Is there a group policy that would push a new user name and password to all local machines on a network?

Question

I work on a small network that runs on windows server 2003, and with machines running xp. Is there a group policy that could push a new user name and password to replace our old local administrator user accounts?

Answer 1

I use pspasswd from sysinternals.

http://www.microsoft.com/technet/sysinternals/Utilities/PsPasswd.mspx

Here is a user automating it:

http://forum.sysinternals.com/forum_posts.asp?TID=9469

Edit:

I also just found this which is exactly what you are asking for:

http://www.gilham.org/Blog/Lists/Posts/Post.aspx?List=aab85845-88d2-4091-8088-a6bbce0a4304&ID=505

Answer 2

I use a computer startup script to do this for local "Administrator" passwords, combined with a "trap door" group membership so that the script only runs once.

• Create a group in the AD - "Local Administrator Password Set". Modify the permissions on the group to allow "Domain Computers" to "Add/Remove Self as Member".

• Create a new GPO, "Set Local Administrator Password" and link it wherever you want in the directory. Modify the permission on the GPO to DENY "Apply Group Policy" to members of the "Local Administrator Password Set" group. Remove the "Authenticated Users" from the stock permission and add "Domain Computers" with "Read" and "Apply Group Policy" permission.

• Add a startup script to the GPO with:

  NET USER Administrator new_password_here NET GROUP "Local Administrator Password Set" %COMPUTERNAME%$ /ADD /DOMAIN

• Link the GPO wherever I want it to apply.

(I really enjoy doing "trapdoor" scripts like this. I use them to run SYSOCMGR the first time a new PC is joined to the domain, etc.)

Answer 3

Password, no; you can, however, set the Administrator username using GP. It's under:

• Computer Settings
• Windows Settings
• Security Settings
• Local Policies
• Security Options

Find the one called "Rename administrator account", and change it to whatever you want.

For re-setting the password, we've simply set them all on installation to ridiculously long strings, then created a "Workstation Admin" group in Active Directory; then, using Group Policy, go to:

• Computer -> Windows -> Security -> Restricted Groups

Add the new group, and make them a member of "Administrators". So long as your PCs are joined to the domain, and you give your techies membership of this group, they can log on using their personal Active Directory accounts, rather than sharing a local administrator account (which gives you much more accountability!).

Your mileage may vary when using this technique on laptops or machines that are often disconnected from AD, of course.

Hope that helps!

Answer 4

You can attach a startup script for the computer account. This can check the existence of a user and if it's not there, create it. The catch is ensuring the password is encrypted in some manner. However, it sounds like you just want to rename the administrator account. If so, see Keith's response. You can rename via GPO and that's the way to go. Setting the password is more difficult and can't be done directly via GPO except through a startup script.