they will become unreadable unless you have an EFS administrator to sort it out (and even then it is tricky). Apart from that it won't cause any problems.

[ArchersIT]

I have a similar problem to this, until I realised that the password was fine, it was just the script had DisableAdminAccountOnDomainJoin set.

 

One of those "Doh!" moments when I realised - may be worth checking?

 

Jonathan

[ChrisH]

I have a similar problem to this, until I realised that the password was fine, it was just the script had DisableAdminAccountOnDomainJoin set.

 

One of those "Doh!" moments when I realised - may be worth checking?

 

Jonathan

I seem to remember a problem with some images where the password on the image had to be blank in order for sysprep to change it. That may have been 2000 though. You can change all the local admin passwords witha startup script or a clever psexec script.

[tosca925]

I have a VB script that runs at OU level in the GPO that resets the local/administrator password to whatever you tell it.

 

I had to use this recently on all our clients after our dopy senior tech shouted the old password accross a room full of kids whne he could not login (because he had caps lock on) :-(

[Andie]

We have had issues where the sysprep hate password if it has been encrypted so now we just leave it as plain text and that solved that problem.

 

I have checked the sysprep inf file again, and it has encrypt password set to NO. Also, I don't have the DisableAdminAccountOnDomainJoin string set, so it can't be that either.

 

I guess I shall have to reset the password manually, but each time I sysprep I'm going to have the same problem.

 

Just a thought, and to demonstrate my ignorance, when I do sysprep on the XPs, I choose Mini-setup and Reseal. These wouldn't be affecting things, would they?

[GeeDee]

No - but if you are sysprepping a machine with an administator password set that is NOT a blank password then then the sysprep password settings (either scripted or set via the GUI during mini-setup) will have no effect on anything and the pre-existing password will remain set.

 

[ChrisH]

No - but if you are sysprepping a machine with an administator password set that is NOT a blank password then then the sysprep password settings (either scripted or set via the GUI during mini-setup) will have no effect on anything and the pre-existing password will remain set.

 

 

I thought as much I mentioned it earlier.

[kylewilliamson]

You can use 'cusrmgr' to remotely change local passwords across a domain

[Andie]

Hmm, sorry if this is taking me a long time to get my head round. But are you saying that if the person who set the machine up in the first case entered an Administrator's password for that machine, then the password in the sysprep file will not take effect? And the sysprep/imaging will still work, but just won't reset the password? So I would need to talk to the ICT provider who set the machine up in the first place to get hold of my Admin password?

[GeeDee]

But are you saying that if the person who set the machine up in the first case entered an Administrator's password for that machine, then the password in the sysprep file will not take effect?

 

Correct. It can't reset the password unless it's blank.

 

And the sysprep/imaging will still work, but just won't reset the password?

 

Yup.

 

So I would need to talk to the ICT provider who set the machine up in the first place to get hold of my Admin password?

 

Or just reset the password to blank yourself before you sysprep the machine. Or reset the password to whatever you want before you sysprep and that's then your password, irrespective of whatever sysprep does.

[Andie]

Phew, thanks guys for your endless patience! I shall hopefully have my XP machines sorted out before half-term - yippee!

[Andie]

For those of you that like a happy ending:

 

I set aside Wednesday last week to begin resetting the admin passwords, still not knowing the currently set password, and still, despite all your reassurances, a bit anxious that I might just do something bad to a machine (only techie and currently no backup if things go wrong, you see).

 

Then I had a belated moment of inspiration on the Monday beforehand. I tried typing in password as the password, and (fanfare) it worked! So come Wednesday I could breathe easy and have now reset all my machines with a new local admin password the nice and safe way. Just have to edit the sysprep inf file to match the new password and everything will be as it should be.

 

No idea how the password got set to password. I didn't set the machines up in the first place, but the people who did asked me for the password I wanted to use and put that into the sysprep inf file for me, which is why I was very confused when it didn't work. But every cloud has a silver lining, and I now know a lot more about admin passwords and sysprep as a result of all your help! Thanks again!

[Ric_]

@Andie: You need not be so worried about using the 'offline password reset' tools - there's one on UBCD that should do the trick.

 

The only problem that I have had is that it hasn't reset the password... run it again and it was fine... odd! It also works better using a blank password with the reset tools.